The Most ELITE OPSEC Guide I have ever released.

If you're looking for something specific, please press CTRL + F and type in what you need; i.e. Email Services

Security is not a proccess, Its a state until you get pwned.

Without Furtherado, please enjoy reading;


Privacy nowdays gets violated 24/7 by social media companies, three letter agencies, employers, hackers and service providers. Let's prevent this.

This is the index for the text document you're about to read:

  1. Terminology
  2. Identity Compartmentalization
  3. Networking
  4. Legality & Government Requests
  5. Device & Hardware
  6. Software & Tools
  7. Data Handling
  8. Telecom & SIM Cards
  9. COMSEC
  10. Threat Modeling
  11. Physical Security
  12. Financial
  13. Operating Systems
  14. Infrastructure
  15. Browser
  16. Credits

  1. Terminology

Within OPSEC, you will encounter many different terms, some linking to other topics, but overall - it's good to be familiar with these terms, and understand them well so you can maintain a good OPSEC.


General Opsec Terminology:

OPSEC - Operational Security is a risk management process that identifies critical information, and then implements security measures to reduce the ability of adversaries to exploit the information.

Risk Profile - The likelihood and impact of threats in relation to an individual, or organization.

TTP - Tactics, Techniques, Procedures

Doxxing - Releasing PII without someones consent.

Adversary - threat.

Burner - Disposable phone/account

Profiling - Analyzing behavioral data to track individuals

Chaff - false or misleading data

Threat actor - A person or group involved in malicious activity

Metadata - Data that provides information about other data, i.e. Timestamps - Device Info - Author

Airgap - A physical seperation of a device from any network to prevent unathorized access.

Detrace - A fake profile; i.e. sock puppet set up to make others believe they know your PII; when in reality - they don't.


Identity Compartmentalization Terminology:

Alias - A secondary name or identity used for specific purpose.

Sock-Puppet: A false online identity used for deception.

Lore Building: The process of creating detailed, believable backstories for identities.


Legality & Government Requests Terminology:

EDR - Emergency Data Request, a request the government can make to retrieve user-info

Gag Order - A legal order preventing disclosure of a government data request. (I.e, the site can't tell you that you got EDRed.)

MLAT - An agreement allowing cross-border requests, Mutual Legal Assistance Treaty

Compelled Decryption - A situation where a user is forced to provide encryption keys.

Subpoena - A legal demand for records.

Warrant Canary - A method for indirectly disclosing that a warrant has been served.

Forging Documents - The forgery (making fake) documents to spoof a legal request.


Device & Hardware:

Farady Bag - A device that blocks radio signals, to isolate devices.

Cold Boot Attack - Exploiting data remnants in RAM after power has been cut.

BIOS Lock - A password lock on firmware settings to prevent tampering.

TPM - (Trusted Platform Module) is a hardware-based security chip for cryptographic operations.

Coreboot - Open-sourc efirmware replacement for enhanced control, and security.


Software & Tools:

OTP - One time passcode

MAT2 - Metadata anonymization toolkit

VPN - Virtual Private Network


Data Handling:

Timestomping - Modifying and forging timestamps to stop profiling.

Slack Space - Residual data in disk storage left over from partially filled sectors.


Telecom & SIM Cards:

IMSI Catcher - A fake cell tower used to intercept mobile data.

Sim Swapping - Fraudulently transferring a phone number to a new SIM to hack accounts.

Baseband Attack - Exploiting firmware in cellular radios.

Silent SMS - Undetectable text message used to track device location.

Burner SIM - Temporary SIM Card used to avoid long-term linkage/profiling.


COMSEC:

E2EE - (End to End Encryption) is the process of encrypting data so that only the sender and recipient can read it.

Signal Protocol - A cryptographic protocol which provides E2EE with forward secrecy.

Metadata Resistance - Communications that minimize exposed auxilliary data.

OTR - (Off the record messaging) - Encrypted chat protocol with deniability and perfect forward secrecy.

OnionShare - Secure, and anonymous file sharing over tor.


Threat Modeling:

WWHWW - Who What How When Why

Adversary Capability - The expertise an attacker can bring to bear.

Attack Vector - The method/pathway used to gain unathorized access

Defense-in-Depth - Using multiple layered security controls.

Risk Appetite - The level of risk an individual or organization is willing to tolerate.


Resources:

N/A, This will just be links.


Physical Security:

RFID Skimming - Capturing data from RFID-Enabled devices.

Dead Drop - A covert location for exchanging items without absolute contact.

Perimiter Hardening - Strengthening entry points.


Financial:

Monero (XMR) - A privacy-based crypto.

Coinjoin - A method for obscuring bitcoin transaction origins.

