2192 lines
101 KiB
HTML
2192 lines
101 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Chapter 7: Digital Hygiene and Privacy - Field Manual for Resistance Operations</title>
|
|
<meta name="description" content="Comprehensive digital privacy and footprint management for resistance operations">
|
|
|
|
<!-- Favicon -->
|
|
<link rel="icon" type="image/x-icon" href="/assets/images/favicon.ico">
|
|
|
|
<!-- Stylesheets -->
|
|
<link rel="stylesheet" href="/assets/css/main.css">
|
|
|
|
<!-- Security headers -->
|
|
<meta http-equiv="X-Content-Type-Options" content="nosniff">
|
|
<meta http-equiv="X-Frame-Options" content="DENY">
|
|
<meta http-equiv="X-XSS-Protection" content="1; mode=block">
|
|
|
|
<!-- No tracking -->
|
|
<meta name="robots" content="noindex, nofollow">
|
|
<!-- Matomo -->
|
|
<script>
|
|
var _paq = window._paq = window._paq || [];
|
|
/* tracker methods like "setCustomDimension" should be called before "trackPageView" */
|
|
_paq.push(['trackPageView']);
|
|
_paq.push(['enableLinkTracking']);
|
|
(function() {
|
|
var u="//stats.resist.is/";
|
|
_paq.push(['setTrackerUrl', u+'matomo.php']);
|
|
_paq.push(['setSiteId', '4']);
|
|
var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
|
|
g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
|
|
})();
|
|
</script>
|
|
<!-- End Matomo Code -->
|
|
</head>
|
|
<body>
|
|
<header class="header">
|
|
<div class="container">
|
|
<div class="header-content">
|
|
<div class="logo">
|
|
<span class="omega">Ω</span>
|
|
<span>FM-R1</span>
|
|
</div>
|
|
<button class="nav-toggle" id="nav-toggle" aria-label="Toggle navigation">
|
|
☰
|
|
</button>
|
|
</div>
|
|
</div>
|
|
</header>
|
|
|
|
<div class="main-layout">
|
|
<nav class="sidebar" id="sidebar">
|
|
<nav class="main-navigation">
|
|
<!-- <div class="nav-header">
|
|
<div class="nav-subtitle">Field Manual for Resistance Operations</div>
|
|
</div>
|
|
-->
|
|
<div class="nav-sections">
|
|
<!-- Front Matter -->
|
|
<div class="nav-section">
|
|
<h3>Field Manual</h3>
|
|
<ul>
|
|
<li><a href="/" >Table of Contents</a></li>
|
|
<li><a href="/preface/" >Preface</a></li>
|
|
<li><a href="/introduction/" >Introduction</a></li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- Part I: Foundations -->
|
|
<div class="nav-section">
|
|
<h3>Part I: Foundations</h3>
|
|
<ul>
|
|
<li>
|
|
<a href="/parts/part-1/" >Part Overview</a>
|
|
<ul>
|
|
<li><a href="/chapters/chapter-1/" >Ch 1: Core Security Principles</a></li>
|
|
<li><a href="/chapters/chapter-2/" >Ch 2: Threat Assessment</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- Part II: Communication -->
|
|
<div class="nav-section">
|
|
<h3>Part II: Communication</h3>
|
|
<ul>
|
|
<li>
|
|
<a href="/parts/part-2/" >Part Overview</a>
|
|
<ul>
|
|
<li><a href="/chapters/chapter-3/" >Ch 3: Communication Architecture</a></li>
|
|
<li><a href="/chapters/chapter-4/" >Ch 4: Secure Messaging</a></li>
|
|
<li><a href="/chapters/chapter-5/" >Ch 5: File Sharing</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- Part III: OpSec -->
|
|
<div class="nav-section">
|
|
<h3>Part III: OpSec</h3>
|
|
<ul>
|
|
<li>
|
|
<a href="/parts/part-3/" >Part Overview</a>
|
|
<ul>
|
|
<li><a href="/chapters/chapter-6/" >Ch 6: Hardware Security</a></li>
|
|
<li><a href="/chapters/chapter-7/" class="active">Ch 7: Digital Hygiene</a></li>
|
|
<li><a href="/chapters/chapter-8/" >Ch 8: Operational Procedures</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- Part IV: Advanced -->
|
|
<div class="nav-section">
|
|
<h3>Part IV: Advanced</h3>
|
|
<ul>
|
|
<li>
|
|
<a href="/parts/part-4/" >Part Overview</a>
|
|
<ul>
|
|
<li><a href="/chapters/chapter-9/" >Ch 9: Intelligence Gathering</a></li>
|
|
<li><a href="/chapters/chapter-10/" >Ch 10: Counter-Intelligence</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- Appendices
|
|
<div class="nav-section">
|
|
<h3>Appendices</h3>
|
|
<ul>
|
|
<li><a href="/appendices/" >Appendices Overview</a></li>
|
|
<li><a href="/appendices/appendix-a/" >Appendix A: Essential Tools</a></li>
|
|
<li><a href="/appendices/appendix-b/" >Appendix B: Legal Considerations</a></li>
|
|
<li><a href="/appendices/appendix-c/" >Appendix C: Emergency Procedures</a></li>
|
|
<li><a href="/appendices/appendix-d/" >Appendix D: Glossary & References</a></li>
|
|
</ul>
|
|
</div>
|
|
-->
|
|
|
|
<!-- Quick Access -->
|
|
<div class="nav-section nav-quick-access">
|
|
<h3>Quick Access</h3>
|
|
<ul>
|
|
<li><a href="/appendices/appendix-a/" class="nav-emergency">Essential Tools</a></li>
|
|
<li><a href="/appendices/appendix-b/" class="nav-emergency">Legal Rights</a></li>
|
|
<li><a href="/appendices/appendix-c/" class="nav-emergency">Emergency Procedures</a></li>
|
|
<li><a href="/appendices/appendix-d/" class="nav-emergency">Glossary & References</a></li>
|
|
</ul>
|
|
</div>
|
|
|
|
<!-- External Links -->
|
|
<div class="nav-section">
|
|
<h3>External Links</h3>
|
|
<ul>
|
|
<li><a href="https://resist.is" target="_blank">resist.is</a></li>
|
|
<li><a href="https://activistchecklist.org" target="_blank">Activist Checklist</a></li>
|
|
<li><a href="https://signal.org" target="_blank">Signal</a></li>
|
|
<li><a href="https://briarproject.org" target="_blank">Briar</a></li>
|
|
<li><a href="https://element.io" target="_blank">Element</a></li>
|
|
<li><a href="https://tails.boum.org" target="_blank">Tails OS</a></li>
|
|
<li><a href="https://onionshare.org" target="_blank">OnionShare</a></li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Security Notice
|
|
<div class="nav-security-notice">
|
|
<div class="security-warning">
|
|
<strong>OPERATIONAL SECURITY REMINDER</strong><br>
|
|
This manual contains sensitive information. Ensure secure handling and storage. Practice compartmentalization and need-to-know principles.
|
|
</div>
|
|
</div> -->
|
|
|
|
<!-- Footer -->
|
|
<div class="nav-footer">
|
|
<div class="manual-info">
|
|
<div class="classification">FOR RESISTANCE USE ONLY</div>
|
|
<div class="version">Version 1.0 | FM-R1</div>
|
|
<div class="date">2025</div>
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
|
|
|
|
</nav>
|
|
|
|
<main class="content">
|
|
<div class="content-header">
|
|
<div class="manual-designation">FM-R1: FM-R1: Secure Communication Networks for Decentralized Resistance</div>
|
|
<div class="classification">UNCLASSIFIED</div>
|
|
|
|
<div class="section-number">Section 7-1 to 7-6</div>
|
|
|
|
</div>
|
|
|
|
<h1 id="chapter-7-digital-hygiene-and-privacy">Chapter 7: Digital Hygiene and Privacy</h1>
|
|
|
|
<h2 id="chapter-overview">Chapter Overview</h2>
|
|
|
|
<p>This chapter provides comprehensive guidance for maintaining digital hygiene and privacy in resistance operations. Digital hygiene encompasses all practices related to managing your online presence, protecting personal information, and minimizing digital footprints that could compromise operational security. Unlike hardware security which focuses on physical devices, digital hygiene addresses the behavioral and procedural aspects of online activities.</p>
|
|
|
|
<p><strong>Sections in this chapter:</strong></p>
|
|
<ul>
|
|
<li>7-1: Browser Security Configuration</li>
|
|
<li>7-2: Search Engine Privacy</li>
|
|
<li>7-3: VPN and Tor Usage</li>
|
|
<li>7-4: Social Media Operational Security</li>
|
|
<li>7-5: Email Security and Anonymous Accounts</li>
|
|
<li>7-6: Digital Footprint Minimization</li>
|
|
</ul>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-1-browser-security-configuration">Section 7-1: Browser Security Configuration</h2>
|
|
|
|
<h3 id="overview">Overview</h3>
|
|
|
|
<p>Web browsers are the primary interface for online activities and represent a significant attack surface for surveillance and compromise. Proper browser configuration is essential for maintaining privacy and security during research, communication, and operational activities. This section provides comprehensive browser hardening procedures for resistance operations.</p>
|
|
|
|
<h3 id="browser-selection-and-evaluation">Browser Selection and Evaluation</h3>
|
|
|
|
<h4 id="security-focused-browser-options">Security-Focused Browser Options</h4>
|
|
|
|
<p><strong>Browser Security Comparison:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Browser Security Assessment:
|
|
1. Tor Browser:
|
|
- Advantages: Built-in Tor integration, maximum anonymity
|
|
- Disadvantages: Slower performance, limited functionality
|
|
- Use Case: High-risk operations requiring maximum anonymity
|
|
- Security Level: Maximum
|
|
|
|
2. Firefox with Hardening:
|
|
- Advantages: Open source, extensive customization options
|
|
- Disadvantages: Requires manual configuration
|
|
- Use Case: Research and medium-security operations
|
|
- Security Level: High (when properly configured)
|
|
|
|
3. Brave Browser:
|
|
- Advantages: Built-in ad blocking and privacy features
|
|
- Disadvantages: Chromium-based, limited anonymity
|
|
- Use Case: Daily browsing with enhanced privacy
|
|
- Security Level: Medium-High
|
|
|
|
4. Ungoogled Chromium:
|
|
- Advantages: Chrome compatibility without Google tracking
|
|
- Disadvantages: Manual updates, limited support
|
|
- Use Case: Compatibility requirements with privacy focus
|
|
- Security Level: Medium
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="tor-browser-configuration">Tor Browser Configuration</h3>
|
|
|
|
<h4 id="tor-browser-security-settings">Tor Browser Security Settings</h4>
|
|
|
|
<p><strong>Security Level Configuration:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Tor Browser Security Levels:
|
|
1. Standard (Default):
|
|
- JavaScript enabled for all sites
|
|
- Audio and video enabled
|
|
- Some fonts and math symbols allowed
|
|
- Use for: Low-risk browsing and research
|
|
|
|
2. Safer:
|
|
- JavaScript disabled on non-HTTPS sites
|
|
- Some fonts and symbols disabled
|
|
- Audio and video click-to-play
|
|
- Use for: Medium-risk operational activities
|
|
|
|
3. Safest:
|
|
- JavaScript disabled on all sites
|
|
- Images, media, and fonts disabled
|
|
- Maximum security with reduced functionality
|
|
- Use for: High-risk operations and sensitive activities
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>Advanced Tor Browser Configuration:</strong></p>
|
|
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1">// about:config security settings for Tor Browser</span>
|
|
<span class="c1">// Access via about:config in address bar</span>
|
|
|
|
<span class="c1">// Disable WebRTC to prevent IP leaks</span>
|
|
<span class="nx">media</span><span class="p">.</span><span class="nx">peerconnection</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
|
|
<span class="c1">// Disable geolocation services</span>
|
|
<span class="nx">geo</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
|
|
<span class="c1">// Disable camera and microphone access</span>
|
|
<span class="nx">media</span><span class="p">.</span><span class="nb">navigator</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
|
|
<span class="c1">// Disable WebGL for fingerprinting protection</span>
|
|
<span class="nx">webgl</span><span class="p">.</span><span class="nx">disabled</span> <span class="o">=</span> <span class="kc">true</span>
|
|
|
|
<span class="c1">// Disable battery API</span>
|
|
<span class="nx">dom</span><span class="p">.</span><span class="nx">battery</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
|
|
<span class="c1">// Disable clipboard events</span>
|
|
<span class="nx">dom</span><span class="p">.</span><span class="nx">event</span><span class="p">.</span><span class="nx">clipboardevents</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="tor-browser-operational-security">Tor Browser Operational Security</h4>
|
|
|
|
<p><strong>Tor Browser Usage Procedures:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Tor Browser OpSec Guidelines:
|
|
1. Session Management:
|
|
- Use New Identity for different activities
|
|
- Clear cookies and site data between sessions
|
|
- Avoid logging into personal accounts
|
|
- Use different circuits for different purposes
|
|
|
|
2. JavaScript and Plugin Management:
|
|
- Disable JavaScript for sensitive activities
|
|
- Never install browser plugins or extensions
|
|
- Avoid sites requiring Flash or Java
|
|
- Use NoScript for granular script control
|
|
|
|
3. Download Security:
|
|
- Avoid downloading files through Tor Browser
|
|
- Scan all downloads with antivirus software
