Putting together a practical guide to online privacy

1Based Frog1

Well-known member
I’ve been looking into ways to cut my digital footprint even more and figured I’d see if anyone has suggestions I haven’t considered. Right now, I run Firefox with hardened settings, Privacy Badger, and Trace for tracking protection. Mullvad VPN, paid in crypto. Linux, obviously. No social media or messaging apps cluttering my devices.

The goal is to minimize exposure without making daily use unbearable. I’ve thought about self-hosting email, but most services block custom domains unless you’re using a major provider. Also debating whether de-googled phones are worth the hassle long-term or if a dumb phone is the better move.
 
I’ve been looking into ways to cut my digital footprint even more and figured I’d see if anyone has suggestions I haven’t considered. Right now, I run Firefox with hardened settings, Privacy Badger, and Trace for tracking protection. Mullvad VPN, paid in crypto. Linux, obviously. No social media or messaging apps cluttering my devices.

The goal is to minimize exposure without making daily use unbearable. I’ve thought about self-hosting email, but most services block custom domains unless you’re using a major provider. Also debating whether de-googled phones are worth the hassle long-term or if a dumb phone is the better move.
Use a vpn and don’t post your personal info on the internet nor use social media and don’t use nor trust big tech
 
Browsing:
- Use Tor By Default, On Public WiFi
- Use Hardened Firefox If You MUST Use VPN
- Mullvad VPN, Paid In Monero, If Necessary
- No Real Names Should Ever Be Posted
- No Faces Either Of Course
- If You Must Use Voice Chat, Use A Voice Changer

Data Storage:
- Full Disk Encryption Via LUKS
- Message/File Encryption Via GPG, Works Even On Normie Platforms If You're Not An Idiot
- XMPP Encryption Via OMEMO, If You Use It
- NEVER USE CLOUD STORAGE

Operating Systems:
- Linux, Preferably Gentoo If You Have The Time + Will To Use It
- Android, Assuming You NEED Any Phone, Also, Use Burner SIMs + Old Burner Phones
- TailsOS, Just In Case

Messaging:
- Email, GPG Encrypt Things
- Forums, GPG Encrypt Emails + GPG Sign Public Messages
- XMPP, GPG Or OMEMO Encrypt Messages, You May Be Able To Combine Both Encryption Methods Btw

Hardware:
- Old ThinkPads (ofc)
- Hacked Androids

I would advise you also do stuff like google your real name to see what you can find. In my case, I have basically nothing to my real name. I've heard from some that you can just exploit EU regulations to remove data even if you're not in the EU, so try to remove as much of that as you can. I would also recommend going through existing aliases and deleting what is even slightly likely to dox you, particularly if you are using the same typing style everywhere + have leaked other details. Keep the details extremely vague. Sometimes, you may actually want to do the opposite of outright deleting all real-name social-media accounts, but only if you know how to blend in with normies. Realistically, you are just hiding from random internet anons, so it would be better to delete all social-media, rather than try to give the feds the idea that you're just a normie citizen.

I say only use Tor over public WiFi so it's harder to track the fact you use it, presuming the feds are an issue. They probably aren't, but it works as good measure. In general, you should keep *some* normalfag alias in order to make yourself seem less suspicious, but you don't have to use your real name usually. I've messed around with this to enough of an extent that I can reliably do so, without having to have real-name social-media or anything like that. Make things lead to dead ends. If they're endlessly looking through information and can't figure out what's real, even if someone gets the correct information, they may not be sure of it for so long that by the time it is confirmed as correct, it will likely be entirely irrelevant. I've heard you can also create an LLC and use that to purchase things such as property without having all your info registered to it, which if true, I will consider doing in order to avoid having to ever register personal information into public databases, if or when I am finally able to own land.

If you dropped out of high-school, and you have never went to college, even better (getting a GED should be fine, but even that may not be necessary in rare cases). If you're a dual-citizen of countries, such as the US and Canada, you could try seeing if you can have two legal names, one per country. You can leverage this to your advantage if it is legal, but I cannot confirm if it is, and you'd have to check the laws before attempting this. Also, you still have to know what you're doing, otherwise it will go wrong. There may be more, but this is the main stuff I can think of, and some of it already approaches "heavily inconvenient". To have extreme privacy + anonymity, you will have a ton of inconvenience. It is actually rather easy if you already live in the middle of nowhere, though, since you will already be used to interacting with your family and frens almost-exclusively, and thus, you aren't likely to get tracked especially if they don't usually email you or anything like that.
 
