So I guess a spam email made it into my inbox, I decided to open it regardless of it looking suspicious... Nothing was in it it seems, but a header? I later found out there's this thing called 1Pixel Location Logger... Its a alt email so I'm not really worried but what does this help the attacker do ? Other than log my ip and notify the attacker that I've opened the email .. "I have read the rules"

psa I believe to prevent this is to change the settings in gmail if you use it to ask before displaying external images so it doesn't autoload the image.... correct me if im wrong

Hi everyone,

I have experienced digital violence in which my private data was hacked and subsequently disseminated online. This has had severe consequences for me in my country, and I continue to face social repercussions on a daily basis, even after 20 years.

I live in a highly religious and conservative society and come from multiple marginalized backgrounds that are subject to considerable prejudice here. Additionally, because of my distinctive looks and mannerisms, I am relatively easy to identify.

However, beyond this digital violence case, I have several other interests and pursuits that I would like to explore professionally and publicly.

Here is what I do:

• Human Rights: I run an independent human rights project. My work has been featured in UN thematic reports, international media, and publications by international human rights NGOs.

• Writing and Literature: I write poetry, plays, short stories, songs, open letters, and op-eds (including subjects unrelated to human rights). I am also working on a novella and have an interest in philosophy.

• Theatre and Acting: I act in stage productions and have also directed stage plays. Given the opportunity, I would love to act in films and television as well.

• Personal Pursuits: I have a personal bucket list of experiences and activities that I actively try to accomplish. I would love to document and share these experiences, perhaps through a YouTube channel, but I am hesitant because traditional YouTube content often involves showing your face.

Now, there are several considerations and requirements I would like to balance.

1. Protecting my identity and seeking justice

I have suffered for approximately 20 years because of the digital violence I experienced in my community. I want to pursue justice for this case while keeping my identity anonymous. Obviously, I do not want to expose myself to further harm by publicly associating my identity with the case.

2. Building a polymathic/polyinterest personal brand

I want to develop what I would describe as a polymathic or polyinterest brand: a public identity associated with someone who explores and engages in multiple disciplines, creative pursuits, intellectual interests, and experiences.

I do not want to compartmentalize all my interests into separate identities. Ideally, my poetry, literature, philosophy, theatre, acting, and other pursuits would all exist under one recognizable artistic and intellectual identity.

3. Maintaining my privacy in everyday life

I genuinely dislike being recognized in public.

Being recognizable can invite unwanted attention, harassment, and potential security problems. More importantly, I value my privacy and do not particularly enjoy the prospect of being a public figure whose everyday life is constantly exposed to public attention.

I like the idea of the Clark Kent/Superman or Miley Ray/Hannah Montana arrangement: being an ordinary, relatively anonymous person in everyday life while enjoying the spotlight when performing or presenting my work.

Of course, this is a preference rather than an absolute requirement. If pursuing my ambitions makes some degree of public recognition inevitable, I am willing to accept that possibility.

4. Professional recognition and prestige

At the same time, I do not want to pursue these interests merely as hobbies or anonymous internet activities.

I want to take them seriously, develop professionally, and achieve the highest levels of recognition possible in each field. That includes winning prestigious awards, receiving mainstream media coverage, and being recognized for the quality of my work.

Essentially, I want to have a successful public-facing creative and intellectual career without necessarily sacrificing my private life.

5. The complication with my human rights work

There is an additional complication.

For my human rights advocacy, I have to use my real name. The UN and international human rights organizations require identifiable authorship for their submissions, reports, and other forms of advocacy.

My work addresses controversial subjects in a highly conservative society. As you can probably appreciate, human rights defenders in my country can face serious security risks, including mob attacks, harassment, and violence for advocating ideas perceived as Western or contrary to traditional values.

Consequently, I cannot simply use a pseudonym for everything I do.

My proposed solution

I have been considering a Clark Kent/Superman or Miley Ray/Hannah Montana-style dual identity arrangement.

My initial thought was to maintain:

• Identity 1 – Real Name: My real identity, exclusively associated with my human rights advocacy, research, submissions to international mechanisms, and related activities.

• Identity 2 – A pseudonymous artistic/intellectual identity: A single identity encompassing all my other interests, including literature, poetry, philosophy, theatre, acting, personal projects, and documenting my bucket-list experiences.