|
|
- Open downloads in isolated environments
|
|
- Verify file integrity and authenticity
|
|
|
|
4. Browsing Behavior:
|
|
- Avoid unique browsing patterns
|
|
- Don't resize browser window
|
|
- Use standard screen resolution
|
|
- Avoid enabling full-screen mode
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="firefox-hardening">Firefox Hardening</h3>
|
|
|
|
<h4 id="privacy-and-security-configuration">Privacy and Security Configuration</h4>
|
|
|
|
<p><strong>Firefox Privacy Settings:</strong></p>
|
|
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1">// Firefox about:config privacy hardening</span>
|
|
<span class="c1">// Essential privacy and security configurations</span>
|
|
|
|
<span class="c1">// Disable telemetry and data collection</span>
|
|
<span class="nx">toolkit</span><span class="p">.</span><span class="nx">telemetry</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
<span class="nx">datareporting</span><span class="p">.</span><span class="nx">healthreport</span><span class="p">.</span><span class="nx">uploadEnabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
<span class="nx">datareporting</span><span class="p">.</span><span class="nx">policy</span><span class="p">.</span><span class="nx">dataSubmissionEnabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
|
|
<span class="c1">// Enhanced tracking protection</span>
|
|
<span class="nx">privacy</span><span class="p">.</span><span class="nx">trackingprotection</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">true</span>
|
|
<span class="nx">privacy</span><span class="p">.</span><span class="nx">trackingprotection</span><span class="p">.</span><span class="nx">socialtracking</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">true</span>
|
|
<span class="nx">privacy</span><span class="p">.</span><span class="nx">trackingprotection</span><span class="p">.</span><span class="nx">cryptomining</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">true</span>
|
|
|
|
<span class="c1">// DNS over HTTPS configuration</span>
|
|
<span class="nx">network</span><span class="p">.</span><span class="nx">trr</span><span class="p">.</span><span class="nx">mode</span> <span class="o">=</span> <span class="mi">2</span>
|
|
<span class="nx">network</span><span class="p">.</span><span class="nx">trr</span><span class="p">.</span><span class="nx">uri</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://mozilla.cloudflare-dns.com/dns-query</span><span class="dl">"</span>
|
|
|
|
<span class="c1">// Disable WebRTC IP leak</span>
|
|
<span class="nx">media</span><span class="p">.</span><span class="nx">peerconnection</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
<span class="nx">media</span><span class="p">.</span><span class="nx">peerconnection</span><span class="p">.</span><span class="nx">ice</span><span class="p">.</span><span class="nx">default_address_only</span> <span class="o">=</span> <span class="kc">true</span>
|
|
|
|
<span class="c1">// Fingerprinting protection</span>
|
|
<span class="nx">privacy</span><span class="p">.</span><span class="nx">resistFingerprinting</span> <span class="o">=</span> <span class="kc">true</span>
|
|
<span class="nx">privacy</span><span class="p">.</span><span class="nx">firstparty</span><span class="p">.</span><span class="nx">isolate</span> <span class="o">=</span> <span class="kc">true</span>
|
|
|
|
<span class="c1">// Cookie and storage settings</span>
|
|
<span class="nx">network</span><span class="p">.</span><span class="nx">cookie</span><span class="p">.</span><span class="nx">cookieBehavior</span> <span class="o">=</span> <span class="mi">1</span>
|
|
<span class="nx">network</span><span class="p">.</span><span class="nx">cookie</span><span class="p">.</span><span class="nx">lifetimePolicy</span> <span class="o">=</span> <span class="mi">2</span>
|
|
<span class="nx">dom</span><span class="p">.</span><span class="nx">storage</span><span class="p">.</span><span class="nx">enabled</span> <span class="o">=</span> <span class="kc">false</span>
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="extension-security">Extension Security</h4>
|
|
|
|
<p><strong>Recommended Firefox Extensions:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Security-Focused Extensions:
|
|
1. uBlock Origin:
|
|
- Advanced ad and tracker blocking
|
|
- Custom filter lists and rules
|
|
- JavaScript blocking capabilities
|
|
- Resource usage monitoring
|
|
|
|
2. NoScript:
|
|
- Granular script execution control
|
|
- XSS and clickjacking protection
|
|
- Application boundary enforcement
|
|
- Whitelist-based security model
|
|
|
|
3. HTTPS Everywhere:
|
|
- Automatic HTTPS upgrades
|
|
- SSL/TLS connection enforcement
|
|
- Certificate validation enhancement
|
|
- Mixed content protection
|
|
|
|
4. ClearURLs:
|
|
- URL parameter cleaning
|
|
- Tracking parameter removal
|
|
- Link sanitization
|
|
- Privacy-focused URL handling
|
|
|
|
5. Decentraleyes:
|
|
- CDN emulation for privacy
|
|
- Third-party resource blocking
|
|
- Local resource serving
|
|
- Tracking prevention
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="browser-operational-security">Browser Operational Security</h3>
|
|
|
|
<h4 id="session-isolation-and-management">Session Isolation and Management</h4>
|
|
|
|
<p><strong>Browser Session Security:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Session Management Procedures:
|
|
1. Role-Based Browsing:
|
|
- Separate browser profiles for different roles
|
|
- Different browsers for different activities
|
|
- Isolated browsing environments
|
|
- Clear separation between operational and personal browsing
|
|
|
|
2. Session Cleanup:
|
|
- Clear browsing data after each session
|
|
- Delete cookies, cache, and history
|
|
- Clear form data and passwords
|
|
- Restart browser between different activities
|
|
|
|
3. Incognito/Private Browsing:
|
|
- Use private browsing for sensitive activities
|
|
- Understand limitations of private browsing
|
|
- Combine with other privacy measures
|
|
- Clear data even in private mode
|
|
|
|
4. Browser Fingerprinting Protection:
|
|
- Use common browser configurations
|
|
- Avoid unique extensions and settings
|
|
- Disable fingerprinting vectors
|
|
- Regularly test fingerprinting resistance
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="download-and-file-handling-security">Download and File Handling Security</h4>
|
|
|
|
<p><strong>Secure Download Procedures:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Download Security Framework:
|
|
1. Download Source Verification:
|
|
- Verify download source authenticity
|
|
- Check file hashes and signatures
|
|
- Use official download channels only
|
|
- Avoid suspicious or modified files
|
|
|
|
2. Download Isolation:
|
|
- Download to isolated directories
|
|
- Scan files with antivirus software
|
|
- Open files in sandboxed environments
|
|
- Avoid executing downloaded files directly
|
|
|
|
3. File Type Security:
|
|
- Avoid executable file downloads
|
|
- Be cautious with document files
|
|
- Verify file types and extensions
|
|
- Use safe file viewers when possible
|
|
|
|
4. Post-Download Security:
|
|
- Clear download history
|
|
- Securely delete temporary files
|
|
- Monitor system for changes
|
|
- Document downloaded files for security review
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="browser-testing-and-verification">Browser Testing and Verification</h3>
|
|
|
|
<h4 id="privacy-and-security-testing">Privacy and Security Testing</h4>
|
|
|
|
<p><strong>Browser Security Verification:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Browser Security Testing:
|
|
1. IP Address Leaks:
|
|
- Test for WebRTC IP leaks
|
|
- Check DNS leak protection
|
|
- Verify proxy/VPN integration
|
|
- Monitor for IPv6 leaks
|
|
|
|
2. Fingerprinting Resistance:
|
|
- Test browser fingerprinting uniqueness
|
|
- Verify JavaScript fingerprinting protection
|
|
- Check canvas and WebGL fingerprinting
|
|
- Monitor for tracking pixel detection
|
|
|
|
3. Cookie and Storage Testing:
|
|
- Verify cookie blocking and deletion
|
|
- Test local storage isolation
|
|
- Check session storage handling
|
|
- Monitor for tracking cookie persistence
|
|
|
|
4. Network Security Testing:
|
|
- Verify HTTPS enforcement
|
|
- Test certificate validation
|
|
- Check mixed content handling
|
|
- Monitor for insecure connections
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>Testing Tools and Resources:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Browser security testing tools</span>
|
|
<span class="c"># Use these tools to verify browser security configuration</span>
|
|
|
|
<span class="c"># IP leak testing</span>
|
|
curl <span class="nt">-s</span> https://ipinfo.io/ip <span class="c"># Check current IP</span>
|
|
<span class="c"># Visit: https://ipleak.net/ for comprehensive leak testing</span>
|
|
|
|
<span class="c"># DNS leak testing</span>
|
|
<span class="c"># Visit: https://www.dnsleaktest.com/</span>
|
|
|
|
<span class="c"># Browser fingerprinting testing</span>
|
|
<span class="c"># Visit: https://panopticlick.eff.org/</span>
|
|
<span class="c"># Visit: https://amiunique.org/</span>
|
|
|
|
<span class="c"># WebRTC leak testing</span>
|
|
<span class="c"># Visit: https://browserleaks.com/webrtc</span>
|
|
|
|
<span class="c"># JavaScript security testing</span>
|
|
<span class="c"># Visit: https://browserleaks.com/javascript</span>
|
|
</code></pre></div></div>
|
|
|
|
<div class="warning-box">
|
|
<div class="warning-title">Browser Security Limitations</div>
|
|
<p>Browser security configurations provide significant protection but cannot eliminate all risks. JavaScript, plugins, and browser vulnerabilities can still compromise security. Use browsers as part of a comprehensive security strategy, not as standalone protection.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-2-search-engine-privacy">Section 7-2: Search Engine Privacy</h2>
|
|
|
|
<h3 id="overview-1">Overview</h3>
|
|
|
|
<p>Search engines collect vast amounts of data about user interests, activities, and intentions. This data can be used to build detailed profiles for surveillance and targeting. Privacy-focused search strategies are essential for resistance operations to prevent intelligence gathering through search activities and to maintain operational security during research.</p>
|
|
|
|
<h3 id="search-engine-threat-model">Search Engine Threat Model</h3>
|
|
|
|
<h4 id="search-based-intelligence-gathering">Search-Based Intelligence Gathering</h4>
|
|
|
|
<p><strong>Search Surveillance Capabilities:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Search Engine Surveillance Risks:
|
|
1. Query Logging and Analysis:
|
|
- Complete search history and query logs
|
|
- Temporal analysis of search patterns
|
|
- Correlation with other user activities
|
|
- Behavioral profiling and interest mapping
|
|
|
|
2. Result Click Tracking:
|
|
- Monitoring of clicked search results
|
|
- Time spent on linked websites
|
|
- Follow-up searches and research patterns
|
|
- Cross-site tracking and correlation
|
|
|
|
3. Location and Context Correlation:
|
|
- IP address and geographic location tracking
|
|
- Device and browser fingerprinting
|
|
- Time-based activity correlation
|
|
- Social network and contact analysis
|
|
|
|
4. Predictive Analysis:
|
|
- Intent prediction based on search patterns
|
|
- Risk assessment and threat scoring
|
|
- Automated flagging and alerting
|
|
- Integration with surveillance databases
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="privacy-focused-search-engines">Privacy-Focused Search Engines</h3>
|
|
|
|
<h4 id="alternative-search-engine-options">Alternative Search Engine Options</h4>
|
|
|
|
<p><strong>Privacy Search Engine Comparison:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Privacy Search Engine Assessment:
|
|
1. DuckDuckGo:
|
|
- Advantages: No tracking, good results, Tor support
|
|
- Disadvantages: US-based, limited advanced features
|
|
- Use Case: General research and daily searching
|
|
- Privacy Level: High
|
|
|
|
2. Startpage:
|
|
- Advantages: Google results without tracking
|
|
- Disadvantages: Netherlands-based, limited customization
|
|
- Use Case: Google-quality results with privacy
|
|
- Privacy Level: High
|
|
|
|
3. Searx:
|
|
- Advantages: Open source, self-hostable, aggregated results
|
|