Browsing:
- Use Tor By Default, On Public WiFi
- Use Hardened Firefox If You MUST Use VPN
- Mullvad VPN, Paid In Monero, If Necessary
- No Real Names Should Ever Be Posted
- No Faces Either Of Course
- If You Must Use Voice Chat, Use A Voice Changer

Data Storage:
- Full Disk Encryption Via LUKS
- Message/File Encryption Via GPG, Works Even On Normie Platforms If You're Not An Idiot
- XMPP Encryption Via OMEMO, If You Use It
- NEVER USE CLOUD STORAGE

Operating Systems:
- Linux, Preferably Gentoo If You Have The Time + Will To Use It
- Android, Assuming You NEED Any Phone, Also, Use Burner SIMs + Old Burner Phones
- TailsOS, Just In Case

Messaging:
- Email, GPG Encrypt Things
- Forums, GPG Encrypt Emails + GPG Sign Public Messages
- XMPP, GPG Or OMEMO Encrypt Messages, You May Be Able To Combine Both Encryption Methods Btw

Hardware:
- Old ThinkPads (ofc)
- Hacked Androids

I would advise you also do stuff like google your real name to see what you can find. In my case, I have basically nothing to my real name. I've heard from some that you can just exploit EU regulations to remove data even if you're not in the EU, so try to remove as much of that as you can. I would also recommend going through existing aliases and deleting what is even slightly likely to dox you, particularly if you are using the same typing style everywhere + have leaked other details. Keep the details extremely vague. Sometimes, you may actually want to do the opposite of outright deleting all real-name social-media accounts, but only if you know how to blend in with normies. Realistically, you are just hiding from random internet anons, so it would be better to delete all social-media, rather than try to give the feds the idea that you're just a normie citizen.

I say only use Tor over public WiFi so it's harder to track the fact you use it, presuming the feds are an issue. They probably aren't, but it works as good measure. In general, you should keep *some* normalfag alias in order to make yourself seem less suspicious, but you don't have to use your real name usually. I've messed around with this to enough of an extent that I can reliably do so, without having to have real-name social-media or anything like that. Make things lead to dead ends. If they're endlessly looking through information and can't figure out what's real, even if someone gets the correct information, they may not be sure of it for so long that by the time it is confirmed as correct, it will likely be entirely irrelevant. I've heard you can also create an LLC and use that to purchase things such as property without having all your info registered to it, which if true, I will consider doing in order to avoid having to ever register personal information into public databases, if or when I am finally able to own land.

If you dropped out of high-school, and you have never went to college, even better (getting a GED should be fine, but even that may not be necessary in rare cases). If you're a dual-citizen of countries, such as the US and Canada, you could try seeing if you can have two legal names, one per country. You can leverage this to your advantage if it is legal, but I cannot confirm if it is, and you'd have to check the laws before attempting this. Also, you still have to know what you're doing, otherwise it will go wrong. There may be more, but this is the main stuff I can think of, and some of it already approaches "heavily inconvenient". To have extreme privacy + anonymity, you will have a ton of inconvenience. It is actually rather easy if you already live in the middle of nowhere, though, since you will already be used to interacting with your family and frens almost-exclusively, and thus, you aren't likely to get tracked especially if they don't usually email you or anything like that.
Good stuff. On the topic of Tor, I’ve always wondered, are you truly anonymous when using it? I hear so much conflicting opinions on it.
 
I remember @nagolbud mentioned previously that he had put together some program (calling it a "program" because it may've been a business or a guidebook or some other thing, I forget) called something like "Online Camo" that had a similar intention of wiping an identity's presence online. I'll @ him so that when he comes back he can expound on that. He could have some advice to give here.
 
Good stuff. On the topic of Tor, I’ve always wondered, are you truly anonymous when using it? I hear so much conflicting opinions on it.
When using Tor, avoid JavaScript especially if you don't trust the website's code (which you shouldn't unless you made it yourself or an IRL friend made it, if that). Also, it's theoretically possible to be deanonymized, but rather hard to do so as they'd have to take over or outright control the nodes, but they may be inclined to do so. This is even harder if you decided to use it over public WiFi only with huge WiFi antennas to connect from miles away. I've heard you can block certain country IPs, but this will probably slow you to a screeching halt, so good luck using it in many cases if you go that far.

TLDR; Somewhat, but it has to be used carefully, sometimes it's better to just use a VPN due to speed and it being less suspicious.
I remember @nagolbud mentioned previously that he had put together some program (calling it a "program" because it may've been a business or a guidebook or some other thing, I forget) called something like "Online Camo" that had a similar intention of wiping an identity's presence online. I'll @ him so that when he comes back he can expound on that. He could have some advice to give here.
I actually do have some interest in this, more so to make it easier to erase information of family members from Google, which is still more sparse than I thought so I presume most of what is used is privated, such as on social-media. Still, good to have good OPSEC and even scrub really old things that may be missed in a normal cleanup.
 
