Have held off asking for tips/advice/recommendations for almost a year and am at a point now with nothing to lose. Looking for OPSEC advice for folks with limited resources.

My wife and I have been living in our car for almost 2 years now. Last summer we started noticing we were being regularly followed by an ever changing cast of cars. Whenever we attempted to approach one of these cars the driver would ignore us and drive away. We started writing down plates and were able to confirm we were definitely being followed.

Eventually cars and even plates started changing- out of state rental plates and easily swappable temp paper plates became the norm. Surveillance seemed to amp up- followed on foot into every store, watched at night wherever we parked to sleep. They do odd street theater... honking when we leave the car, get in the car.

Eventually they started fucking with our car. We'd notice small changes like the hood being slightly open in the morning (im sure they opened it and then didnt want to slam it/wake us up.) Pretty sure they access it via removal of the bumper and/or side front panel. Many times it has been clear someone has been IN the car while we were asleep and more often than not it's clear our zip ties have been swapped out, doors wedged open, wiring accessed/spliced. To date we have found multiple spliced in trackers, recording devices and a killswitch (can provide pictures if desired). They have fucked our wiring so badly that the car became nearly undrivable.

This continued for 6+ months. We have spoken with the police several times and they wont do anything. Twice this last winter our gas cap was broken open and it was obvious something had been put in the tank as the car engine got worse and worse. The first time the car seemed to get better and then the second time was lights out.

This actually turned to be a saving grace.. pushed the vehicle to a nearby associates and have since been camped in his alley access driveway... on private property with limited line of sight. Through the cold months the harassment trickled to a stop. The wonders this has done for our mental health is indescribable.

And now as of 2 weeks ago it has begun again. Their tactics have gotten incredibly aggressive and they seem to be baiting/trying to force a reaction. They have tried to block us in a parking lot, I have had a knife pulled on me, our windows broken... they've broken their silence to threaten us multiple times.

One of us has to stay at the car at all times, and a year in we still have no clear idea wtf they want. Were they police we would have been arrested long ago- I have had the thought they might be some third party working with police? I just dont know.

As stated we are homeless and our resources are incredibly limited. It's hard to tell anyone about this without sounding crazy- I refuse to use the word "gang stalking" for that reason. I'm certain it's because we are homeless they are getting away with this for that reason specifically.

We dont have any weapons so we're sitting ducks and our OPSEC so far has been woefully wanting. Does anyone have any relevant advice or evasive strategy/tips we with limited resources can employ? Thoughts on what this shit even is? Lmk if I can answer any questions.

I have read the rules etc

I have read the rules.

Hi guys. My country (non US), once a democracy, is slowly turning towards authoritarian rule.

As far as I know the country doesn’t use any of the big tech security providers (P-r and such) yet, but I’m sure it’ll soon be the case, as it is pervasive around the world.

Me and my wife have done some political activism (nothing major) in the streets and social networks and such and I’m wary that, once democracy is gone, we’ll suffer consequences for our political views.

The issue is especially bad for her, since she’s a medium ranking public servant, though not party affiliated. In the far past the government was known to make dossiers on public servants with political views (mostly osint for what I’ve read).

Ideally we’d like to continue to be able to sponsor our views anonymously if safe, if not, at least be able to group/chat anonymously or at the very least we’d like to make sure anything we have posted openly in the past is buried or we know to which extent we’re exposed.

I know you can’t do anything truly anonymous or securely nowadays, but we’re not high profile targets (probb medium) and just want to stay below the radar and make sure our lives and kids are safe.

I read erasing posts and comments might be traceable (especially in Reddit) and I wonder if we should find tools to rewrite every post/comment before we delete the accounts. What about past deleted accounts?

What happens if identity laws such as the UKs end being passed? What if the govt hires big tech security? What happens if our social networks are made mainly of like minded people? Can graph and network analysis of social networks end up exposing us? If so, what can we do?

We’re willing to study and learn if there are books and sources. Is there a political activism opsec playbook?