- Disadvantages: Variable result quality, setup complexity
|
|
- Use Case: Maximum privacy and control
|
|
- Privacy Level: Maximum (when self-hosted)
|
|
|
|
4. Yandex (with precautions):
|
|
- Advantages: Good for non-Western perspectives
|
|
- Disadvantages: Russian-based, potential surveillance
|
|
- Use Case: Specific research requiring diverse sources
|
|
- Privacy Level: Low (use with Tor/VPN only)
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="self-hosted-search-solutions">Self-Hosted Search Solutions</h4>
|
|
|
|
<p><strong>Searx Installation and Configuration:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Install Searx for private search engine</span>
|
|
<span class="c"># Requires Docker for easy deployment</span>
|
|
|
|
<span class="c"># Clone Searx repository</span>
|
|
git clone https://github.com/searx/searx-docker.git
|
|
<span class="nb">cd </span>searx-docker
|
|
|
|
<span class="c"># Configure Searx settings</span>
|
|
<span class="nb">cp</span> .env.example .env
|
|
<span class="c"># Edit .env file with custom settings</span>
|
|
|
|
<span class="c"># Start Searx instance</span>
|
|
docker-compose up <span class="nt">-d</span>
|
|
|
|
<span class="c"># Access Searx at http://localhost:8080</span>
|
|
<span class="c"># Configure search engines and preferences</span>
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>Searx Security Configuration:</strong></p>
|
|
<div class="language-yaml highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1"># searx/settings.yml security configuration</span>
|
|
<span class="na">general</span><span class="pi">:</span>
|
|
<span class="na">debug</span><span class="pi">:</span> <span class="kc">false</span>
|
|
<span class="na">instance_name</span><span class="pi">:</span> <span class="s2">"</span><span class="s">Private</span><span class="nv"> </span><span class="s">Search"</span>
|
|
<span class="na">contact_url</span><span class="pi">:</span> <span class="kc">false</span>
|
|
<span class="na">enable_stats</span><span class="pi">:</span> <span class="kc">false</span>
|
|
|
|
<span class="na">server</span><span class="pi">:</span>
|
|
<span class="na">port</span><span class="pi">:</span> <span class="m">8080</span>
|
|
<span class="na">bind_address</span><span class="pi">:</span> <span class="s2">"</span><span class="s">127.0.0.1"</span>
|
|
<span class="na">secret_key</span><span class="pi">:</span> <span class="s2">"</span><span class="s">generate_random_secret_key"</span>
|
|
<span class="na">base_url</span><span class="pi">:</span> <span class="kc">false</span>
|
|
<span class="na">image_proxy</span><span class="pi">:</span> <span class="kc">true</span>
|
|
|
|
<span class="na">search</span><span class="pi">:</span>
|
|
<span class="na">safe_search</span><span class="pi">:</span> <span class="m">0</span>
|
|
<span class="na">autocomplete</span><span class="pi">:</span> <span class="s2">"</span><span class="s">"</span>
|
|
<span class="na">default_lang</span><span class="pi">:</span> <span class="s2">"</span><span class="s">"</span>
|
|
<span class="na">ban_time_on_fail</span><span class="pi">:</span> <span class="m">5</span>
|
|
<span class="na">max_ban_time_on_fail</span><span class="pi">:</span> <span class="m">120</span>
|
|
|
|
<span class="na">outgoing</span><span class="pi">:</span>
|
|
<span class="na">request_timeout</span><span class="pi">:</span> <span class="m">3.0</span>
|
|
<span class="na">useragent_suffix</span><span class="pi">:</span> <span class="s2">"</span><span class="s">"</span>
|
|
<span class="na">pool_connections</span><span class="pi">:</span> <span class="m">100</span>
|
|
<span class="na">pool_maxsize</span><span class="pi">:</span> <span class="m">20</span>
|
|
<span class="na">enable_http2</span><span class="pi">:</span> <span class="kc">true</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="search-operational-security">Search Operational Security</h3>
|
|
|
|
<h4 id="anonymous-search-procedures">Anonymous Search Procedures</h4>
|
|
|
|
<p><strong>Search OpSec Framework:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Anonymous Search Procedures:
|
|
1. Network Anonymity:
|
|
- Use Tor Browser for all sensitive searches
|
|
- Route searches through VPN when appropriate
|
|
- Use different exit nodes for different topics
|
|
- Avoid searching from personal network connections
|
|
|
|
2. Query Obfuscation:
|
|
- Use generic terms instead of specific queries
|
|
- Break complex searches into multiple simple queries
|
|
- Use synonyms and alternative terminology
|
|
- Add noise queries to mask real interests
|
|
|
|
3. Temporal Separation:
|
|
- Spread related searches across time
|
|
- Use different search sessions for different topics
|
|
- Vary search timing to avoid pattern recognition
|
|
- Clear search history between sessions
|
|
|
|
4. Search Engine Rotation:
|
|
- Use different search engines for different purposes
|
|
- Rotate between privacy-focused search engines
|
|
- Avoid consistent search engine preferences
|
|
- Test search engines for result bias and filtering
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="research-methodology">Research Methodology</h4>
|
|
|
|
<p><strong>Secure Research Techniques:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Research Security Procedures:
|
|
1. Research Planning:
|
|
- Plan research objectives and scope
|
|
- Identify information sources and methods
|
|
- Assess research risks and security requirements
|
|
- Develop research timeline and milestones
|
|
|
|
2. Information Gathering:
|
|
- Use multiple independent sources
|
|
- Cross-reference information for accuracy
|
|
- Document sources and methodology
|
|
- Verify information through alternative channels
|
|
|
|
3. Source Protection:
|
|
- Protect source identity and location
|
|
- Use secure communication for source contact
|
|
- Implement source verification procedures
|
|
- Maintain source confidentiality and security
|
|
|
|
4. Information Security:
|
|
- Encrypt and protect research data
|
|
- Use secure storage and backup procedures
|
|
- Implement access controls and permissions
|
|
- Plan for information sanitization and disposal
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="advanced-search-techniques">Advanced Search Techniques</h3>
|
|
|
|
<h4 id="search-query-optimization">Search Query Optimization</h4>
|
|
|
|
<p><strong>Advanced Search Operators:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Search Operator Security Usage:
|
|
1. Site-Specific Searches:
|
|
- site:example.com "search term"
|
|
- Use to limit searches to trusted sources
|
|
- Avoid revealing specific site interests
|
|
- Combine with other operators for precision
|
|
|
|
2. File Type Searches:
|
|
- filetype:pdf "search term"
|
|
- Use to find specific document types
|
|
- Be cautious with executable file searches
|
|
- Verify file safety before downloading
|
|
|
|
3. Time-Based Searches:
|
|
- Use date ranges to limit search scope
|
|
- Focus on recent information when relevant
|
|
- Avoid time patterns that reveal interests
|
|
- Use historical searches for context
|
|
|
|
4. Exclusion Searches:
|
|
- -"unwanted term" to exclude results
|
|
- Use to filter out irrelevant information
|
|
- Avoid revealing what you want to exclude
|
|
- Combine with inclusion terms for precision
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="specialized-search-resources">Specialized Search Resources</h4>
|
|
|
|
<p><strong>Alternative Information Sources:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Specialized Search Resources:
|
|
1. Academic Databases:
|
|
- Google Scholar for academic papers
|
|
- JSTOR for academic journals
|
|
- arXiv for preprint papers
|
|
- Use institutional access when available
|
|
|
|
2. Government Databases:
|
|
- FOIA reading rooms and databases
|
|
- Government transparency portals
|
|
- Legislative and regulatory databases
|
|
- Court records and legal databases
|
|
|
|
3. News and Media Archives:
|
|
- Internet Archive Wayback Machine
|
|
- Newspaper archives and databases
|
|
- Broadcast news archives
|
|
- Social media archives and tools
|
|
|
|
4. Technical Resources:
|
|
- GitHub for code and technical documentation
|
|
- Stack Overflow for technical questions
|
|
- Technical forums and communities
|
|
- Vendor documentation and resources
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="search-result-verification">Search Result Verification</h3>
|
|
|
|
<h4 id="information-verification-procedures">Information Verification Procedures</h4>
|
|
|
|
<p><strong>Source Verification Framework:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Information Verification Process:
|
|
1. Source Credibility Assessment:
|
|
- Evaluate source reputation and expertise
|
|
- Check source funding and potential bias
|
|
- Verify source contact information and legitimacy
|
|
- Cross-reference with other credible sources
|
|
|
|
2. Information Accuracy Verification:
|
|
- Compare information across multiple sources
|
|
- Check for factual errors and inconsistencies
|
|
- Verify dates, names, and specific details
|
|
- Look for primary source documentation
|
|
|
|
3. Currency and Relevance Check:
|
|
- Verify information publication and update dates
|
|
- Check for more recent information or updates
|
|
- Assess relevance to current situation
|
|
- Consider information lifecycle and validity
|
|
|
|
4. Bias and Perspective Analysis:
|
|
- Identify potential source bias and agenda
|
|
- Seek diverse perspectives and viewpoints
|
|
- Analyze language and presentation for bias
|
|
- Consider cultural and political context
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="fact-checking-resources">Fact-Checking Resources</h4>
|
|
|
|
<p><strong>Verification Tools and Techniques:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Information verification tools and techniques</span>
|
|
|
|
<span class="c"># Reverse image search for image verification</span>
|
|
<span class="c"># Use TinEye or Google Images (through Tor)</span>
|
|
|
|
<span class="c"># Website verification tools</span>
|
|
whois example.com <span class="c"># Check domain registration</span>
|
|
dig example.com <span class="c"># Check DNS information</span>
|
|
|
|
<span class="c"># Archive verification</span>
|
|
<span class="c"># Use Internet Archive Wayback Machine</span>
|
|
<span class="c"># Check for historical versions of information</span>
|
|
|
|
<span class="c"># Social media verification</span>
|
|
<span class="c"># Cross-reference social media posts</span>
|
|
<span class="c"># Check account verification and history</span>
|
|
<span class="c"># Look for original sources and context</span>
|
|
</code></pre></div></div>
|
|
|
|
<div class="success-box">
|
|
<div class="success-title">Search Privacy Benefits</div>
|
|
<p>Privacy-focused search practices significantly reduce surveillance exposure and protect research activities. Combined with proper browser security and network anonymity, private search engines provide effective protection for intelligence gathering and research operations.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-3-vpn-and-tor-usage">Section 7-3: VPN and Tor Usage</h2>
|
|
|
|
<h3 id="overview-2">Overview</h3>
|
|
|
|
<p>Virtual Private Networks (VPNs) and The Onion Router (Tor) are essential tools for network anonymity and privacy protection. While both provide network-level protection, they serve different purposes and have different security characteristics. This section provides comprehensive guidance for selecting, configuring, and using VPNs and Tor for resistance operations.</p>
|
|
|
|
<h3 id="vpn-vs-tor-comparison">VPN vs. Tor Comparison</h3>
|
|
|
|
<h4 id="technology-comparison">Technology Comparison</h4>
|
|
|
|
<p><strong>VPN and Tor Characteristics:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>VPN vs. Tor Analysis:
|
|
1. VPN Characteristics:
|
|
- Advantages: Fast speeds, easy setup, full device protection
|
|
- Disadvantages: Single point of trust, potential logging
|
|
- Use Case: General privacy and geo-blocking circumvention
|
|
- Anonymity Level: Medium (depends on provider)
|
|
|
|
2. Tor Characteristics:
|
|
- Advantages: Strong anonymity, no single point of trust
|
|
- Disadvantages: Slower speeds, limited protocol support
|
|
- Use Case: High-risk activities requiring maximum anonymity
|
|
- Anonymity Level: High (when properly used)
|
|