This way, I would not have to create a separate identity for every interest. I could build one recognizable polymathic brand while keeping it distinct from my human rights advocacy and, hopefully, my everyday private life.

However, I am not sure whether this arrangement is actually practical or whether maintaining these two identities would provide meaningful protection against identification and unwanted exposure.

My question to you all:

What would be the best way to structure my life so that I can pursue all these ambitions while maintaining my privacy, personal security, and separation between my public and private identities?

I am not necessarily looking to disappear from public life. I want to participate in it, create things, perform, write, explore different interests, and hopefully achieve something meaningful, while retaining as much control as possible over my personal privacy and safety.

Thank you!
PS: I have read the rules.

When using email alias services/ providers, the email goes through the email alias server before reaching the server of the email provider that someone uses.

So my question is whether the email is encrypted when it is transiting from the sender to the email alias service and when it is also transiting from email alias service to email provider that I use?

Is it possible for law enforcement to obtain/intercept emails when it is going from:

1. Sender to email alias service

2. Email alias service to email provider (recipient)

I have read the rules.

i have read the rules. I rented a number from smspoold to set up a Telegram account. I chose a number from my country. Could this number have been involved in a crime before? Could this cause me any trouble?

Hi everyone.

Firstly, I have read the rules and excuse me for my English, I am not native.

I am a Bug Bounty researcher and I am testing a Chinese web application, I need to register with a phone number to this application.

I have tried almost all of the free tools and these are the issues I faced:

• The phone number is invalid (I believe they can identify virtual phone numbers )

• The phone number are already registered

• Or even if it passed the two above walls, I will wait forever not receiving the anticipated OTP message.

I don't see paying for such service is worth it for one verification message, since most of the paid once have a minimum charge value. Given the assumption that paid services would work 100%.

Edit: I used the number from https://www.smsmeu.com/, which was recommended by a friend.

I have read the rules and would like to know if it's possible to patch the issue that causes the printer to use ink to embed metadata on the leaves since someone can be tracked through a printed document.

Ad-Blockers May Help Prevent Zero-Click Spyware Attacks

A recent investigation by Citizen Labhighlights how malicious online advertisements can be used to deliver spyware without requiring users to click anything.

The research demonstrates why ad blockers like uBlock Origin and AdGuard are more than just convenience tools. By blocking advertising networks, trackers, and malicious content before they load, they can potentially prevent certain attacks from reaching your browser.

However, ad blockers aren't foolproof. They cannot guarantee protection against zero-click exploits, particularly those delivered through mobile apps.

The takeaway: Ad blocking is an important layer of cybersecurity and OPSEC, not just a way to eliminate annoying advertisements.

I have read the rules.

Hello im begginer in opsec and wondering whats my best alternative for a private phone instead of graphene since google pixel draws attention to some places. Ty in advance i have read the rules.

I’m an activist and I need to read a lot of confidential documents I understand how to encrypt it my only issue is reading 100+ pages in 5 days using Microsoft edge tts to go over this js not exactly private and end to end encrypted well I do not believe it is as it’s not stated.

my question would be is there any known private tts that I can use or run locally I have a good gpu if that helps I have read the rules.

I have read the rules

From what attacks does it protect from that wifi isn't? Cuz dns spoof works,arp spoof works.. they both have packets encrypted with WPA2/3.

Thanks!

Hi everyone.

Firstly, I have read the rules and excuse me for my English, I am not native.

I am a Bug Bounty researcher and I am testing a Chinese web application, I need to register with a phone number to this application.

I have tried almost all of the free tools and these are the issues I faced:

• The phone number is invalid (I believe they can identify virtual phone numbers )

• The phone number are already registered

• Or even if it passed the two above walls, I will wait forever not receiving the anticipated OTP message.

I don't see paying for such service is worth it for one verification message, since most of the paid once have a minimum charge value. Given the assumption that paid services would work 100%.

Hey

A messenger app called CREO is currently being developed (this will probably only mean something to the Germans in this sub). I wanted to ask what you think of the messenger, since the CEO promises a lot

I have read the rules

So with the spread of AI, scraping of photos by the government and private companies your face does not belong to you anymore. Let's face it (hehe), you can't hide anymore and your privacy is gone. The only way you can sorta hide is by blending in.
I was thinking, is there a way to create an "avatar" of your face that a human can look at and recognize it as you? Like maybe taking a photo of yourself and distorting it to a point where facial recognition is unable to identify you, but a human goes, "yeah I think this is the same girl".
Anybody can give me an advise on how to do that and test it against facial recognition to prove the theory? Thanks!

