absolute.red

A hub for offensive security professionals, red-teamers, and digital privacy enthusiasts.

How to protect your/others' privacy in the digital realm

General advice

  • Avoid traditional DNS servers and use DNS-Over-TLS (DoT) or DNS-Over-HTTPS (DoH). To find a tool, look here.
  • Disable telemetry if you use Windows as your primary OS. Check this.
  • Use Whonix / Tor Link or Tails as a VM.
    • Make sure that you encrypt the VM's HDD.
  • You can use Qubes OS as your primary OS. Here is why (Tor-Broswer required) + how to use it!
  • GrapheneOS is the most rational pick for your mobile device.
  • DO NOT use clearnet and Tor/Proxy at the same time.
  • If someone uses a nickname (in social media) and you know the person, do not talk about their real name, gender, tattoos, piercings, physical capacities, disabilities, profession, hobbies, or involvement in activist groups.
  • Always use full disk encryption (for physical computers and VMs). Encrypt your disk(s) using VeraCrypt/LUKS.
  • Remember: The longer the same pseudonym/Nickname/ID is used, the higher the probability that mistakes will be made that reveal the user's identity.
  • Avoid posting full system logs or complete configuration files.
  • Be more careful with your screenshots. Double-check before posting them / sending them to someone else.
  • Remove all the metadata from your pictures before sending them to others. You can use exifcleaner.
  • Avoid (mobile) phone number verification. (Use only with caution.)
  • Always separate non-anonymous and anonymous accounts.
  • Telegram is not a safe platform. Here is why. You can consider Signal as an alternative.
    • Telegram does not have end-to-end encryption for group chats.
    • The encryption protocol called MTProto uses a 2048-bit Diffie-Hellman key exchange algorithem. However, the protocol relies on the server to choose specific cryptographic parameters.
  • Use PGP when sending an important/sensitive email/data.
  • Reboot your device (PC, smartphone, etc.) daily.
    • This action can help prevent an attacker from gaining further access to your device/network after a successful exploration attempt.
    • It also decreases the chance of successful persistence.
  • Use Self-hosted image scubber / online version in cases where you want to remove faces from a picture. E.g., anonymizing photographs taken at protests.
  • Use a web service instead of installing an application on your smartphone.
  • If you don't use Tor or VPN, browse in incognito or private mode. If you can't, use the container tabs in your browser. This helps you isolate websites' data (like cookies and trackers) into separate containers/spaces, preventing cross-site tracking.
  • Disable image autoloading in email clients/web services.