|
|
3. VPN + Tor Combination:
|
|
- Advantages: Enhanced anonymity and protection
|
|
- Disadvantages: Complex setup, potential performance issues
|
|
- Use Case: Maximum security for critical operations
|
|
- Anonymity Level: Maximum
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="vpn-selection-and-configuration">VPN Selection and Configuration</h3>
|
|
|
|
<h4 id="vpn-provider-evaluation">VPN Provider Evaluation</h4>
|
|
|
|
<p><strong>VPN Security Assessment Criteria:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>VPN Provider Evaluation Framework:
|
|
1. Privacy Policy and Jurisdiction:
|
|
- Verified no-logs policy with independent audits
|
|
- Jurisdiction outside surveillance alliances (5/9/14 Eyes)
|
|
- Transparent privacy practices and warrant canaries
|
|
- No data retention requirements or legal obligations
|
|
|
|
2. Technical Security Features:
|
|
- Strong encryption protocols (OpenVPN, WireGuard, IKEv2)
|
|
- Perfect forward secrecy and secure key exchange
|
|
- DNS leak protection and IPv6 support
|
|
- Kill switch and connection monitoring
|
|
|
|
3. Infrastructure and Performance:
|
|
- Large server network with diverse locations
|
|
- High-speed connections and unlimited bandwidth
|
|
- Multiple protocol options and port configurations
|
|
- Reliable uptime and connection stability
|
|
|
|
4. Payment and Account Security:
|
|
- Anonymous payment options (cryptocurrency, cash)
|
|
- No personal information requirements
|
|
- Secure account management and authentication
|
|
- Regular security updates and maintenance
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="vpn-configuration-best-practices">VPN Configuration Best Practices</h4>
|
|
|
|
<p><strong>OpenVPN Configuration:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Secure OpenVPN client configuration</span>
|
|
<span class="c"># /etc/openvpn/client.conf</span>
|
|
|
|
client
|
|
dev tun
|
|
proto udp
|
|
remote vpn-server.example.com 1194
|
|
resolv-retry infinite
|
|
nobind
|
|
persist-key
|
|
persist-tun
|
|
|
|
<span class="c"># Authentication</span>
|
|
ca ca.crt
|
|
cert client.crt
|
|
key client.key
|
|
tls-auth ta.key 1
|
|
|
|
<span class="c"># Security settings</span>
|
|
cipher AES-256-GCM
|
|
auth SHA256
|
|
key-direction 1
|
|
tls-version-min 1.2
|
|
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
|
|
|
|
<span class="c"># DNS and routing</span>
|
|
script-security 2
|
|
up /etc/openvpn/update-resolv-conf
|
|
down /etc/openvpn/update-resolv-conf
|
|
redirect-gateway def1 bypass-dhcp
|
|
dhcp-option DNS 1.1.1.1
|
|
dhcp-option DNS 1.0.0.1
|
|
|
|
<span class="c"># Connection monitoring</span>
|
|
ping 15
|
|
ping-restart 0
|
|
ping-timer-rem
|
|
persist-tun
|
|
persist-key
|
|
|
|
<span class="c"># Logging</span>
|
|
verb 3
|
|
mute 20
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>WireGuard Configuration:</strong></p>
|
|
<div class="language-ini highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># WireGuard client configuration
|
|
# /etc/wireguard/wg0.conf
|
|
</span>
|
|
<span class="nn">[Interface]</span>
|
|
<span class="py">PrivateKey</span> <span class="p">=</span> <span class="s">CLIENT_PRIVATE_KEY</span>
|
|
<span class="py">Address</span> <span class="p">=</span> <span class="s">10.0.0.2/32</span>
|
|
<span class="py">DNS</span> <span class="p">=</span> <span class="s">1.1.1.1, 1.0.0.1</span>
|
|
|
|
<span class="c"># Kill switch using iptables
|
|
</span><span class="py">PostUp</span> <span class="p">=</span> <span class="s">iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT</span>
|
|
<span class="py">PreDown</span> <span class="p">=</span> <span class="s">iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT</span>
|
|
|
|
<span class="nn">[Peer]</span>
|
|
<span class="py">PublicKey</span> <span class="p">=</span> <span class="s">SERVER_PUBLIC_KEY</span>
|
|
<span class="py">Endpoint</span> <span class="p">=</span> <span class="s">vpn-server.example.com:51820</span>
|
|
<span class="py">AllowedIPs</span> <span class="p">=</span> <span class="s">0.0.0.0/0</span>
|
|
<span class="py">PersistentKeepalive</span> <span class="p">=</span> <span class="s">25</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="tor-network-usage">Tor Network Usage</h3>
|
|
|
|
<h4 id="tor-browser-and-network-configuration">Tor Browser and Network Configuration</h4>
|
|
|
|
<p><strong>Tor Network Security:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Tor Usage Best Practices:
|
|
1. Tor Browser Usage:
|
|
- Use official Tor Browser for web browsing
|
|
- Never install additional plugins or extensions
|
|
- Use highest security level for sensitive activities
|
|
- Clear browser data between different activities
|
|
|
|
2. Tor Network Configuration:
|
|
- Use bridges for censorship circumvention
|
|
- Configure entry and exit node preferences
|
|
- Monitor circuit paths and exit node countries
|
|
- Use new circuits for different activities
|
|
|
|
3. Application Integration:
|
|
- Configure applications to use Tor SOCKS proxy
|
|
- Use Tor-specific versions of applications when available
|
|
- Avoid applications that bypass Tor proxy
|
|
- Monitor for DNS and IP leaks
|
|
|
|
4. Operational Security:
|
|
- Never download files through Tor Browser
|
|
- Avoid logging into personal accounts over Tor
|
|
- Use different circuits for different identities
|
|
- Monitor for traffic analysis attacks
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="tor-bridge-configuration">Tor Bridge Configuration</h4>
|
|
|
|
<p><strong>Bridge Setup for Censorship Circumvention:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code># Tor bridge configuration
|
|
# /etc/tor/torrc
|
|
|
|
# Use bridges for censorship circumvention
|
|
UseBridges 1
|
|
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
|
|
|
|
# Bridge configurations (obtain from https://bridges.torproject.org/)
|
|
Bridge obfs4 192.0.2.1:443 cert=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA iat-mode=0
|
|
Bridge obfs4 192.0.2.2:443 cert=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB iat-mode=0
|
|
|
|
# Additional security settings
|
|
ExitPolicy reject *:*
|
|
DisableNetwork 0
|
|
ControlPort 9051
|
|
CookieAuthentication 1
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="advanced-anonymity-configurations">Advanced Anonymity Configurations</h3>
|
|
|
|
<h4 id="vpn--tor-combinations">VPN + Tor Combinations</h4>
|
|
|
|
<p><strong>Layered Anonymity Setups:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>VPN + Tor Configuration Options:
|
|
1. VPN → Tor (VPN first, then Tor):
|
|
- Advantages: Hides Tor usage from ISP
|
|
- Disadvantages: VPN provider can see real IP
|
|
- Setup: Connect to VPN, then use Tor Browser
|
|
- Use Case: Tor censorship circumvention
|
|
|
|
2. Tor → VPN (Tor first, then VPN):
|
|
- Advantages: VPN doesn't see real IP
|
|
- Disadvantages: Complex setup, potential correlation
|
|
- Setup: Route Tor traffic through VPN
|
|
- Use Case: Accessing VPN-only services anonymously
|
|
|
|
3. VPN → Tor → VPN (Double VPN with Tor):
|
|
- Advantages: Maximum anonymity layers
|
|
- Disadvantages: Very slow, complex configuration
|
|
- Setup: VPN1 → Tor → VPN2
|
|
- Use Case: Extreme security requirements
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="multi-hop-vpn-configurations">Multi-Hop VPN Configurations</h4>
|
|
|
|
<p><strong>Cascading VPN Connections:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Multi-hop VPN setup using multiple providers</span>
|
|
<span class="c"># Requires careful configuration to avoid leaks</span>
|
|
|
|
<span class="c"># First VPN connection</span>
|
|
openvpn <span class="nt">--config</span> provider1.ovpn <span class="nt">--daemon</span>
|
|
|
|
<span class="c"># Second VPN connection through first</span>
|
|
openvpn <span class="nt">--config</span> provider2.ovpn <span class="nt">--route-gateway</span> 10.0.0.1 <span class="nt">--daemon</span>
|
|
|
|
<span class="c"># Verify connection chain</span>
|
|
curl <span class="nt">-s</span> https://ipinfo.io/ip
|
|
<span class="c"># Should show second VPN provider's IP</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="network-monitoring-and-verification">Network Monitoring and Verification</h3>
|
|
|
|
<h4 id="connection-verification-procedures">Connection Verification Procedures</h4>
|
|
|
|
<p><strong>Network Security Testing:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Network security verification scripts</span>
|
|
|
|
<span class="c"># Check current IP address</span>
|
|
check_ip<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"Current IP: </span><span class="si">$(</span>curl <span class="nt">-s</span> https://ipinfo.io/ip<span class="si">)</span><span class="s2">"</span>
|
|
<span class="nb">echo</span> <span class="s2">"Location: </span><span class="si">$(</span>curl <span class="nt">-s</span> https://ipinfo.io/city<span class="si">)</span><span class="s2">"</span>
|
|
<span class="nb">echo</span> <span class="s2">"ISP: </span><span class="si">$(</span>curl <span class="nt">-s</span> https://ipinfo.io/org<span class="si">)</span><span class="s2">"</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># DNS leak testing</span>
|
|
check_dns_leaks<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"DNS servers in use:"</span>
|
|
nslookup google.com | <span class="nb">grep </span>Server
|
|
|
|
<span class="c"># Test for DNS leaks</span>
|
|
curl <span class="nt">-s</span> https://www.dnsleaktest.com/results.php
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># WebRTC leak testing</span>
|
|
check_webrtc_leaks<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"Testing for WebRTC leaks..."</span>
|
|
<span class="c"># Use browser-based testing at browserleaks.com/webrtc</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Tor circuit information</span>
|
|
check_tor_circuit<span class="o">()</span> <span class="o">{</span>
|
|
<span class="k">if </span><span class="nb">command</span> <span class="nt">-v</span> tor &> /dev/null<span class="p">;</span> <span class="k">then
|
|
</span><span class="nb">echo</span> <span class="s2">"Tor circuit information:"</span>
|
|
<span class="nb">echo</span> <span class="s1">'GETINFO circuit-status'</span> | nc 127.0.0.1 9051
|
|
<span class="k">fi</span>
|
|
<span class="o">}</span>
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="performance-monitoring">Performance Monitoring</h4>
|
|
|
|
<p><strong>Network Performance Assessment:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Network performance monitoring</span>
|
|
|
|
<span class="c"># Speed testing through anonymity network</span>
|
|
test_speed<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"Testing connection speed..."</span>
|
|
curl <span class="nt">-o</span> /dev/null <span class="nt">-s</span> <span class="nt">-w</span> <span class="s2">"Speed: %{speed_download} bytes/sec</span><span class="se">\n</span><span class="s2">"</span> <span class="se">\</span>
|
|
http://speedtest.wdc01.softlayer.com/downloads/test100.zip
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Latency testing</span>
|
|
test_latency<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"Testing network latency..."</span>
|
|
ping <span class="nt">-c</span> 5 8.8.8.8 | <span class="nb">tail</span> <span class="nt">-1</span> | <span class="nb">awk</span> <span class="s1">'{print $4}'</span> | <span class="nb">cut</span> <span class="nt">-d</span> <span class="s1">'/'</span> <span class="nt">-f</span> 2
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Connection stability monitoring</span>
|
|
monitor_connection<span class="o">()</span> <span class="o">{</span>
|
|
<span class="k">while </span><span class="nb">true</span><span class="p">;</span> <span class="k">do
|
|
if</span> <span class="o">!</span> curl <span class="nt">-s</span> <span class="nt">--max-time</span> 10 https://check.torproject.org/ <span class="o">></span> /dev/null<span class="p">;</span> <span class="k">then
|
|
</span><span class="nb">echo</span> <span class="s2">"</span><span class="si">$(</span><span class="nb">date</span><span class="si">)</span><span class="s2">: Connection lost"</span>
|
|
<span class="c"># Implement reconnection logic</span>
|
|
<span class="k">fi
|
|
</span><span class="nb">sleep </span>60
|
|
<span class="k">done</span>
|
|