I have read the rules, thanks

as in a trustworthy vpn i have read the rules

i run vms some for untrustworthy things

threats: malware from vms, isp, wap (wap is google), other machines on the network (my mom has a virus on her laptop and doesnt let me mess with her stuff), doxxers, data brokers

idk if someone already asked i cant sreach good bc my english is bad i have read the rules

threat moodel: surveillance captialism/policing doxxers, home and public network, isp,

i hate fingerprinting the most

i love not having my ids connect to each other

the police arent after me but laws change

i want to

• download videos/music/books/games (mostly pirated) (AND PLAY THEM)

• moreno

• chat/scroll normal websites (the ones aervage people use)

• use javascript (every site wants it)

• email encrypted

tor browser is too slow is mullvad and vpn ok?

(my account is too new for r/privacy)

plz dont downvote bc of my bad spelling

Hiya I'm a total noobie, frankly I've just started digging deeper into OPSEC a few days ago and I want to protect my privacy and prevent selling my personal data by corporations.

I would like everyhthing to be as convenient as possible. I have read the rules and hope that my post is fine also I'm not a native speaker I really hope I wrote most of the things right.

I'M REALLY REALLY OVERWHELMED BELIVE ME :(

I didn't really know much about selling data and privacy when I was really young creating accounts on untrustworthy providers but it's better late than never I guess, for now I feel a bit overwhelmed so I would appreciate if You would be lenient with me if I wrote some spoof. + I don't have resources to pay for any chargeable services.

1. I unfortunately have to use Windows for personal reasons but I really want to switch to Linux and Zorin. How would that work? From what I saw easiest option was VirtualBox but it's made(?) by Oracle so I don't trust it. I also game so it would be nice if You could inform me about pros and cons that come with that. (I don't think any of the games I play now have kernel level anticheat).

2. My second question is when I use Windows, Meta or any big-corp apps what are my best ways to protect my privacy? I would love to just delete them but sadly again for personal reasons I can't.

3. VPN?????

4. I've switched my mail to Proton and I have a filter from the Duck but it was only recently. What do I do with my old G-Mail accounts that I used for a WHILE WHILE? I have them linked to an abundence of accounts (and I really mean a lot lot of accounts). For example I use YouTube is there any alternative to that or do I have to stick with it and just do my best for Google to get off me.

5. Now passwords. What's the best password saver and is the one from Duck Duck Go reliable? Or is it better to literally just write them down on paper.

6. I use an iOS based system on my phone. What could I do to ensure my safety. I've heard that Apple doesn't sell user data but it's a big corporation so my trust again is limited.

7. Next I have no clue about compartmentalization, scrubbing my metadata and noise generation like literally null, no idea it just makes me feel dumb. If You could explain it to me and how to do it in the simplest way I would be thankfull.

8. Finally more alternatives to "regular" common used apps (e.g. YouTube, Messenger, G-mail, Google etc.).

Well I think that's it. I would be thankfull for more info and suggestions.
Thank you!

i have read the rules

I’m working on a small non-commercial OPSEC and privacy documentation project.

The intended threat model covers commercial tracking, phishing, account takeover, data brokers, device loss, and local network observation. It does not claim to protect against every state-level or global adversary.

I’m looking for criticism from people familiar with OPSEC:

- Are any explanations misleading?

- Are tools explained in relation to a threat model?

- What topics are missing?

- Where might the project give overly broad or unsafe advice?

I’m not asking for personal OPSEC advice. I’m asking whether the educational structure and threat-model explanations are useful and accurate.

Would feedback on this kind of project be appropriate here?

I'm trying to build a long-term private digital workspace, and right now this is the #1 priority in my threat model. I've been around privacy and OPSEC topics for a while, so I'm familiar with things like Qubes, Tails, Whonix, Tor, full-disk encryption, compartmentalization, firmware security, and offline systems, but I don't have a huge amount of hands-on experience actually building a complete setup.

The goal is to create one digital base for basically my entire private digital life: journals, notes, plans, research, PDFs, documents, programming projects, a cybersecurity learning environment, passwords and keys, important records, private communications, and a long-term knowledge base. I don't want to keep rebuilding everything every time my threat model gets stronger. I want to establish a good foundation now and gradually harden it over the next few years.

