4 ms·

> I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, Let's update this for 2024: Signal/Session/Matrix/^, Tails/Whonix/Qubes/Heads/BSDs,

> I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, Let's update this for 2024: Signal/Session/Matrix/^, Tails/Whonix/Qubes/Heads/BSDs, VeraCrypt/Cryptomator/^, GrapheneOS/CalyxOS/PureOS/^, KeePassXC/Bitwarden/^, Mullvad, NetGuard(Android) ^ represents others that I am leaving out for convenience.

deleted 2y ago
[deleted]
maqp 2y ago
You're missing Tor, and metadata reducing messaging like https://cwtch.im/ https://cwtch.im/ Also Mullvad Browser is a worthy addition given that its basically Tor Browser with the VPN instead of Tor-gateway. Same excellent metadata reduction tweaks, and you don't have to configure anything. Oh and since this is against APTs my work might be useful for messaging: https://github.com/maqp/tfc https://github.com/maqp/tfc It's as close to NSA-proof you can get. Naturally, if the government parks their flower van across the street and grabs your keyboard cable's spurious radio waves* or installs a cam in your house you're SoL, but otherwise you should be pretty good. * https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
- ementally 2y ago
  >basically Tor Browser with the VPN instead of Tor-gateway. You don't need a Mullvad VPN for it work, you can use it without Mullvad VPN or any VPN at all.
  - maqp 2y ago
    Oh interesting, thanks for letting me know!
zahlman 2y ago
> Tails/Whonix/Qubes/Heads/BSDs... Mullvad, NetGuard(Android) I don't even know what kind of things these are... ?
- salawat 2y ago
  Tails is an immutable distribution of Linux that runs entirely out of RAM, persisting nothing to long term disks. Typically used in a LiveCD like manner. https://tails.net/ https://tails.net/ Heads similar. https://heads.dyne.org/ https://heads.dyne.org/ Qubes is an OS endeavoring to isolate literally everything conceivable from each other. https://www.qubes-os.org/ https://www.qubes-os.org/ BSD is a kernel specifically focused, iiuc, on being as secure and straightforward as possible. https://en.m.wikipedia.org/wiki/FreeBSD https://en.m.wikipedia.org/wiki/FreeBSD Whonix seems to be focused around decreasing online or browser based metadata leakage? Mullvad is a paid VPN service. https://en.m.wikipedia.org/wiki/Whonix https://en.m.wikipedia.org/wiki/Whonix Calyx/Pure/GrapheneOS Apparently security focused Android distros. KeePassXC, password manager, self hosted. TrueCrypt/VeraCrypt: Encrypted volume management. Bitwarden, FDE solution iirc. Notably no mention of Wireguard, managing your firewalls/routers/network architecture, IDS's/Intrusion response plans, key hygiene, and focusing on getting end users prepped for the infosec environment; noting that an ineffective infosec engagement with end users completely undermines everything you're trying to work for. Trying to go all in on most of those tools is a recipe for disaster for any org that actually has something else to do other than jumping through endless security hoops. Tools aren't the be all end all. Educated and invested users are.
  - embeng4096 2y ago
    Just adding a small correction: you might be thinking of Bitlocker for FDE -- Bitwarden is a password manager. Thanks for the details on the other stuff, I didn't know what Whonix and Heads were
  - astrange 2y ago
    > BSD is a kernel specifically focused, iiuc, on being as secure and straightforward as possible. No it is not, or at least it doesn't use any modern tools or make a serious attempt to do so. It's a family of OSes written by the kind of people who think if you grow a beard and stare very hard at your C code it will become secure and bug free. It does change slowly, which is a good technique for avoiding introducing bugs, but it's barely heard of techniques like regression testing. The secure one in particular has a lot of mitigations that especially feel like they just dreamed up what they think a security mitigation is, instead of engaging with research.
ignoramous 2y ago
> NetGuard(Android) GrapheneOS warns of NetGuard leaking connections: https://discuss.grapheneos.org/d/8330-app-compatibility-with-grapheneos/68 https://discuss.grapheneos.org/d/8330-app-compatibility-with...

deleted 2y ago

[deleted]

maqp 2y ago

You're missing Tor, and metadata reducing messaging like https://cwtch.im/ https://cwtch.im/ Also Mullvad Browser is a worthy addition given that its basically Tor Browser with the VPN instead of Tor-gateway. Same excellent metadata reduction tweaks, and you don't have to configure anything. Oh and since this is against APTs my work might be useful for messaging: https://github.com/maqp/tfc https://github.com/maqp/tfc It's as close to NSA-proof you can get. Naturally, if the government parks their flower van across the street and grabs your keyboard cable's spurious radio waves* or installs a cam in your house you're SoL, but otherwise you should be pretty good. * https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)

ementally 2y ago
>basically Tor Browser with the VPN instead of Tor-gateway. You don't need a Mullvad VPN for it work, you can use it without Mullvad VPN or any VPN at all.
- maqp 2y ago
  Oh interesting, thanks for letting me know!

zahlman 2y ago

> Tails/Whonix/Qubes/Heads/BSDs... Mullvad, NetGuard(Android) I don't even know what kind of things these are... ?

salawat 2y ago
Tails is an immutable distribution of Linux that runs entirely out of RAM, persisting nothing to long term disks. Typically used in a LiveCD like manner. https://tails.net/ https://tails.net/ Heads similar. https://heads.dyne.org/ https://heads.dyne.org/ Qubes is an OS endeavoring to isolate literally everything conceivable from each other. https://www.qubes-os.org/ https://www.qubes-os.org/ BSD is a kernel specifically focused, iiuc, on being as secure and straightforward as possible. https://en.m.wikipedia.org/wiki/FreeBSD https://en.m.wikipedia.org/wiki/FreeBSD Whonix seems to be focused around decreasing online or browser based metadata leakage? Mullvad is a paid VPN service. https://en.m.wikipedia.org/wiki/Whonix https://en.m.wikipedia.org/wiki/Whonix Calyx/Pure/GrapheneOS Apparently security focused Android distros. KeePassXC, password manager, self hosted. TrueCrypt/VeraCrypt: Encrypted volume management. Bitwarden, FDE solution iirc. Notably no mention of Wireguard, managing your firewalls/routers/network architecture, IDS's/Intrusion response plans, key hygiene, and focusing on getting end users prepped for the infosec environment; noting that an ineffective infosec engagement with end users completely undermines everything you're trying to work for. Trying to go all in on most of those tools is a recipe for disaster for any org that actually has something else to do other than jumping through endless security hoops. Tools aren't the be all end all. Educated and invested users are.
- embeng4096 2y ago
  Just adding a small correction: you might be thinking of Bitlocker for FDE -- Bitwarden is a password manager. Thanks for the details on the other stuff, I didn't know what Whonix and Heads were
- astrange 2y ago
  > BSD is a kernel specifically focused, iiuc, on being as secure and straightforward as possible. No it is not, or at least it doesn't use any modern tools or make a serious attempt to do so. It's a family of OSes written by the kind of people who think if you grow a beard and stare very hard at your C code it will become secure and bug free. It does change slowly, which is a good technique for avoiding introducing bugs, but it's barely heard of techniques like regression testing. The secure one in particular has a lot of mitigations that especially feel like they just dreamed up what they think a security mitigation is, instead of engaging with research.

ignoramous 2y ago

> NetGuard(Android) GrapheneOS warns of NetGuard leaking connections: https://discuss.grapheneos.org/d/8330-app-compatibility-with-grapheneos/68 https://discuss.grapheneos.org/d/8330-app-compatibility-with...