<span class="o">}</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="operational-procedures">Operational Procedures</h3>
|
|
|
|
<h4 id="network-access-protocols">Network Access Protocols</h4>
|
|
|
|
<p><strong>Secure Network Usage Framework:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Network Access Procedures:
|
|
1. Pre-Connection Security:
|
|
- Verify network security configuration
|
|
- Check for DNS and IP leak protection
|
|
- Test kill switch functionality
|
|
- Document network access plan
|
|
|
|
2. Connection Establishment:
|
|
- Connect to VPN/Tor using secure procedures
|
|
- Verify anonymity and security status
|
|
- Test connection performance and stability
|
|
- Monitor for security warnings or alerts
|
|
|
|
3. Operational Usage:
|
|
- Follow role-based network access policies
|
|
- Monitor connection status continuously
|
|
- Use appropriate security levels for activities
|
|
- Document network usage for security review
|
|
|
|
4. Disconnection Security:
|
|
- Clear browser data and temporary files
|
|
- Verify secure disconnection procedures
|
|
- Check for data leaks or security issues
|
|
- Document session activities and outcomes
|
|
</code></pre></div></div>
|
|
|
|
<div class="info-box">
|
|
<div class="info-title">Network Anonymity Limitations</div>
|
|
<p>VPNs and Tor provide strong network-level protection but cannot protect against all surveillance methods. Behavioral analysis, timing correlation, and application-level attacks can still compromise anonymity. Use network anonymity tools as part of comprehensive operational security.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-4-social-media-operational-security">Section 7-4: Social Media Operational Security</h2>
|
|
|
|
<h3 id="overview-3">Overview</h3>
|
|
|
|
<p>Social media platforms present significant operational security challenges for resistance operations. These platforms collect vast amounts of personal data, track user behavior, and can be used for surveillance and intelligence gathering. This section provides comprehensive guidance for managing social media presence while maintaining operational security.</p>
|
|
|
|
<h3 id="social-media-threat-model">Social Media Threat Model</h3>
|
|
|
|
<h4 id="platform-surveillance-capabilities">Platform Surveillance Capabilities</h4>
|
|
|
|
<p><strong>Social Media Intelligence Gathering:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Social Media Surveillance Risks:
|
|
1. Data Collection and Profiling:
|
|
- Complete activity logs and behavioral patterns
|
|
- Social network mapping and relationship analysis
|
|
- Location tracking and movement patterns
|
|
- Interest profiling and predictive analysis
|
|
|
|
2. Content Analysis:
|
|
- Automated content scanning and keyword detection
|
|
- Image and video analysis with facial recognition
|
|
- Sentiment analysis and political profiling
|
|
- Cross-platform content correlation
|
|
|
|
3. Network Analysis:
|
|
- Social graph mapping and relationship tracking
|
|
- Communication pattern analysis
|
|
- Influence network identification
|
|
- Group membership and activity monitoring
|
|
|
|
4. Real-Time Monitoring:
|
|
- Live activity tracking and alerting
|
|
- Location-based surveillance and targeting
|
|
- Event coordination and protest monitoring
|
|
- Emergency response and law enforcement coordination
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="platform-specific-security-considerations">Platform-Specific Security Considerations</h3>
|
|
|
|
<h4 id="major-platform-analysis">Major Platform Analysis</h4>
|
|
|
|
<p><strong>Platform Security Assessment:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Social Media Platform Risks:
|
|
1. Facebook/Meta Platforms:
|
|
- Extensive data collection and profiling
|
|
- Real-name policy and identity verification
|
|
- Cross-platform tracking and correlation
|
|
- Government cooperation and data sharing
|
|
|
|
2. Twitter/X:
|
|
- Public content and searchable archives
|
|
- Real-time monitoring and trending analysis
|
|
- Government censorship and content removal
|
|
- Account suspension and deplatforming risks
|
|
|
|
3. Instagram:
|
|
- Image metadata and location tracking
|
|
- Facial recognition and tagging
|
|
- Story and activity monitoring
|
|
- Integration with Facebook surveillance
|
|
|
|
4. TikTok:
|
|
- Extensive device permissions and data access
|
|
- Content recommendation algorithm analysis
|
|
- International data sharing concerns
|
|
- Real-time location and activity tracking
|
|
|
|
5. LinkedIn:
|
|
- Professional network and employment tracking
|
|
- Skill and interest profiling
|
|
- Company and organization monitoring
|
|
- Career progression and relationship analysis
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="anonymous-social-media-usage">Anonymous Social Media Usage</h3>
|
|
|
|
<h4 id="account-creation-and-management">Account Creation and Management</h4>
|
|
|
|
<p><strong>Anonymous Account Procedures:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Anonymous Social Media Account Setup:
|
|
1. Account Creation Security:
|
|
- Use Tor Browser for account registration
|
|
- Create accounts from public WiFi locations
|
|
- Use temporary email addresses for registration
|
|
- Provide minimal or false personal information
|
|
|
|
2. Identity Development:
|
|
- Create consistent but fictional persona
|
|
- Develop believable background and interests
|
|
- Use AI-generated profile photos
|
|
- Maintain consistent posting patterns and voice
|
|
|
|
3. Account Security:
|
|
- Use strong, unique passwords
|
|
- Enable two-factor authentication with anonymous phone numbers
|
|
- Regularly review and update privacy settings
|
|
- Monitor account for suspicious activity
|
|
|
|
4. Operational Separation:
|
|
- Never link anonymous accounts to real identity
|
|
- Use different devices for different accounts
|
|
- Maintain separate browser profiles and sessions
|
|
- Avoid cross-contamination between accounts
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="content-security-guidelines">Content Security Guidelines</h4>
|
|
|
|
<p><strong>Secure Content Practices:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Social Media Content Security:
|
|
1. Content Creation:
|
|
- Remove metadata from all images and videos
|
|
- Avoid location-specific references or landmarks
|
|
- Use generic language and avoid unique phrases
|
|
- Consider time zone implications for posting times
|
|
|
|
2. Image and Video Security:
|
|
- Strip EXIF data from all media files
|
|
- Avoid reflective surfaces showing surroundings
|
|
- Use image editing to remove identifying features
|
|
- Consider reverse image search implications
|
|
|
|
3. Language and Communication:
|
|
- Use coded language for sensitive topics
|
|
- Avoid specific names, dates, and locations
|
|
- Maintain consistent persona voice and style
|
|
- Consider linguistic analysis and fingerprinting
|
|
|
|
4. Interaction Security:
|
|
- Limit interactions with known associates
|
|
- Avoid liking or sharing personal content
|
|
- Use private messaging sparingly and securely
|
|
- Monitor follower lists for suspicious accounts
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="privacy-settings-and-configuration">Privacy Settings and Configuration</h3>
|
|
|
|
<h4 id="platform-privacy-hardening">Platform Privacy Hardening</h4>
|
|
|
|
<p><strong>Privacy Settings Optimization:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Social Media Privacy Configuration:
|
|
1. Profile Privacy:
|
|
- Set profile to private/protected mode
|
|
- Limit profile information visibility
|
|
- Disable people discovery features
|
|
- Turn off activity status indicators
|
|
|
|
2. Content Privacy:
|
|
- Limit post visibility to followers only
|
|
- Disable content indexing by search engines
|
|
- Turn off location services and geotagging
|
|
- Disable automatic photo tagging and recognition
|
|
|
|
3. Communication Privacy:
|
|
- Restrict direct message permissions
|
|
- Disable read receipts and typing indicators
|
|
- Limit who can find you by contact information
|
|
- Turn off online status and last seen indicators
|
|
|
|
4. Data and Advertising:
|
|
- Opt out of data collection and sharing
|
|
- Disable personalized advertising
|
|
- Limit third-party app permissions
|
|
- Turn off cross-platform tracking
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="mobile-app-security">Mobile App Security</h4>
|
|
|
|
<p><strong>Social Media App Hardening:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Mobile app permission management</span>
|
|
<span class="c"># Disable unnecessary permissions for social media apps</span>
|
|
|
|
<span class="c"># Android permission management</span>
|
|
adb shell pm revoke com.facebook.katana android.permission.ACCESS_FINE_LOCATION
|
|
adb shell pm revoke com.facebook.katana android.permission.CAMERA
|
|
adb shell pm revoke com.facebook.katana android.permission.RECORD_AUDIO
|
|
|
|
<span class="c"># iOS permission management (through Settings)</span>
|
|
<span class="c"># Settings > Privacy & Security > Location Services > [App] > Never</span>
|
|
<span class="c"># Settings > Privacy & Security > Camera > [App] > Off</span>
|
|
<span class="c"># Settings > Privacy & Security > Microphone > [App] > Off</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="social-media-intelligence-gathering">Social Media Intelligence Gathering</h3>
|
|
|
|
<h4 id="open-source-intelligence-osint">Open Source Intelligence (OSINT)</h4>
|
|
|
|
<p><strong>Social Media Research Techniques:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>OSINT Social Media Research:
|
|
1. Profile Investigation:
|
|
- Analyze public profile information and history
|
|
- Map social connections and relationships
|
|
- Identify patterns in posting behavior
|
|
- Cross-reference information across platforms
|
|
|
|
2. Content Analysis:
|
|
- Search for specific keywords and hashtags
|
|
- Analyze image and video content for intelligence
|
|
- Track location data and movement patterns
|
|
- Monitor real-time activity and updates
|
|
|
|
3. Network Mapping:
|
|
- Identify key influencers and network nodes
|
|
- Map organizational structures and hierarchies
|
|
- Track communication patterns and relationships
|
|
- Analyze group membership and affiliations
|
|
|
|
4. Temporal Analysis:
|
|
- Track activity patterns over time
|
|
- Identify routine behaviors and schedules
|
|
- Correlate activities with external events
|
|
- Predict future activities and locations
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="counter-intelligence-measures">Counter-Intelligence Measures</h4>
|
|
|
|
<p><strong>Social Media Counter-Intelligence:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Counter-Intelligence Procedures:
|
|
1. Disinformation and Misdirection:
|
|
- Post misleading information about activities
|
|
- Create false patterns and routines
|
|
- Use decoy accounts and personas
|
|
- Implement noise generation strategies
|
|
|
|
2. Surveillance Detection:
|
|
- Monitor for unusual follower activity
|
|
- Track suspicious engagement patterns
|
|
- Identify potential surveillance accounts
|
|
- Document and report suspicious activity
|
|
|
|
3. Operational Security:
|
|
- Compartmentalize social media activities
|
|
- Use different platforms for different purposes
|
|
- Implement temporal and geographic separation
|
|
- Maintain plausible deniability for activities
|
|
|
|
4. Network Protection:
|
|
- Protect associate identities and activities
|
|
- Avoid tagging or mentioning operational contacts
|
|
- Use coded communication for coordination
|
|
- Implement group security protocols
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="crisis-communication-and-emergency-procedures">Crisis Communication and Emergency Procedures</h3>
|
|
|
|
<h4 id="emergency-social-media-protocols">Emergency Social Media Protocols</h4>
|
|
|
|
<p><strong>Crisis Communication Framework:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Emergency Social Media Procedures:
|
|
1. Account Compromise Response:
|
|
- Immediately change passwords and enable 2FA
|
|
- Review account activity and unauthorized access
|
|
- Notify contacts through alternative channels
|
|
- Document compromise for security analysis
|
|
|
|
2. Content Removal and Damage Control:
|
|
- Identify and remove compromising content
|
|
- Contact platform support for content removal
