▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
░  O P S E C   / /   G H O S T
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓

This guide covers personal digital privacy and security hygiene. It is educational, not legal advice — if you're in a high-risk situation, pair it with guidance from a lawyer or a trained security trainer. Tip: press ` or the shell button below to open an interactive terminal.

##01 // Threat Modeling

Before you touch a single setting, answer five questions. Everything else in this guide is just tooling for the answers.

• What do I actually want to protect? (Location, real name, photos, contacts, browsing habits.)
• Who do I want to protect it from? (A nosy ex, an employer, advertisers, a stalker, a government.)
• How bad are the consequences if I fail?
• How likely is the threat to actually target me?
• How much friction and inconvenience am I willing to accept to lower the risk?

A useful shortcut

Write your threat model as one sentence: "I'm protecting [asset] from [adversary], and if it fails [consequence] happens." Revisit it whenever your life circumstances change — a breakup, a new job, a move, increased public visibility all shift the model.

##02 // Crypto Lab

Everything else in this guide — Tor, Signal, disk encryption, password managers — is a wrapper around a handful of cryptographic primitives. Understanding them makes every other decision easier. The tools below run entirely in your browser; nothing you type here is sent anywhere.

Glossary

• Symmetric encryption — one key locks and unlocks the data (AES). Fast, but both sides need the same secret.
• Asymmetric encryption — a public key locks, only the matching private key unlocks (RSA, Curve25519). Solves how two strangers agree on a secret.
• Hash function — a one-way fingerprint of data (SHA-256). Same input always gives the same output; you can't reverse it back to the input.
• Digital signature — proves a message came from a specific private key and wasn't altered in transit.
• Forward secrecy — even if a key leaks later, past conversations stay unreadable. This is how the Signal protocol works.
• End-to-end encryption — only the two endpoints hold the keys, not the server relaying the message.

Live hash generator

Toy cipher (XOR)

Password strength lab

Fingerprint practice

Best practices

• Never write your own encryption algorithm — use vetted, open, peer-reviewed implementations (AES-256, ChaCha20, Curve25519).
• Verify checksums and signatures on anything you download before you run it, not just one or the other.
• Keep a master signing key offline; use short-lived subkeys for everyday work.
• Store your revocation certificate somewhere separate from the key itself, in case you ever need to kill it.
• Prefer tools that give you forward secrecy for daily messaging over ones that don't.

##03 // Compartmentalization

The single most common way people get deanonymized is linking two identities they meant to keep separate. Compartmentalization is the discipline of never letting that link form.

• Use a distinct email, username, and password for each persona — never reuse a handle across contexts.
• Keep a dedicated browser profile (or browser entirely) for sensitive activity, separate from your everyday one.
• Use email aliasing so a leaked signup email can't be traced back to your primary inbox.
• For high-stakes separation, use a separate device or virtual machine rather than just a separate browser tab.

• Never log into a personal account "just for a second" from an anonymous session — one slip links everything permanently.
• Don't follow, friend, or message your real-world contacts from an anonymous persona.
• Watch for shared recovery emails/phone numbers across accounts — a password reset flow can be the leak.

##04 // Networks: VPN vs Tor

These solve different problems. Neither one makes you "anonymous" by itself.

VPN

Encrypts your traffic between you and the VPN provider, hiding it from your ISP and local network. It shifts trust to the VPN provider instead of removing it — they can usually still see what you connect to. Good for: hiding browsing from your ISP or a shared network. Not a substitute for anonymity from the sites you visit.

Tor

Routes your traffic through three independent relays so no single point can see both who you are and what you're accessing. Slower than a VPN, and exit nodes can see unencrypted traffic — always prefer HTTPS. Good for: anonymity against network-level observers. Bad idea: logging into personal, identity-linked accounts over Tor, which defeats the purpose.

• Don't casually combine VPN + Tor without understanding the trade-off — misconfigured, it can reduce your anonymity set instead of improving it.
• Public Wi-Fi captive portals and networks operated by an adversary (a workplace, an abusive partner's router) can still see connection metadata even with a VPN.

##05 // Metadata

The content of a file is rarely the leak. The metadata riding along with it usually is.

• Photos carry EXIF data — GPS coordinates, device model, exact timestamp — by default.
• Documents carry author names, edit history, and software fingerprints in hidden fields.
• File names and upload timestamps can reveal patterns even when content is scrubbed.

