"arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say" - some random online

i'm not gonna pretend this is some comprehensive guide that'll make you invisible to the NSA. it's more of a brain dump of things i've learned over the years. take what you need, ignore what you don't.

threat modeling

opsec isn't some magic checklist you blindly follow. it's about knowing who's actually after you and what happens if they win.

are you hiding from your ex or a wannabe cybercriminal? that's different from dodging a full-blown government surveillance op. some script kiddie on a forum isn't the same as a nation-state actor with unlimited resources.

ask yourself:

  • what am i actually protecting?
  • who wants it?
  • what's the worst case if they get it?

if the worst case is "i get doxxed and harassed" you need different defenses than if it's "i go to prison." figure this out first.

your writing style is a fingerprint

here's something most people don't think about - stylometry. the way you write is as unique as your actual fingerprint. sentence structure, word choice, punctuation habits, even how often you use "lol" or "lmao" - all of it creates a pattern that can be traced across platforms.

if you're running an anonymous account and your writing style matches your main account, you're cooked. simple as that.

the fix? create a completely different writing persona. if you naturally write like a 20-something gamer, start writing like you're a 45-year-old accountant. analyze your own writing, identify the patterns, then deliberately break them.

behavioral-biometric profiling is wild

this one's gonna sound paranoid but hear me out. the way you type - your keystroke patterns, the timing between keys, how you move your mouse - all of it is trackable. banks already use this to detect fraud. algorithms only need a few minutes of data to build a profile unique enough to identify you across different sites.

websites can embed javascript that captures all of this. even if you're on tor with a fresh identity, your typing rhythm can give you away.

some things that help:

  • write offline in notepad, copy-paste into browser (no keystroke capture)
  • disable javascript where possible (extreme but effective)
  • there's browser extensions that randomize keystroke timing, but i wouldn't trust chrome extensions for this

during ww2, the british identified german telegraph operators based on their unique transmission habits. same concept, different century.

passwords and account hygiene

if you're reusing passwords across platforms i genuinely don't know what to tell you. use a password manager - keepassxc is solid. generate random passwords for everything.

for social media:

  • delete old accounts, create new ones through tor
  • use temp numbers for verification (smscodes.io, crypton.sh - pay with monero)
  • make everything private
  • never use real names, photos, or identifying info
  • don't share your age, hobbies, location in bios
  • different usernames on every platform so tools like whatsmyname.app can't link you
  • 2fa on everything (freeotp or aegis, not google authenticator)

your profile picture matters too. no personal photos, nothing that shows your window view or local landmarks. either leave it blank or use ai-generated faces (stable diffusion, midjourney).

anonymous payments

monero is your friend here. it hides the sender, receiver, and transaction amount - unlike bitcoin where everything's public on the blockchain.

ways to get monero anonymously:

  • p2p exchanges like hodlhodl or localcoinswap (no kyc)
  • buy bitcoin/litecoin p2p, then swap to monero through trocador
  • decentralized exchanges like haveno or bisq

always send to your own self-hosted wallet. never leave funds on exchanges.

for spending - anonymous marketplaces that accept monero, or use trocador to buy prepaid cards.

one important thing about monero nodes: using a remote node is convenient but there's some risk. running a local node means downloading hundreds of gigs of blockchain and doing that through tor is basically impossible. the middle ground is hosting your own node on a vps and connecting to it via onion service.

vpns are mostly marketing

i'm gonna be real - vpns are oversold. yes they encrypt your traffic, but your vpn provider sees everything unless they actually don't log (and how would you verify that?).

if you must use one:

  • no-logs policy is mandatory (but unverifiable)
  • must accept monero
  • avoid free vpns - they're selling your data

for actual anonymity, setting up your own vpn on a vps in a country with weak international cooperation is better than trusting some company's marketing.

remember: your isp knows you're using a vpn even if they can't see what you're doing through it. for serious operations, tor is the answer, not vpns.

mullvad seems alright if you need something for everyday browsing.

network security basics

change default credentials immediately. disable remote management. set up a separate vlan for iot garbage (smart tvs, alexa, whatever) - those things are basically spyware that phone home 24/7.

use dns over https or dns over tls. self-host unbound if you can, otherwise use quad9 or mullvad dns. block all devices from using any other dns.

if you're using wifi, wpa3 minimum. hide your ssid. disable wps. rotate passwords regularly.

monitor your traffic. set up wireshark or suricata. if something's phoning home to servers you don't recognize, kill it.

tor and i2p

if you're serious about anonymity, tor or i2p are the tools. but they're not magic.

timing attacks are real - if someone controls enough nodes, they can correlate your activity. the fbi is known for running their own relays to monitor users.

disable javascript. always. browser exploits are the most common way people get caught on tor.

photo metadata will expose you

exif data in images can include your camera model, settings, and sometimes gps coordinates. strip it before posting anything.

but it gets worse - every camera sensor has unique noise patterns that can fingerprint images back to a specific device. jpeg compression uses quantization tables that vary by device and can identify the source camera even after editing.

if you're posting images from an anonymous account, you need to strip metadata AND run the image through enough processing to destroy these fingerprints.

emergency protocols

have a plan for when things go wrong:

  • kill switch to immediately encrypt/wipe data
  • exit routes and safe locations planned in advance
  • critical info always on encrypted drives you control

if you think you're being tracked, leave all devices behind. even powered-off phones can be used for tracking in some cases.

social engineering is the biggest threat

honestly, most people don't get caught through technical means - they get caught through social engineering.

fake emergencies, infiltration by people posing as delivery drivers or it support, honey traps building trust over months, deepfakes of trusted people's voices.

assume every interaction is a potential exploit attempt. trust is a vulnerability. even family can be leveraged without realizing it.

change daily patterns. secure meeting spots. assume you're watched and act accordingly.

as machiavelli said - "he who seeks to deceive will always find someone who will allow himself to be deceived." don't be that someone.

final thoughts

this isn't comprehensive and it's not meant to be. opsec is about understanding your specific risks and building appropriate defenses. someone hiding from a stalker ex needs different tools than someone doing actual illegal shit.

the biggest takeaway - don't be lazy. most people get caught because they cut corners, reuse identities, or trust systems they shouldn't.

stay paranoid out there.