|
|
- Implement damage assessment procedures
|
|
- Coordinate response with network members
|
|
|
|
3. Emergency Communication:
|
|
- Use predetermined emergency communication codes
|
|
- Activate alternative communication channels
|
|
- Coordinate with network emergency procedures
|
|
- Monitor for law enforcement or surveillance response
|
|
|
|
4. Account Abandonment:
|
|
- Implement secure account deletion procedures
|
|
- Transfer important information to secure channels
|
|
- Notify trusted contacts of account changes
|
|
- Create new accounts with enhanced security
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="legal-and-compliance-considerations">Legal and Compliance Considerations</h4>
|
|
|
|
<p><strong>Legal Risk Management:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Social Media Legal Considerations:
|
|
1. Content Liability:
|
|
- Understand platform terms of service
|
|
- Consider legal implications of posted content
|
|
- Implement content review and approval procedures
|
|
- Document content for legal protection
|
|
|
|
2. Data Protection and Privacy:
|
|
- Comply with applicable privacy regulations
|
|
- Understand data retention and deletion policies
|
|
- Implement data protection procedures
|
|
- Consider cross-border data transfer implications
|
|
|
|
3. Law Enforcement Cooperation:
|
|
- Understand platform cooperation with authorities
|
|
- Consider warrant and subpoena implications
|
|
- Implement legal response procedures
|
|
- Maintain legal counsel and support resources
|
|
|
|
4. International Considerations:
|
|
- Consider jurisdiction and applicable laws
|
|
- Understand international cooperation agreements
|
|
- Implement location-specific security measures
|
|
- Consider diplomatic and political implications
|
|
</code></pre></div></div>
|
|
|
|
<div class="warning-box">
|
|
<div class="warning-title">Social Media Risks</div>
|
|
<p>Social media platforms pose significant risks to operational security through extensive data collection, surveillance capabilities, and government cooperation. Use social media sparingly and with comprehensive security measures, or avoid entirely for high-risk operations.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-5-email-security-and-anonymous-accounts">Section 7-5: Email Security and Anonymous Accounts</h2>
|
|
|
|
<h3 id="overview-4">Overview</h3>
|
|
|
|
<p>Email remains a critical communication channel for many activities, but traditional email services pose significant security and privacy risks. This section covers secure email practices, anonymous account creation, and email security measures for resistance operations.</p>
|
|
|
|
<h3 id="email-threat-model">Email Threat Model</h3>
|
|
|
|
<h4 id="email-security-vulnerabilities">Email Security Vulnerabilities</h4>
|
|
|
|
<p><strong>Email-Based Surveillance Risks:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Email Security Threats:
|
|
1. Content Surveillance:
|
|
- Unencrypted email content scanning
|
|
- Keyword detection and automated analysis
|
|
- Attachment scanning and malware detection
|
|
- Cross-reference with other intelligence sources
|
|
|
|
2. Metadata Collection:
|
|
- Email headers and routing information
|
|
- Sender and recipient relationship mapping
|
|
- Timestamp and frequency analysis
|
|
- IP address and location tracking
|
|
|
|
3. Account Compromise:
|
|
- Password attacks and credential theft
|
|
- Account takeover and impersonation
|
|
- Email forwarding and redirection
|
|
- Access to email history and contacts
|
|
|
|
4. Provider Cooperation:
|
|
- Government data requests and subpoenas
|
|
- Real-time monitoring and interception
|
|
- Data retention and historical access
|
|
- Cross-border data sharing agreements
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="secure-email-service-selection">Secure Email Service Selection</h3>
|
|
|
|
<h4 id="privacy-focused-email-providers">Privacy-Focused Email Providers</h4>
|
|
|
|
<p><strong>Secure Email Provider Comparison:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Secure Email Provider Assessment:
|
|
1. ProtonMail:
|
|
- Advantages: End-to-end encryption, Swiss jurisdiction
|
|
- Disadvantages: Limited free tier, requires JavaScript
|
|
- Use Case: General secure email with good usability
|
|
- Security Level: High
|
|
|
|
2. Tutanota:
|
|
- Advantages: Full encryption, open source client
|
|
- Disadvantages: Limited third-party client support
|
|
- Use Case: Maximum encryption with calendar integration
|
|
- Security Level: High
|
|
|
|
3. Guerrilla Mail:
|
|
- Advantages: Temporary email, no registration required
|
|
- Disadvantages: No encryption, temporary nature
|
|
- Use Case: Disposable email for account registration
|
|
- Security Level: Low (anonymity only)
|
|
|
|
4. Cock.li:
|
|
- Advantages: Anonymous registration, Tor-friendly
|
|
- Disadvantages: Reliability concerns, limited features
|
|
- Use Case: Anonymous email with minimal requirements
|
|
- Security Level: Medium
|
|
|
|
5. Self-Hosted Email:
|
|
- Advantages: Complete control, custom security
|
|
- Disadvantages: Technical complexity, maintenance burden
|
|
- Use Case: Maximum control and customization
|
|
- Security Level: Maximum (when properly configured)
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="anonymous-email-account-creation">Anonymous Email Account Creation</h3>
|
|
|
|
<h4 id="account-registration-security">Account Registration Security</h4>
|
|
|
|
<p><strong>Anonymous Account Setup Procedures:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Anonymous Email Account Creation:
|
|
1. Network Anonymity:
|
|
- Use Tor Browser for account registration
|
|
- Connect from public WiFi locations
|
|
- Use different exit nodes for different accounts
|
|
- Avoid patterns in registration timing and location
|
|
|
|
2. Identity Protection:
|
|
- Use temporary or anonymous contact information
|
|
- Provide minimal required information only
|
|
- Use password managers for unique, strong passwords
|
|
- Enable two-factor authentication with anonymous methods
|
|
|
|
3. Payment Security (for paid services):
|
|
- Use cryptocurrency for anonymous payments
|
|
- Purchase prepaid cards with cash
|
|
- Use gift cards obtained anonymously
|
|
- Avoid linking to personal financial accounts
|
|
|
|
4. Account Verification:
|
|
- Use anonymous phone numbers for SMS verification
|
|
- Use temporary email addresses for email verification
|
|
- Avoid social media or identity verification
|
|
- Complete verification from same anonymous network
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="multiple-account-management">Multiple Account Management</h4>
|
|
|
|
<p><strong>Account Compartmentalization Strategy:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Email Account Compartmentalization:
|
|
1. Role-Based Accounts:
|
|
- Personal/cover identity accounts
|
|
- Research and intelligence gathering accounts
|
|
- Operational communication accounts
|
|
- Emergency and backup accounts
|
|
|
|
2. Account Isolation:
|
|
- Different email providers for different roles
|
|
- Separate devices or browser profiles for each account
|
|
- Different network access methods for each account
|
|
- Independent password and security management
|
|
|
|
3. Account Rotation:
|
|
- Regular account replacement and renewal
|
|
- Secure migration of important communications
|
|
- Proper disposal of obsolete accounts
|
|
- Documentation of account lifecycle and usage
|
|
|
|
4. Cross-Contamination Prevention:
|
|
- Never link accounts to each other
|
|
- Avoid similar usernames or patterns
|
|
- Use different writing styles and languages
|
|
- Maintain separate contact lists and communications
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="email-encryption-and-security">Email Encryption and Security</h3>
|
|
|
|
<h4 id="pgpgpg-email-encryption">PGP/GPG Email Encryption</h4>
|
|
|
|
<p><strong>Email Encryption Setup:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># GPG key generation for email encryption</span>
|
|
gpg <span class="nt">--full-generate-key</span>
|
|
|
|
<span class="c"># Select key type: RSA and RSA (default)</span>
|
|
<span class="c"># Key size: 4096 bits</span>
|
|
<span class="c"># Key expiration: 2 years (recommended)</span>
|
|
<span class="c"># Real name: Use operational pseudonym</span>
|
|
<span class="c"># Email: Use secure email address</span>
|
|
<span class="c"># Passphrase: Strong, unique passphrase</span>
|
|
|
|
<span class="c"># Export public key for sharing</span>
|
|
gpg <span class="nt">--armor</span> <span class="nt">--export</span> user@example.com <span class="o">></span> public_key.asc
|
|
|
|
<span class="c"># Import recipient's public key</span>
|
|
gpg <span class="nt">--import</span> recipient_public_key.asc
|
|
|
|
<span class="c"># Encrypt email message</span>
|
|
<span class="nb">echo</span> <span class="s2">"Secret message"</span> | gpg <span class="nt">--armor</span> <span class="nt">--encrypt</span> <span class="nt">--recipient</span> recipient@example.com
|
|
|
|
<span class="c"># Decrypt received message</span>
|
|
gpg <span class="nt">--decrypt</span> encrypted_message.asc
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>Thunderbird with Enigmail Configuration:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Thunderbird Email Security Setup:
|
|
1. Thunderbird Installation:
|
|
- Download from official Mozilla website
|
|
- Verify download integrity and signatures
|
|
- Install with minimal permissions and features
|
|
- Configure for maximum privacy and security
|
|
|
|
2. Account Configuration:
|
|
- Use secure email provider settings
|
|
- Enable SSL/TLS for all connections
|
|
- Disable automatic content loading
|
|
- Configure secure authentication methods
|
|
|
|
3. Enigmail/OpenPGP Integration:
|
|
- Install Enigmail extension or use built-in OpenPGP
|
|
- Import or generate PGP keys
|
|
- Configure automatic encryption and signing
|
|
- Test encryption with trusted contacts
|
|
|
|
4. Security Hardening:
|
|
- Disable remote content and tracking
|
|
- Configure secure deletion of messages
|
|
- Enable message encryption by default
|
|
- Regular backup of keys and configuration
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="email-operational-security">Email Operational Security</h4>
|
|
|
|
<p><strong>Secure Email Practices:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Email OpSec Procedures:
|
|
1. Message Security:
|
|
- Encrypt all sensitive email messages
|
|
- Use coded language even in encrypted messages
|
|
- Avoid specific names, dates, and locations
|
|
- Implement message retention and deletion policies
|
|
|
|
2. Attachment Security:
|
|
- Encrypt all email attachments separately
|
|
- Remove metadata from attached files
|
|
- Use secure file formats and avoid executables
|
|
- Verify attachment integrity and authenticity
|
|
|
|
3. Communication Protocols:
|
|
- Establish secure communication procedures with contacts
|
|
- Use predetermined code words and phrases
|
|
- Implement message authentication and verification
|
|
- Plan for emergency communication procedures
|
|
|
|
4. Account Security:
|
|
- Regular password changes and security updates
|
|
- Monitor account activity for suspicious behavior
|
|
- Use secure devices and networks for email access
|
|
- Implement account backup and recovery procedures
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="temporary-and-disposable-email">Temporary and Disposable Email</h3>
|
|
|
|
<h4 id="disposable-email-services">Disposable Email Services</h4>
|
|
|
|
<p><strong>Temporary Email Usage:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Disposable Email Services:
|
|
1. Guerrilla Mail:
|
|
- No registration required
|
|
- Temporary inbox with configurable duration
|
|
- Basic spam filtering and security
|
|
- Tor-friendly access and usage
|
|
|
|
2. 10 Minute Mail:
|
|
- Automatic expiration after 10 minutes
|
|
- Extendable duration if needed
|
|
- No registration or personal information
|
|
- Good for one-time account verification
|
|
|
|
3. TempMail:
|
|
- Multiple domain options
|
|
- Mobile app availability
|
|
- Basic security features
|
|
- API access for automation
|
|
|
|
4. ProtonMail Aliases:
|
|
- Temporary aliases for ProtonMail accounts
|
|
- Full encryption and security features
|
|
- Integrated with main account management