Michael Bazzel's What it takes to disappear is a great source of privacy tips against a private investigator type adversary, like how to keep your car/house ownership out of databases using trusts.

Data Storage:
- Full Disk Encryption Via LUKS
- Message/File Encryption Via GPG, Works Even On Normie Platforms If You're Not An Idiot
- XMPP Encryption Via OMEMO, If You Use It
- NEVER USE CLOUD STORAGE
Disk encryption is also good because it gives professionals more opportunity to screw up if they try to frame you for something.

Cloud/VPS storage could be better than local storage under some circumstances for some goals.
Say you believe that men with guns are going to be of the type that (have to pretend to, choose to) follow some rules when they analyze your stuff. If your stuff is right there on the disk, there are rules that have at times said you can be held in contempt of court if you don't decrypt, just like how they can demand you unlock a vault even if the evidence inside will supposedly incriminate you. This is USA law, and the precedent may have shifted around so DYOR. Anyway, the point being that if your stuff is in a third party location, a cloud that is inaccessible to them (so not just amazon or google) then it may be that they don't find evidence linking you strongly enough to it for them to demand access to this remote service. (Or maybe the jurisprudence isn't even settled on them being able to make that demand, idk)
Say you're going through a country (like the USA I think?) where they can demand you decrypt your device so they can see your stuff before you go through. You don't want your trade secrets or whatever stolen? Just take that data off your device and just host it on a secure file server inside your own home so you and only you can download it while you are abroad. You could also use a regular commercial cloud, but yeah that still poses other surveillance/security issues.

Deniable disk encryption ("I can't prove that I don't have more hidden partitions") has unique tradeoffs.
 
I remember @nagolbud mentioned previously that he had put together some program (calling it a "program" because it may've been a business or a guidebook or some other thing, I forget) called something like "Online Camo" that had a similar intention of wiping an identity's presence online. I'll @ him so that when he comes back he can expound on that. He could have some advice to give here.
Yeah, I remember that. Online Camo was my baby, designed to scrub your online presence clean like it never existed. It's not just about disappearing; it's about making sure they can't piece you back together. It’s got tips on how to do it right, but since I'm down here in Mexico, the specifics might differ. Living here makes you practically invisible to the Jesuits third eye.
 
Michael Bazzel's What it takes to disappear is a great source of privacy tips against a private investigator type adversary, like how to keep your car/house ownership out of databases using trusts.


Disk encryption is also good because it gives professionals more opportunity to screw up if they try to frame you for something.

Cloud/VPS storage could be better than local storage under some circumstances for some goals.
Say you believe that men with guns are going to be of the type that (have to pretend to, choose to) follow some rules when they analyze your stuff. If your stuff is right there on the disk, there are rules that have at times said you can be held in contempt of court if you don't decrypt, just like how they can demand you unlock a vault even if the evidence inside will supposedly incriminate you. This is USA law, and the precedent may have shifted around so DYOR. Anyway, the point being that if your stuff is in a third party location, a cloud that is inaccessible to them (so not just amazon or google) then it may be that they don't find evidence linking you strongly enough to it for them to demand access to this remote service. (Or maybe the jurisprudence isn't even settled on them being able to make that demand, idk)
Say you're going through a country (like the USA I think?) where they can demand you decrypt your device so they can see your stuff before you go through. You don't want your trade secrets or whatever stolen? Just take that data off your device and just host it on a secure file server inside your own home so you and only you can download it while you are abroad. You could also use a regular commercial cloud, but yeah that still poses other surveillance/security issues.

Deniable disk encryption ("I can't prove that I don't have more hidden partitions") has unique tradeoffs.
If you decide to have an off-site storage system, I would recommend only accessing your files over Tor or I2P when not at that location, and also, make sure you host the service yourself. You can setup a server at one of your friends or family member's houses, then just remember the necessary details to use it. It will be slow over Tor, and even slower over I2P usually, but it should be enough to throw things off especially if you know how to make sure the feds don't find the server location.
 
Do not buy cars with bluetooth or GPS technology built-in. The government can track your car’s location at anytime if they decide to. They can even lock your doors remotely to trap you in.
It’s kind of pointless if you have your phone with you all the time. Even if you turn it off they can still track you.
 