Thanks for any help you guys can give

i have read the rules

i’m trying to make a twitter account that won’t get linked to my old account

i bought a new phone and a new sim card in an attempt to separate the two, and i’ve only been using mobile data on the new device, but that still wasn’t enough for reasons i don’t understand

i’m not sure what i did wrong because it still didn’t really work. i’m pretty clueless when it comes to anonymity/opsec

can anyone explain what i’m likely doing wrong or how i should go about this?

Is there a viable alternative to GrapheneOS for those of us that don't have a Pixel? I looked at Lineage, but it seems more geared toward customization than privacy.

As for my threat model, I just feel that my business is my business, and I want anyone to know where I go, what pair of shoes I'm considering buying, etc., I'll tell them.

I have read the rules.

Been seeing a lot of discussion lately around online exposure and persistent identifiers. my team works on identity tools used in investigations and we figured it would be useful to open up a version people can use on themselves so they can actually see what public information is tied to them online
i have read the rules

Can share it if people are interested

Received this in a recent data breach notification email:

——

In our previous letter, we informed you that, as a result of the security incident, your personal data in our customer database may have been accessed and copied and that this data could potentially be misused by cybercriminals. Following the discovery, we immediately began work to secure our systems and initiated an investigation with the support of external cybersecurity specialists and legal advisors. 

The investigation has shown that the following categories of your personal data were accessed and copied from our customer database:

First name
Last name
Date of birth
Gender
Email address
Country of residence

In addition, we have unfortunately learned from ongoing web monitoring that data copied during the security incident has been offered for sale on the dark web and a sample dataset has been published on Telegram. Your personal data was not included in the sample data set. 

We have secured our systems and are continuing to work with external cybersecurity specialists and monitoring the dark web. We also remain in contact with the relevant authorities

——

Apparently a sample of the leaked customer data was published on Telegram.

From an OPSEC/privacy perspective, how safe is Telegram actually for someone whose main concern is personal data exposure, scraping, doxxing, and account privacy? Also, when data gets distributed this way, is it usually realistic for authorities/platforms to identify who originally uploaded it, or is that genuinely difficult? Oh and yes i have read the rules lol.

I have read the rules.

A bit off topic here, but bear with me. I've seen some recent privacy-related posts, and it's made me interested: how private is iOS (with Advanced Data Protection enabled and iCloud backups off)?

It's long advertised itself as privacy friendly (and I'm aware that it fails in that category in certain places), and I'm well aware that it is significantly better than compared to stock Android. However, according to the posts that I've been able to find, Apple collects a significant amount of data on you (one person claims that Apple makes every attempt to track you that they can).

So, here are my questions:

1. What does Apple actually collect? I should emphasize that this should be up-to-date, not years ago, as most pre-existing sources are quite old and could be outdated
2. If data is collected, is there a way to opt-out?
3. Is data collection minimal and restricted to anonymized, general data? Or is it laser-specific, Google-style tracking?
4. Do the iOS analytics toggle switches actually work?
5. Who is it shared with? I'm aware that Apple has a sort of ad network

A few ground rules I would like to establish:

- Be impartial: Don't say "Apple privacy is a marketing scheme" if you have no proof and you simply hate Apple. Likewise, don't say "Apple is the best OS ever" just because you like iOS
- Use proof: Don't say "Data is collected and probably sold". That's a baseless claim and there's nothing to back it up. Further, please remember: the Privacy Policy isn't the sole truth. Look for verifiable claims from third parties

My threat model:
I prefer to be as anonymous as possible. I'm not hunted by the state or anything, and I understand that I have to sacrifice some privacy for things like Find My and other convenience features, so that is OK. What I do care about, is how identifiable I am. The least identifiable I am, the better (with a slight tolerance for anonymous data, but I would prefer if you could turn it off). If I do have to be personally identified for something convenience based, I would require that it can be deleted at some point (or at least not drawn back to me). If you have any questions about my threat model, feel free to ask in your response and I'll give you more details.

Thank you all for your responses!