|
|
- Professional appearance and reliability
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="automated-email-management">Automated Email Management</h4>
|
|
|
|
<p><strong>Email Automation and Filtering:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Email filtering and automation scripts</span>
|
|
|
|
<span class="c"># Automatic email deletion script</span>
|
|
<span class="c">#!/bin/bash</span>
|
|
<span class="c"># Delete emails older than 30 days</span>
|
|
find ~/Mail <span class="nt">-name</span> <span class="s2">"*.eml"</span> <span class="nt">-mtime</span> +30 <span class="nt">-delete</span>
|
|
|
|
<span class="c"># Encrypted email backup script</span>
|
|
<span class="c">#!/bin/bash</span>
|
|
<span class="c"># Backup and encrypt email archive</span>
|
|
<span class="nb">tar</span> <span class="nt">-czf</span> email_backup.tar.gz ~/Mail
|
|
gpg <span class="nt">--cipher-algo</span> AES256 <span class="nt">--compress-algo</span> 1 <span class="nt">--s2k-mode</span> 3 <span class="se">\</span>
|
|
<span class="nt">--s2k-digest-algo</span> SHA512 <span class="nt">--s2k-count</span> 65536 <span class="nt">--symmetric</span> <span class="se">\</span>
|
|
<span class="nt">--output</span> email_backup.tar.gz.gpg email_backup.tar.gz
|
|
<span class="nb">rm </span>email_backup.tar.gz
|
|
|
|
<span class="c"># Email security monitoring script</span>
|
|
<span class="c">#!/bin/bash</span>
|
|
<span class="c"># Monitor for suspicious email activity</span>
|
|
<span class="nb">grep</span> <span class="nt">-i</span> <span class="s2">"failed login"</span> /var/log/mail.log | <span class="nb">tail</span> <span class="nt">-10</span>
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="self-hosted-email-security">Self-Hosted Email Security</h3>
|
|
|
|
<h4 id="mail-server-setup-and-hardening">Mail Server Setup and Hardening</h4>
|
|
|
|
<p><strong>Secure Mail Server Configuration:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Basic mail server security setup (Postfix + Dovecot)</span>
|
|
|
|
<span class="c"># Install mail server components</span>
|
|
<span class="nb">sudo </span>apt update
|
|
<span class="nb">sudo </span>apt <span class="nb">install </span>postfix dovecot-imapd dovecot-pop3d
|
|
|
|
<span class="c"># Configure Postfix for security</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_use_tls=yes'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_tls_security_level=may'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtp_tls_security_level=may'</span>
|
|
|
|
<span class="c"># Configure authentication and security</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_sasl_auth_enable=yes'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_sasl_security_options=noanonymous'</span>
|
|
<span class="nb">sudo </span>postconf <span class="nt">-e</span> <span class="s1">'smtpd_recipient_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'</span>
|
|
|
|
<span class="c"># Enable and start services</span>
|
|
<span class="nb">sudo </span>systemctl <span class="nb">enable </span>postfix dovecot
|
|
<span class="nb">sudo </span>systemctl start postfix dovecot
|
|
</code></pre></div></div>
|
|
|
|
<p><strong>Email Server Security Hardening:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Mail Server Security Checklist:
|
|
□ Enable SSL/TLS encryption for all connections
|
|
□ Configure strong authentication mechanisms
|
|
□ Implement spam and malware filtering
|
|
□ Set up proper DNS records (SPF, DKIM, DMARC)
|
|
□ Configure firewall rules for mail services
|
|
□ Enable logging and monitoring
|
|
□ Implement backup and recovery procedures
|
|
□ Regular security updates and maintenance
|
|
</code></pre></div></div>
|
|
|
|
<div class="success-box">
|
|
<div class="success-title">Email Security Layering</div>
|
|
<p>Effective email security requires multiple layers including secure providers, encryption, operational security, and proper account management. No single measure provides complete protection against all email-based threats.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="section-7-6-digital-footprint-minimization">Section 7-6: Digital Footprint Minimization</h2>
|
|
|
|
<h3 id="overview-5">Overview</h3>
|
|
|
|
<p>Digital footprint minimization involves reducing and managing the traces of online activity that can be used for surveillance, profiling, and tracking. Every online interaction creates data that can be collected, analyzed, and used to build detailed profiles of individuals and their activities. This section provides comprehensive strategies for minimizing digital exposure while maintaining operational effectiveness.</p>
|
|
|
|
<h3 id="digital-footprint-assessment">Digital Footprint Assessment</h3>
|
|
|
|
<h4 id="types-of-digital-traces">Types of Digital Traces</h4>
|
|
|
|
<p><strong>Digital Footprint Categories:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Digital Trace Classification:
|
|
1. Active Digital Footprints:
|
|
- Social media posts and interactions
|
|
- Email communications and subscriptions
|
|
- Online purchases and financial transactions
|
|
- Website registrations and account creation
|
|
|
|
2. Passive Digital Footprints:
|
|
- Website visit logs and tracking cookies
|
|
- Search engine queries and results
|
|
- Location data from mobile devices
|
|
- Network traffic and connection logs
|
|
|
|
3. Behavioral Digital Footprints:
|
|
- Typing patterns and linguistic analysis
|
|
- Mouse movement and click patterns
|
|
- Application usage and timing patterns
|
|
- Device and browser fingerprinting
|
|
|
|
4. Metadata Digital Footprints:
|
|
- File creation and modification timestamps
|
|
- Image EXIF data and location information
|
|
- Document metadata and version history
|
|
- Communication timing and frequency patterns
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="footprint-discovery-and-analysis">Footprint Discovery and Analysis</h4>
|
|
|
|
<p><strong>Digital Footprint Audit Procedures:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Digital footprint discovery tools and techniques</span>
|
|
|
|
<span class="c"># Search for personal information online</span>
|
|
<span class="c"># Use search engines with your name and associated information</span>
|
|
google_search<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nb">echo</span> <span class="s2">"Searching for: </span><span class="nv">$1</span><span class="s2">"</span>
|
|
curl <span class="nt">-s</span> <span class="s2">"https://www.google.com/search?q=</span><span class="nv">$1</span><span class="s2">"</span> | <span class="nb">grep</span> <span class="nt">-o</span> <span class="s1">'<h3.*</h3>'</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Check data broker sites</span>
|
|
<span class="c"># Use services like Have I Been Pwned to check for data breaches</span>
|
|
check_breaches<span class="o">()</span> <span class="o">{</span>
|
|
curl <span class="nt">-s</span> <span class="s2">"https://haveibeenpwned.com/api/v3/breachedaccount/</span><span class="nv">$1</span><span class="s2">"</span> <span class="se">\</span>
|
|
<span class="nt">-H</span> <span class="s2">"hibp-api-key: YOUR_API_KEY"</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Reverse image search for profile photos</span>
|
|
<span class="c"># Use TinEye or Google Images to find where images appear</span>
|
|
|
|
<span class="c"># Check social media presence across platforms</span>
|
|
<span class="c"># Use tools like Sherlock to find usernames across platforms</span>
|
|
python3 sherlock.py username
|
|
|
|
<span class="c"># DNS and WHOIS lookups for owned domains</span>
|
|
whois example.com
|
|
dig example.com ANY
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="data-minimization-strategies">Data Minimization Strategies</h3>
|
|
|
|
<h4 id="information-reduction-techniques">Information Reduction Techniques</h4>
|
|
|
|
<p><strong>Data Minimization Framework:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Data Reduction Strategies:
|
|
1. Account Consolidation and Deletion:
|
|
- Identify and catalog all online accounts
|
|
- Delete unnecessary and obsolete accounts
|
|
- Consolidate similar services and accounts
|
|
- Implement regular account review and cleanup
|
|
|
|
2. Information Sanitization:
|
|
- Remove personal information from public profiles
|
|
- Delete historical posts and content
|
|
- Clear search and browsing history
|
|
- Remove metadata from files and documents
|
|
|
|
3. Service Substitution:
|
|
- Replace tracking services with privacy-focused alternatives
|
|
- Use anonymous services where possible
|
|
- Implement self-hosted solutions for critical services
|
|
- Reduce dependency on data-collecting platforms
|
|
|
|
4. Communication Minimization:
|
|
- Reduce email subscriptions and newsletters
|
|
- Limit social media interactions and posts
|
|
- Use ephemeral communication methods
|
|
- Implement communication retention policies
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="privacy-focused-service-alternatives">Privacy-Focused Service Alternatives</h4>
|
|
|
|
<p><strong>Service Replacement Matrix:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Privacy Service Alternatives:
|
|
Service Type | Standard Option | Privacy Alternative | Security Level
|
|
--------------------|-----------------|--------------------|-----------------
|
|
Search Engine | Google | DuckDuckGo/Searx | High
|
|
Email Service | Gmail | ProtonMail/Tutanota| High
|
|
Cloud Storage | Google Drive | Mega/Tresorit | Medium-High
|
|
Maps/Navigation | Google Maps | OpenStreetMap | Medium
|
|
Social Media | Facebook | Mastodon/Diaspora | Medium
|
|
Video Platform | YouTube | PeerTube/Odysee | Medium
|
|
Messaging | WhatsApp | Signal/Session | High
|
|
Web Browser | Chrome | Firefox/Tor Browser| High
|
|
Operating System | Windows | Linux/Tails | High
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="online-presence-management">Online Presence Management</h3>
|
|
|
|
<h4 id="identity-compartmentalization">Identity Compartmentalization</h4>
|
|
|
|
<p><strong>Digital Identity Separation:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Identity Management Strategy:
|
|
1. Personal Identity:
|
|
- Real name and authentic information
|
|
- Normal social media and online presence
|
|
- Standard privacy settings and practices
|
|
- Minimal operational security measures
|
|
|
|
2. Professional Identity:
|
|
- Work-related accounts and profiles
|
|
- Industry-specific social media presence
|
|
- Professional networking and communications
|
|
- Enhanced privacy settings and awareness
|
|
|
|
3. Research Identity:
|
|
- Anonymous or pseudonymous accounts
|
|
- Privacy-focused services and tools
|
|
- Enhanced operational security measures
|
|
- Compartmentalized from other identities
|
|
|
|
4. Operational Identity:
|
|
- Completely anonymous accounts and services
|
|
- Maximum security and privacy measures
|
|
- Ephemeral and disposable accounts
|
|
- No connection to other identities
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="content-management-and-curation">Content Management and Curation</h4>
|
|
|
|
<p><strong>Digital Content Strategy:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Content Management Procedures:
|
|
1. Content Creation:
|
|
- Consider long-term implications of all content
|
|
- Remove identifying information and metadata
|
|
- Use generic language and avoid unique phrases
|
|
- Implement content review and approval processes
|
|
|
|
2. Content Distribution:
|
|
- Control content sharing and redistribution
|
|
- Use appropriate platforms for different content types
|
|
- Implement access controls and permissions
|
|
- Monitor content usage and sharing
|
|
|
|
3. Content Maintenance:
|
|
- Regular review and update of published content
|
|
- Remove outdated or compromising content
|
|
- Update privacy settings and access controls
|
|
- Archive important content securely
|
|
|
|
4. Content Deletion:
|
|
- Implement secure deletion procedures
|
|
- Verify content removal from all platforms
|
|
- Consider cached and archived versions
|
|
- Document deletion for compliance and security
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="technical-footprint-reduction">Technical Footprint Reduction</h3>
|
|
|
|
<h4 id="browser-and-device-configuration">Browser and Device Configuration</h4>
|
|
|
|