Browsing:
- Use Tor By Default, On Public WiFi
- Use Hardened Firefox If You MUST Use VPN
- Mullvad VPN, Paid In Monero, If Necessary
- No Real Names Should Ever Be Posted
- No Faces Either Of Course
- If You Must Use Voice Chat, Use A Voice Changer

Data Storage:
- Full Disk Encryption Via LUKS
- Message/File Encryption Via GPG, Works Even On Normie Platforms If You're Not An Idiot
- XMPP Encryption Via OMEMO, If You Use It
- NEVER USE CLOUD STORAGE

Operating Systems:
- Linux, Preferably Gentoo If You Have The Time + Will To Use It
- Android, Assuming You NEED Any Phone, Also, Use Burner SIMs + Old Burner Phones
- TailsOS, Just In Case

Messaging:
- Email, GPG Encrypt Things
- Forums, GPG Encrypt Emails + GPG Sign Public Messages
- XMPP, GPG Or OMEMO Encrypt Messages, You May Be Able To Combine Both Encryption Methods Btw

Hardware:
- Old ThinkPads (ofc)
- Hacked Androids

I would advise you also do stuff like google your real name to see what you can find. In my case, I have basically nothing to my real name. I've heard from some that you can just exploit EU regulations to remove data even if you're not in the EU, so try to remove as much of that as you can. I would also recommend going through existing aliases and deleting what is even slightly likely to dox you, particularly if you are using the same typing style everywhere + have leaked other details. Keep the details extremely vague. Sometimes, you may actually want to do the opposite of outright deleting all real-name social-media accounts, but only if you know how to blend in with normies. Realistically, you are just hiding from random internet anons, so it would be better to delete all social-media, rather than try to give the feds the idea that you're just a normie citizen.

I say only use Tor over public WiFi so it's harder to track the fact you use it, presuming the feds are an issue. They probably aren't, but it works as good measure. In general, you should keep *some* normalfag alias in order to make yourself seem less suspicious, but you don't have to use your real name usually. I've messed around with this to enough of an extent that I can reliably do so, without having to have real-name social-media or anything like that. Make things lead to dead ends. If they're endlessly looking through information and can't figure out what's real, even if someone gets the correct information, they may not be sure of it for so long that by the time it is confirmed as correct, it will likely be entirely irrelevant. I've heard you can also create an LLC and use that to purchase things such as property without having all your info registered to it, which if true, I will consider doing in order to avoid having to ever register personal information into public databases, if or when I am finally able to own land.

If you dropped out of high-school, and you have never went to college, even better (getting a GED should be fine, but even that may not be necessary in rare cases). If you're a dual-citizen of countries, such as the US and Canada, you could try seeing if you can have two legal names, one per country. You can leverage this to your advantage if it is legal, but I cannot confirm if it is, and you'd have to check the laws before attempting this. Also, you still have to know what you're doing, otherwise it will go wrong. There may be more, but this is the main stuff I can think of, and some of it already approaches "heavily inconvenient". To have extreme privacy + anonymity, you will have a ton of inconvenience. It is actually rather easy if you already live in the middle of nowhere, though, since you will already be used to interacting with your family and frens almost-exclusively, and thus, you aren't likely to get tracked especially if they don't usually email you or anything like that.
Michael Bazzel's What it takes to disappear is a great source of privacy tips against a private investigator type adversary, like how to keep your car/house ownership out of databases using trusts.


Disk encryption is also good because it gives professionals more opportunity to screw up if they try to frame you for something.

Cloud/VPS storage could be better than local storage under some circumstances for some goals.
Say you believe that men with guns are going to be of the type that (have to pretend to, choose to) follow some rules when they analyze your stuff. If your stuff is right there on the disk, there are rules that have at times said you can be held in contempt of court if you don't decrypt, just like how they can demand you unlock a vault even if the evidence inside will supposedly incriminate you. This is USA law, and the precedent may have shifted around so DYOR. Anyway, the point being that if your stuff is in a third party location, a cloud that is inaccessible to them (so not just amazon or google) then it may be that they don't find evidence linking you strongly enough to it for them to demand access to this remote service. (Or maybe the jurisprudence isn't even settled on them being able to make that demand, idk)
Say you're going through a country (like the USA I think?) where they can demand you decrypt your device so they can see your stuff before you go through. You don't want your trade secrets or whatever stolen? Just take that data off your device and just host it on a secure file server inside your own home so you and only you can download it while you are abroad. You could also use a regular commercial cloud, but yeah that still poses other surveillance/security issues.

Deniable disk encryption ("I can't prove that I don't have more hidden partitions") has unique tradeoffs.
Thanks for the guides, frens. Looks like I got my work cut out for me.
 
Back
Top