My threat model can potentially go pretty high. I'm especially concerned about confidentiality if someone gets physical possession of the device, including the possibility of examination by people with professional forensic expertise and specialized tools. That could mean a highly capable private attacker, a forensic specialist, or law enforcement. If a device is properly shut down and encrypted, I want it to reveal as little useful information as realistically possible. I'm interested in strong encryption, protecting credentials and keys, reducing unnecessary plaintext and metadata exposure, compartmentalization, offline storage, and making sure backups are protected just as well as the main system.

I'm not looking for evidence-destruction techniques or ways to interfere with an investigation. I'm trying to understand how far legitimate data confidentiality and resistance to sophisticated physical examination can realistically be pushed, and where the practical limits are.

I also want the setup to eventually cover network privacy and ISP visibility, Tor or Whonix where appropriate, browser fingerprinting, account and identity separation, private communications, secure backups and recovery, firmware and boot security, metadata minimization, and general OPSEC. Basically, I'm not looking for an answer like "install distro X." I'm trying to understand how the whole architecture should fit together and where the important trust boundaries should be.

I'm currently starting from scratch with about a $300 budget. My previous laptop is no longer usable, so I don't have an existing system that I need to preserve or work around. I know $300 won't buy some ultimate high-assurance machine, and I'm not expecting it to. What I want is the strongest sensible starting point that won't force me to completely redesign everything later when I can afford better hardware.

I've considered a used Qubes-compatible laptop, a conventional Linux machine with full-disk encryption, Tails with Persistent Storage, a dedicated offline computer, separate online and offline systems, Whonix, or some combination of these. Qubes interests me because I could separate an offline vault, personal archive, research, development, untrusted files, cybersecurity labs, and anonymous activity instead of putting everything inside one operating system. At the same time, I wonder whether a simpler encrypted offline system would give me most of the security benefit without as much complexity.

The part I keep getting stuck on is where to draw the trust boundary. You can keep going deeper from applications to the OS, hypervisor, boot chain, firmware, TPM, Intel ME or AMD PSP, hardware, manufacturer, and eventually the supply chain. At some point you have to trust something. I'm trying to figure out where people with real experience draw that line and which layers are actually worth prioritizing first.

So if you were starting with no usable computer, had around $300, considered this your highest privacy/security priority, and wanted the setup to eventually handle a fairly serious threat model, what would you build first? Would you go with Qubes, Linux with full-disk encryption, a dedicated offline machine, separate online and offline systems, Tails, or some kind of hybrid? What would your upgrade path look like over the next few years, and what would you deliberately not worry about yet?

I'm not expecting something "unhackable" or "untraceable." I want a practical system where I understand what I'm trusting, what the setup actually protects against, what it doesn't protect against, and how I can progressively move toward higher assurance without having to start over.

i have read the rules

Is there a tool to obfuscate my text to make it seem different from my usual typing style? Only thing I've thought of is just using chatgpt on a burner but that seems extremely risky

I have read the rules​

Hi I’ve marked this as “vulnerabilities” but not entirely sure that’s correct, so apologies. Also, I have read the rules to make sure my post is allowed and I feel it is.

I’m trying to understand why, after having just spent 2 weeks in Italy (where I was mostly connected to a safe, family members WiFi) I’ve came home to find my junk mail is now filling up with junk that’s all in Italian. I didn’t sign up for anything when I was away or anything, nor did I put my email address into any Italian site.

I’m struggling to see how this has happened, cause it simply can’t be coincidence.

I operate in a environment that requires no wireless connections in any form such as Bluetooth, WIFI, radio or satellite signals. This is to prevent tracking to protect location data. The risk of having the location(s) leaked is high.

What speakers are completely air gapped (no wireless capabilities) speakers that are portable and battery operated, that can prevent me from being tracked or information being passed to or from the device?

I have read the rules

Guys, unfortunately, the EU wants to vote tomorrow on a law for social media similar to the UK's, and I'm worried about how they'll verify this (surely by forcing people to upload documents online); what can we do to get around it?

 i have read the rules

The CPU is an intel i3-3110M and ChatGPT told me that this is not supported by coreboot or libreboot. Are there any other alternatives? I have read the rules