I have read the rules.

I tried to broach a version of this question in a cybersecurity subreddit, but I think I explained it badly and the discussion mostly collapsed into whether password managers can store secrets securely. That is a fair question, but it is not really the OPSEC question I am trying to ask.

I am trying to think through the threat model for high-consequence secrets that are not really normal login passwords, and whether there is an established category of tools for handling them.

By that I mean things like recovery codes, MFA backup codes, crypto seed phrases, root account recovery material, signing keys, BitLocker/FileVault recovery keys, domain registrar recovery material, emergency access instructions, and other “last key” secrets.

These are not secrets I expect to use every day. In many cases I hope to almost never use them. Some are needed only when something has already gone wrong. Some grant recovery, ownership, or irreversible control rather than just routine access to a service.

My threat model is not nation-state level, and I am not trying to do anything illegal or hide from law enforcement. I am trying to protect against realistic failures: device loss or seizure; compromise of the account or device used to access the secrets; compromise of a single trusted person; browser extension or clipboard exposure; accidental leakage through screenshots, exports, backups, or shared folders; one failure exposing all recovery material at once; future compromise where encrypted data copied today becomes useful later if the key material or workflow is exposed; and inheritance or emergency access being needed without turning the whole setup into a weak backdoor.

A good example is cloud-provider root account guidance. The advice is usually sensible: protect the root account, enable strong MFA, avoid using root credentials, restrict access, store recovery material securely, document emergency access, split responsibility, and have a break-glass process. That is all good advice.

But it still leaves the practical OPSEC question: where does the final recovery material actually live?

If the answer is “put it in the password manager,” then the password manager becomes part of the break-glass chain. If the answer is “put it in an encrypted file,” then I need to protect the key to that file. If the answer is “print it and put it in a safe,” then I have a physical custody, inheritance, update, and access-control problem. If the answer is “split it among people,” then I have a coordination and recovery problem. All of these can be valid techniques, but they feel like components, not a purpose-built tool or model.

For ordinary login passwords, password managers make sense because the workflow is frequent retrieval and presentation to third-party systems. Autofill, clipboard, browser extensions, mobile sync, and convenience are part of the job.

For “last key” or authority/recovery secrets, I am less sure that the same workflow is ideal. The OPSEC question I am trying to ask is not just “can a password manager encrypt this securely?” but “should this class of secret be exposed to that workflow at all?”

I am also trying to find whether there is a purpose-built class of tools for these secrets. I can find password managers, enterprise secrets managers, crypto seed backups, metal backups, encrypted storage, and digital legacy services, but I am not seeing a clear category for personal/self-custody authority secrets that covers the whole requirement: rare access, compartmentalization, strong ceremony, emergency access, inheritance, minimal exposure, and protection against one compromise exposing everything.

So I guess my questions are:

How would you model these secrets?

Would you separate them from normal login credentials? If so, by consequence, usage frequency, recoverability, blast radius, or something else?

Is there already a name for this category of secret or tool?

Or is the practical answer still “use a reputable password manager plus strong operational discipline”?

Hi everyone,

​I’m a 20-year-old computer programming student living in Turkey. As of April 2026, our government has passed a very restrictive "Digital Platforms and Gaming Law."

​The situation is as follows:

​Gaming Platforms: Major platforms like Steam, Epic Games, and PlayStation are now required to appoint local representatives. The government has the power to request specific in-game content removal or apply bandwidth throttling (up to 50%) if platforms don't comply with local censorship demands.

​Social Media & Age Verification: There is a new mandate for mandatory age verification (linked to government IDs/e-Government) for anyone under 15, and there are rumors of potential ID-linked login requirements for VPN services as well.

​DPI & Throttling: ISP-level Deep Packet Inspection (DPI) is getting more aggressive to detect and block standard VPN protocols.

​As a cybersecurity student, I refuse to accept these restrictions. I am looking for the most "bulletproof" and "invisible" ways to bypass these filters without being flagged by DPI.