• Strip metadata before posting photos publicly, especially anything taken at home.
• Screenshot instead of sharing original files when you only need the visual content.
• Assume any file you didn't personally scrub still has your fingerprints on it.

##06 // Secure Communications

• Use an end-to-end encrypted messenger (Signal is the widely recommended default) for anything sensitive.
• Turn on disappearing messages for conversations that don't need a permanent record.
• Verify safety numbers / keys out-of-band with people you communicate with regularly, over a high-trust channel — see the fingerprint tool in 02_crypto-lab.md.
• For email that must be encrypted, PGP/GPG protects content — but not the fact that you emailed someone, or when.

• Avoid SMS for anything sensitive — it's not encrypted in transit and is vulnerable to SIM-swap attacks.
• Encryption hides content, not metadata — who you talked to and when is often visible to the platform regardless.

##07 // Hardened Operating Systems

Tails

A live, amnesic OS you boot from a USB drive. Routes all traffic through Tor by default and leaves no trace on the host machine when you shut down. Good fit when you need a clean, disposable environment for a single sensitive task.

Qubes OS

Builds compartmentalization into the operating system itself — each task runs in its own isolated virtual machine, so a compromise in one "qube" doesn't spread to the rest. Steeper learning curve, strong isolation guarantees.

Whonix

Runs as a pair of virtual machines — one that only talks to Tor, one where you actually work — so even a compromised application can't learn your real IP address.

• For daily-driver Linux use, full-disk encryption and regular updates cover most people's threat model.
• Minimize installed packages — every extra piece of software is extra attack surface.
• Always verify the checksum and signature of an OS image before you boot it — see 02_crypto-lab.md.

##08 // Browser Hygiene

Your browser leaks far more than cookies. Fonts, screen size, installed extensions, and even how your GPU renders a canvas element combine into a fingerprint that can identify you without a single cookie.

• Use a privacy-hardened browser (Tor Browser, Mullvad Browser, or a hardened Firefox) for sensitive sessions.
• Use separate browser containers/profiles to keep sites from linking your activity across them.
• Block third-party trackers by default rather than opting out site-by-site.

• More extensions means a more unique, more trackable fingerprint — install only what you need.
• A VPN does not stop browser fingerprinting; it's a separate problem with a separate fix.

##09 // Passwords & Authentication

• Use a password manager to generate and store a long, unique passphrase for every account — test what "long" buys you in 02_crypto-lab.md.
• Turn on two-factor authentication using an app or a hardware key (FIDO2/U2F) rather than SMS.
• Give fake or randomized answers to "security questions" — real answers are often publicly guessable.

• SMS-based 2FA is better than nothing, but vulnerable to SIM-swap attacks — upgrade it when the account allows.
• Reused passwords mean one breached site compromises every account sharing that password.

##10 // Operational Habits

Most real-world deanonymization isn't a broken cipher — it's a human habit. Tools fail quietly; habits fail loudly.

• Writing style is a fingerprint too (stylometry) — distinctive phrasing can link an "anonymous" post back to your normal voice.
• Consistent posting times, locations, and routines build a pattern of life that's identifying on its own, no names required.
• Casually mentioning your security precautions to people outside your trust circle undermines them.
• Urgency and pressure in a message are classic social-engineering tells — slow down before you act on either.

• Lock your screen every time you step away, even at home.
• Cover your webcam when it's not in use; be aware of what's visible behind you on video calls.
• Review app permissions periodically — location, microphone, and camera access in particular.

##11 // Quick-Start Checklist

Ten concrete moves. None of them require becoming a security expert.

• Set up a password manager with a unique passphrase per account
• Turn on app- or hardware-key 2FA on your main accounts (not SMS)
• Separate your identities — a distinct email/handle per context
• Install a privacy-respecting browser and block third-party trackers
• Strip metadata from photos and documents before sharing publicly
• Set up Signal with disappearing messages for sensitive chats
• Turn on full-disk encryption on your laptop and phone
• Write your threat model down in one sentence
• Review app permissions — location, mic, camera
• Learn what Tor is actually for, and when you need it

##12 // Further Reading

• EFF Surveillance Self-DefenseDeep, scenario-based guides from the Electronic Frontier Foundation — start here for a specific threat model.
• The Tor ProjectOfficial documentation for Tor Browser and how onion routing actually works.
• Privacy GuidesCommunity-maintained, regularly updated tool and software recommendations.
• TailsThe amnesic live operating system referenced in section 07.
• Qubes OSCompartmentalized, VM-isolated operating system referenced in section 07.