<p><strong>Technical Privacy Hardening:</strong></p>
|
|
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1">// Browser privacy configuration</span>
|
|
<span class="c1">// Disable tracking and fingerprinting vectors</span>
|
|
|
|
<span class="c1">// Firefox privacy settings</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.trackingprotection.enabled</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.donottrackheader.enabled</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.resistFingerprinting</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.firstparty.isolate</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
|
|
<span class="c1">// Disable WebRTC IP leaks</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">media.peerconnection.enabled</span><span class="dl">"</span><span class="p">,</span> <span class="kc">false</span><span class="p">);</span>
|
|
|
|
<span class="c1">// Disable geolocation</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">geo.enabled</span><span class="dl">"</span><span class="p">,</span> <span class="kc">false</span><span class="p">);</span>
|
|
|
|
<span class="c1">// Disable battery API</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">dom.battery.enabled</span><span class="dl">"</span><span class="p">,</span> <span class="kc">false</span><span class="p">);</span>
|
|
|
|
<span class="c1">// Clear data on shutdown</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.sanitize.sanitizeOnShutdown</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.clearOnShutdown.cache</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.clearOnShutdown.cookies</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
<span class="nf">user_pref</span><span class="p">(</span><span class="dl">"</span><span class="s2">privacy.clearOnShutdown.history</span><span class="dl">"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="network-level-privacy">Network-Level Privacy</h4>
|
|
|
|
<p><strong>Network Privacy Configuration:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Network privacy and anonymity measures</span>
|
|
|
|
<span class="c"># MAC address randomization (Linux)</span>
|
|
<span class="nb">sudo </span>macchanger <span class="nt">-r</span> wlan0
|
|
|
|
<span class="c"># DNS privacy configuration</span>
|
|
<span class="c"># Use DNS over HTTPS or DNS over TLS</span>
|
|
<span class="nb">echo</span> <span class="s2">"nameserver 1.1.1.1"</span> | <span class="nb">sudo tee</span> /etc/resolv.conf
|
|
<span class="nb">echo</span> <span class="s2">"nameserver 1.0.0.1"</span> | <span class="nb">sudo tee</span> <span class="nt">-a</span> /etc/resolv.conf
|
|
|
|
<span class="c"># Firewall configuration for privacy</span>
|
|
<span class="nb">sudo </span>ufw default deny incoming
|
|
<span class="nb">sudo </span>ufw default allow outgoing
|
|
<span class="nb">sudo </span>ufw <span class="nb">enable</span>
|
|
|
|
<span class="c"># Disable IPv6 if not needed (can leak information)</span>
|
|
<span class="nb">echo</span> <span class="s2">"net.ipv6.conf.all.disable_ipv6 = 1"</span> | <span class="nb">sudo tee</span> <span class="nt">-a</span> /etc/sysctl.conf
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="monitoring-and-maintenance">Monitoring and Maintenance</h3>
|
|
|
|
<h4 id="digital-footprint-monitoring">Digital Footprint Monitoring</h4>
|
|
|
|
<p><strong>Ongoing Footprint Assessment:</strong></p>
|
|
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Automated digital footprint monitoring</span>
|
|
|
|
<span class="c"># Google Alerts for name and associated information</span>
|
|
<span class="c"># Set up alerts for your name, usernames, and associated information</span>
|
|
|
|
<span class="c"># Regular search engine monitoring</span>
|
|
monitor_footprint<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nv">SEARCH_TERMS</span><span class="o">=(</span><span class="s2">"your name"</span> <span class="s2">"username"</span> <span class="s2">"email address"</span><span class="o">)</span>
|
|
|
|
<span class="k">for </span>term <span class="k">in</span> <span class="s2">"</span><span class="k">${</span><span class="nv">SEARCH_TERMS</span><span class="p">[@]</span><span class="k">}</span><span class="s2">"</span><span class="p">;</span> <span class="k">do
|
|
</span><span class="nb">echo</span> <span class="s2">"Searching for: </span><span class="nv">$term</span><span class="s2">"</span>
|
|
<span class="c"># Perform searches and log results</span>
|
|
curl <span class="nt">-s</span> <span class="s2">"https://www.google.com/search?q=</span><span class="nv">$term</span><span class="s2">"</span> <span class="o">></span> <span class="s2">"search_results_</span><span class="si">$(</span><span class="nb">date</span> +%Y%m%d<span class="si">)</span><span class="s2">.html"</span>
|
|
<span class="k">done</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Data breach monitoring</span>
|
|
check_breaches_automated<span class="o">()</span> <span class="o">{</span>
|
|
<span class="nv">EMAIL_ADDRESSES</span><span class="o">=(</span><span class="s2">"email1@example.com"</span> <span class="s2">"email2@example.com"</span><span class="o">)</span>
|
|
|
|
<span class="k">for </span>email <span class="k">in</span> <span class="s2">"</span><span class="k">${</span><span class="nv">EMAIL_ADDRESSES</span><span class="p">[@]</span><span class="k">}</span><span class="s2">"</span><span class="p">;</span> <span class="k">do
|
|
</span><span class="nb">echo</span> <span class="s2">"Checking breaches for: </span><span class="nv">$email</span><span class="s2">"</span>
|
|
<span class="c"># Check Have I Been Pwned API</span>
|
|
curl <span class="nt">-s</span> <span class="s2">"https://haveibeenpwned.com/api/v3/breachedaccount/</span><span class="nv">$email</span><span class="s2">"</span>
|
|
<span class="k">done</span>
|
|
<span class="o">}</span>
|
|
|
|
<span class="c"># Social media monitoring</span>
|
|
monitor_social_media<span class="o">()</span> <span class="o">{</span>
|
|
<span class="c"># Use tools like Social Searcher or mention.com</span>
|
|
<span class="c"># Monitor for mentions across social media platforms</span>
|
|
<span class="nb">echo</span> <span class="s2">"Monitoring social media mentions..."</span>
|
|
<span class="o">}</span>
|
|
</code></pre></div></div>
|
|
|
|
<h4 id="cleanup-and-maintenance-procedures">Cleanup and Maintenance Procedures</h4>
|
|
|
|
<p><strong>Regular Maintenance Tasks:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Digital Hygiene Maintenance Schedule:
|
|
1. Weekly Tasks:
|
|
- Clear browser data and cookies
|
|
- Review and delete unnecessary files
|
|
- Check privacy settings on active accounts
|
|
- Monitor for new digital traces
|
|
|
|
2. Monthly Tasks:
|
|
- Comprehensive search engine footprint check
|
|
- Review and update account privacy settings
|
|
- Delete obsolete accounts and services
|
|
- Update passwords and security settings
|
|
|
|
3. Quarterly Tasks:
|
|
- Complete digital footprint audit
|
|
- Review and update privacy policies
|
|
- Assess new services and privacy implications
|
|
- Update security tools and configurations
|
|
|
|
4. Annual Tasks:
|
|
- Comprehensive security and privacy review
|
|
- Update threat model and risk assessment
|
|
- Review and update operational procedures
|
|
- Plan for emerging threats and technologies
|
|
</code></pre></div></div>
|
|
|
|
<h3 id="legal-and-compliance-considerations-1">Legal and Compliance Considerations</h3>
|
|
|
|
<h4 id="data-protection-rights">Data Protection Rights</h4>
|
|
|
|
<p><strong>Privacy Rights and Regulations:</strong></p>
|
|
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Data Protection Framework:
|
|
1. GDPR Rights (EU):
|
|
- Right to access personal data
|
|
- Right to rectification of inaccurate data
|
|
- Right to erasure ("right to be forgotten")
|
|
- Right to data portability
|
|
|
|
2. CCPA Rights (California):
|
|
- Right to know about personal information collection
|
|
- Right to delete personal information
|
|
- Right to opt-out of sale of personal information
|
|
- Right to non-discrimination for exercising rights
|
|
|
|
3. Data Subject Requests:
|
|
- Submit formal data deletion requests
|
|
- Request copies of collected personal data
|
|
- Challenge inaccurate or outdated information
|
|
- Monitor compliance with deletion requests
|
|
|
|
4. Legal Documentation:
|
|
- Document all data protection requests
|
|
- Maintain records of compliance efforts
|
|
- Consider legal representation for complex cases
|
|
- Understand limitations and exceptions
|
|
</code></pre></div></div>
|
|
|
|
<div class="info-box">
|
|
<div class="info-title">Footprint Minimization Benefits</div>
|
|
<p>Digital footprint minimization significantly reduces surveillance exposure and protects privacy, but requires ongoing effort and vigilance. Complete elimination of digital traces is impossible in modern society, so focus on reducing the most sensitive and identifying information.</p>
|
|
</div>
|
|
|
|
<hr />
|
|
|
|
<h2 id="chapter-summary">Chapter Summary</h2>
|
|
|
|
<p>Chapter 7 has provided comprehensive guidance for maintaining digital hygiene and privacy in resistance operations:</p>
|
|
|
|
<p><strong>Section 7-1</strong> covered browser security configuration including Tor Browser setup, Firefox hardening, and operational security procedures.</p>
|
|
|
|
<p><strong>Section 7-2</strong> detailed search engine privacy strategies including alternative search engines, anonymous search procedures, and research methodology.</p>
|
|
|
|
<p><strong>Section 7-3</strong> explained VPN and Tor usage including service selection, configuration, and advanced anonymity techniques.</p>
|
|
|
|
<p><strong>Section 7-4</strong> covered social media operational security including platform analysis, anonymous usage, and crisis communication procedures.</p>
|
|
|
|
<p><strong>Section 7-5</strong> detailed email security including secure providers, encryption, anonymous accounts, and self-hosted solutions.</p>
|
|
|
|
<p><strong>Section 7-6</strong> provided digital footprint minimization strategies including assessment, reduction techniques, and ongoing monitoring.</p>
|
|
|
|
<h3 id="implementation-strategy">Implementation Strategy</h3>
|
|
|
|
<p>For resistance networks implementing digital hygiene:</p>
|
|
|
|
<ol>
|
|
<li><strong>Start with Browser Security:</strong> Implement secure browser configuration and usage procedures</li>
|
|
<li><strong>Add Search Privacy:</strong> Deploy privacy-focused search engines and research methodology</li>
|
|
<li><strong>Implement Network Anonymity:</strong> Configure VPN and Tor for network-level protection</li>
|
|
<li><strong>Secure Communications:</strong> Establish secure email and minimize social media exposure</li>
|
|
<li><strong>Monitor and Maintain:</strong> Implement ongoing digital footprint monitoring and reduction</li>
|
|
</ol>
|
|
|
|
<h3 id="integration-with-operational-procedures">Integration with Operational Procedures</h3>
|
|
|
|
<p>The digital hygiene practices covered in this chapter provide the foundation for the operational procedures covered in Chapter 8. Proper digital hygiene is essential for maintaining security throughout all resistance activities.</p>
|
|
|
|
<hr />
|
|
|
|
<p><strong>Next:</strong> <a href="/chapters/chapter-8/">Chapter 8: Operational Procedures →</a></p>
|
|
|
|
|
|
|
|
|
|
<nav class="section-nav">
|
|
|
|
<a href="/chapters/chapter-6/" class="nav-link">
|
|
<span class="arrow">←</span>
|
|
<span>Chapter 6: Hardware Security</span>
|
|
</a>
|
|
|
|
|
|
|
|
<a href="/chapters/chapter-8/" class="nav-link">
|
|
<span>Chapter 8: Operational Procedures</span>
|
|
<span class="arrow">→</span>
|
|
</a>
|
|
|
|
</nav>
|
|
|
|
</main>
|
|
</div>
|
|
|
|
<footer class="footer">
|
|
<div class="container">
|
|
<div class="footer-content">
|
|
<div class="organization">Department of Internautics</div>
|
|
<div>Bureau of Decentralized Resistance</div>
|
|
<div>FM-R1 - Version 1.0 - 2025-08-28</div>
|
|
<div style="margin-top: 1rem;">
|
|
<a href="https://resist.is" target="_blank">resist.is</a> |
|
|
<a href="https://git.hacker.supply/Department_of_Internautics/field_guide" target="_blank">Source Code</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</footer>
|
|
|
|
<!-- JavaScript -->
|
|
<script src="/assets/js/main.js"></script>
|
|
</body>
|
|
</html>
|
|
|