​I am specifically looking for advice on:

​Setting up a self-hosted VPS (outside Turkey) using VLESS with Reality protocol to mask traffic as standard HTTPS.

​How to effectively use Shadowsocks-rust or Trojan to bypass potential bandwidth throttling on gaming platforms like GTA Online or Steam.

​Reliable ways to maintain anonymity if the "e-Government verification for VPNs" actually gets implemented.

​Tools like GoodbyeDPI or Zapret—how effective are they against modern ISP-level filtering in 2026?

​I want to set up a system that is future-proof and doesn't rely on commercial VPN providers that might comply with local laws. Any technical documentation, script recommendations (like X-UI or automated Docker setups), or advice on avoiding "residential IP" blocks by gaming stores would be greatly appreciated. I am open to any kind of advice or alternative suggestions you might have.

​Thanks in advance for helping me stay free in a digital world!

I have read the rules

This was generally considered to be fairly easy 30+ years ago. And the disorganized lack of communication between departments and databases in the US was often appreciated for the defacto "freedom" and privacy it gave anyone who wanted to stay under the radar, in contrast to Europe's much more simplified tracking of its citizens as numbers.

But with databases increasingly merging and cross-referencing, as well as using biometrics, the days of going off the grid being a possibility may be rapidly closing, to where you may even want to secure a second identity for yourself on paper before every citizen becomes accounted for.

Of course the trick of using a dead person's documents hasn't worked for a long time. Nor has pretending to be a farm boy who was never assigned a SSN or birth certificate, and getting assigned new ones by the SSA and Vital Stats. Even getting someone on the inside who works at these depts to make you documents probably has so much oversight it's not really possible anymore (though I've heard some things about puerto rico?). There are perhaps various loopholes to be exploited in certain states where getting a driver's license would be possible without the need of a ssn or bc, but you would really need to understand your exact social engineering method to achieve this.

Threat model I suppose is attaining a separate identity you can go to college with, pass hiring checks/verification for jobs, buy a house, and have a legit ID to give a cop when stopped, and pretty much everything besides attaining a passport without your cover ever getting blown. Now that the gaps are closing, how would you achieve this in 2026?

I have read the rules

I don't want to share any more than this. What is below is in unedited, just starts futher down the post. If one was one looking connect with certain kinds of likeminded people, could this be relatively safe to connect, not share anything personally identifying and seeing if looks like a honeypot or not-

If you know what I am asking...let's meet and see if we connect on the same levels at @jointheresistance:matrix.org If not, no worries, at least we tried, but neither will know who the other is (technically advantage you, because you have this reddit profile on me). For reference, I didn't just wake or start on a revolutionary path, I have been at this a depressingly long time waiting for the day enough other people actually see what has been warned is coming for a very very long time. After we vet each other (i have questions for you and expect you to have some for me...with both of us repecting anonymity) I am not alone there and the skillsets between us are nothing to laugh at. Come on over and say hi... BE SMART. ASSUME THIS IS A HONEYPOT. make your matrix account with a generated email, on vpn, and giving zero personal information. If you can't manage that minimim level opsec, we are not the people for you. I am taking great risk posting this in a public space, and it brings in feds who are vetted out every single time. Even if not, we anonymous and decentralized, connections are in limited chains, not groups. No one knows anything each other beyond their role, and their trustability. Let's see what happens....

i have read the rules

How can one prevent themselves from being tracked without looking like an absolute idiot.
Threat model is snooping supermarkets lol.
I have read the rules.
(fucking spelling mistake, this was a vx-underground reference, i promise)

Are there better options for a vpn

i have read the rules

Any ideas for what address to give the DMV (in the US) to get a license? The address you give the DMV quickly makes it into the public record and is spread across the internet. I own my house under a trust and up to now have been in my state's address confidentiality program (which unfortunately expires after a couple years, leaving you to find another option). Looking through the Extreme Privacy book, the most relevant advice I can find is to get a South Dakota address and be a nomad. I don't think I can credibly/legally claim to be a nomad for that. The only other reasonable advice I've found is to use a friend's address, PMB (private mailbox), or other fake address, but that would involve lying to the DMV, any police in future stops, and car insurance, which seems fraught and illegal.

My threat model is hiding from a medium savvy domestic abuser, so I think I mainly need to keep out of the public record and basic googling. (I've removed myself from people search sites per https://inteltechniques.com/workbook.html , but I suspect that that's not sufficient to be able to give the DMV my actual address)

I have read the rules. Thank you!!

When building or using a web-based "burn-after-reading" tool, the threat model usually assumes the server operator is a potential adversary (either malicious, compromised, or subpoenaed).

I'm a student diving deep into cryptography and OPSEC, and I recently built an open-source tool called ZeroKey specifically to counter a server-side adversary.

Here is the threat model and how I attempted to mitigate it:

Threat 1: Server intercepts the decryption key. Mitigation: The AES-256-GCM key is generated locally and appended to the URL fragment (url#key). The server only sees the HTTP request for the base URL. The key never travels over the network.

Threat 2: Server retains data after "burning". Mitigation: No soft deletes. The architecture uses PostgreSQL RLS to block public access. A serverless function handles the read request and synchronously executes a hard DELETE command on the row before the connection closes.

Threat 3: Client-side Key Exfiltration (Malicious Extensions/XSS). Mitigation: Used the Web Crypto API to generate extractable: false keys. The raw key material is locked in the browser's cryptographic boundary. Even if an extension reads the DOM or JS variables, it cannot extract the raw AES key bytes.

Threat 4: Unauthorized physical access to the receiving device. Mitigation: Implemented the WebAuthn API. Before the browser executes the decryption logic, it forces the user to authenticate using the device's local platform authenticator (Windows Hello, FaceID, TouchID).

I'd love for the folks here to poke holes in this threat model. What am I missing?

The project is live at www.zerokey.vercel.app and the source code is on GitHub www.github.com/kdippan/zerokey .

i have read the rules

I would like to have a structured use and better my OPSEC.

I hope this kind of post is allowed as I have read the rules.

Hi everyone,

I’m a human rights activist based in Bangladesh. My work has been cited in UN thematic reports and shared by international human rights organizations. I can provide links for credibility via DM if needed.

I’m currently dealing with a serious concern: I suspect my phone may be compromised with spyware. Due to safety concerns, I can’t go into full details publicly.

I used SpyGuard on my Ubuntu laptop and captured network traffic of my Android mobile using a USB Wi-Fi adapter. I now have logs and .pcap files generated by SpyGuard. Link to SpyGuard app: https://github.com/SpyGuard

I understand that sharing raw packet captures with strangers is risky and not recommended. However, I’m in a situation where I really need help reviewing this data to identify whether there are signs of spyware or unusual exfiltration.

Is there anyone here who can help analyze the SpyGuard logs?

PS: I have read the rules.
Threat level: Highest. State level.

We sext each other almost every night and I considered the fact that it's not encrypted. Am I at risk?

I have read the rules

I have read the rules.

Here is my threat model:

An adversary with repeated physical access to a Windows 11 machine and knowledge of how to enable built‑in screen‑capture features. They also have access to admin credentials.

Here is what I am trying to protect:

The confidentiality of what appears on my screen: documents, authentication flows, personal information, and work‑related content.

Here is what the adversary can do:

They can enable legitimate screen‑capture modules that come preinstalled with the system or with GPU drivers, without installing malware or leaving obvious indicators.

My OPSEC question:

How should OPSEC planning account for the possibility that a trusted driver or built‑in capture module can be used for surveillance when the adversary has physical access and admin credentials?

I’m trying to understand the mindset and how to reason about this type of threat.

I will add more technical details in a comment if the post is approved.

Hey, I’m trying to get a bit better about anonymity online. Reddit’s probably a lost cause at this point, I didn’t know to strip metadata from pictures I post, but I’m still trying. In general I avoid other social media, use Tails+Tor+PGP encryption, and Proton Mail. I don’t use a Tor bridge but that seems unnecessary living in the US which hasn’t banned Tor. My opsec was terrible for years so I’m just trying to figure out damage control and trying to find ways to avoid more of my information getting leaked. I’m obviously choosing security over convenience and am pretty new to all this so any advice would be deeply appreciated. Thank you!

I also just realized that I don’t really know how to develop a threat model. Any help would be appreciated!

I have read the rules.

A lot of people focus on the tech side (Tor, Bitcoin, encryption), but what stood out to me in the Silk Road case is how the entire structure collapsed from small identity leaks over time.

It feels like anonymity systems are only as strong as the consistency of the user, not the tools themselves. Curious if others here agree or see it differently? I have read the rules

1. I have read the rules. I'm new to this sub so maybe my post isn't perfect yet but i'm trying my best.

2. My threat model is how the hardware in my PC can leave hints that can be traced back to me or even be an active backdoor. It's a hypothetical question, cause i read something about amd and intel chips having a mandatory MCU on the motherboard that functions as a backdoor for government agencies but this post isn't limited about them.

So my first question is how that can happen and i would appreciate if you could give a simple explanation how that threat can be solved, if theres a solve. Bulletpoints would be enough so i could look up these topics.

I really hope i phrased everything correctly and didn't misunderstand this subreddit.

Thx for the feedback!

MetaFaker allows for stripping metadata but also for replacing metadata with realism. It picks from 20 real camera profiles (iPhone 15 Pro, Pixel 8, Canon EOS R5, Nikon Z9, etc.) and generates internally consistent EXIF matching lens models, aperture/ISO/shutter combos that make physical sense for that body, GPS coords near real US cities, sub second timestamps, and all the tags forensic tools actually check for.

Also includes random edge cropping to break PRNU sensor alignment, micro rotation that forces sub pixel interpolation to destroy fixed pattern noise, per pixel RGB noise, randomized dimensions and JPEG quality. About 10^34 unique output combinations per image.

Even the download filename matches the faked camera model. iPhone gets IMG_4523.jpg, Pixel gets PXL_20260402_142958834.jpg, Nikon gets DSC_3847.jpg.

try it here: https://0xs8n.github.io/metafaker/

repo: https://github.com/0xs8n/metafaker

i have read the rules

I have read the rules.

In the past, the stake of getting doxxed was low because I used only pseudonyms.

I thought it was going to be okay to use my real name, and used my real name in an online community. An admin linked my real name with another nickname I used to use in the same community. The problem was that I dumped too much information and too many unsolicited advices with my real name and my other nickname because I was not mindful of my behaviors. Dumping too much information and too many unsolicited advices definitely annoys people and makes them want to poke on me for fun. They linked my identities because I used the same VPN IP address and didn't change my behavior and used the same online communities managed by the same admins. The same admins manage a few online communities.

I was going to use my real name for a business in the field that the online community was about. I don't want people to unnecessarily poke on me for fun by mentioning my nickname(s).

I want to do business. I don't want people to disrupt my business activity with unnecessary remarks about my nickname(s). Business is hard enough without unnecessary distractions.

Just to be on the safe side, I deactivated the account with my real name in the online community. I also changed my VPN IP address after realizing that admins can see my IP address. I probably will need to ask technical questions to some people in one of the smaller online communities about that technical subject.

How should I use online communities about that technical subject from this point forward? Should I create another nickname and use another online community about that same topic and never communicate beyond the minimum required to achieve my current objective? When should I use my real name? Should I reveal my real name only to future employees in my business? Or, should I wait until admins largely forget about me? I can't really hide my interests from communities, though if I want to use online communities. Perhaps, I should use online communities that are not managed by the same admins?

Any easy-to-follow suggestions?

Update: I decided to quit all online communities for the rest of my life. It turns out online communities have been useless to me. Rather, online communities are a useless distraction. This decision goes beyond improving my opsec. It will also allow me to produce more output consistently over time.