Burner Wallet - Disposable crypto wallet

Taint Analysis - Linking cryptocurrency addresses through transactions

KYC - Know Your Customer - Identity verification required by financial services


Operating System:

Live OS - An OS that runs from removable media, and does not save changes.

Persistence Mode - Mode allowing a Live OS to save data sort of securely.

Containerization - Running applications in isolated enviroments.

Kernel Hardening - Techniques to protect the core of the OS.

VM - Emulated system used for isolation, or testing.


Infastructure:

VPS - Virtual Private Server - A hosted server instance used for operational deployments

Reverse Proxy - A server that forwards requests while hiding the backend

Hidden Service - A website or service hosted anonymously on tor.

Metadata Strippign Gateway - Server that removes identifying data before forwarding content.

Decentralized Hosting - Hosting services distributed across many nodes to avoid single points of failure.


  1. Identity Compartmentalization

This is the practice of isolating and managing seperate digital and physical identities to prevent correlation, limit exposure and reduce overall risk;
Here is some important concepts to maintain good identity compartmentalization:
Compartmentalization - Never allow two identities to share or link metadata, behaviors, devices, networks, or financial ties. Each compartment should stand alone.

Use multiple false identites.
Use seperate, clean machines or VMs per identity.
Assign unique network paths.
Create unique browser/user agent fingerprints.
Never reuse emails, usernames or writing styles.
Don't cross-reference information.
Maintain an anonymity set by ensuring each identity mimics plausable human behavior.


  1. Networking

Networking in OPSEC Is the controlling of how data travels across the internet to obscure identity, location and behavior.
Tor - An anonymity network that routes traffic through multiple encrypted relays. Use for browsing, publishing and communications that require high anonymity.
VPN - Encrypts your internet traffic and hides your IP address by routing through a remote srver, The ideal VPN is Mullvad VPN. - 5 dollars/month
NOT PROTON VPN, OR ANY OTHER EASILY-SUBPOENAED SERVICE.

My ideal Mullvad VPN settings are below:
DAITA - Enabled
Multihop - Enabled
DNS Content Blockers are optional, I have malware enabled.
IPv6 - Enabled (optional)
Kill Switch - Enabled
Lockdown Mode - Enabled
Tunnel Protocol - Wireguard
^Port - 51820
Obfuscation - UDP-over-TCP
Quantum-resistant Tunnel - Enabled
IP version - IPv6 (optional)
Mullvad Bridges - Enabled
Encrypted DNS Proxy - Enabled

SOCKS5 Proxy - A low level proxy protocol that routes traffic without modifying it.

MAC Address Spoofing - Change your network cards hardware address to prevent tracking via local networks or hotspots, should be done automatically on every boot.

DNS Leaks - DNS Leaks occur when a system sends DNS requests outside of encrypted tunnels. Use DNS leak test tools, and configure encrypted DNS.

Obfs4 - A tor pluggable transport that hides tor traffic from censorship or surveillance - done by mimicking other protocols.

Exit nodes awareness - tors exit node is where your traffic re-enters the open internet, exit nodes CAN log plaintext data. So never send sensitive info without HTTPS.

Corrleation attacks - Adversaries with access to both entry and exit points may correlate timing or volume of traffic, which is dangerous when mixing Tor and clearnet.

So let's summarise all of that into tips, so you can stay up-to-date on your opsec.

  • Use seperate networking enviroments, per identity.
  • Combine Tor + VPN for layered anonymity.
  • Mullvad VPN. Ideal settings are above.
  • Use firewall rules or TUN adapters to force all traffic through anonymizing layers.
  • Always test for leaks on new setups.
  • Use bridges or pluggable transports to evade network-level Tor blocking.
  • Avoid using real-time services over Tor due to the timing leaks.
  • Never log into a real or linked account when using anonymizing networks.
  • Use no-logging policy tools.

  1. Legality & Government Requests (arguably, one of the most important categories)

Know these concepts;
Subpoena - A legal demand for data, often served to service providers.
Warrant - A judge-authorized search or seizure order.
Gag Order - Accompanies a subpoena or warrant, legally prevents the provider from telling the user their data was requested.
MLAT - Internal agreements allowing cross-border data requests.
Compelled Decryption - Being legally forced to hand over passwords or decrypted data.
Warrant Canary - A regularly updated public notice indicating that no secret warrants have been received. If the update stops, it implies a gagged request has been issued.
Govmails - A government email address, usually the most important part of submitting an EDR or subpoena.
LERS - Law enforcement request system

"I don't do illegal shit, why do I need to know this?"

Here's why;

So, follow these practices:

  • IF you do unethical shit, understand the legality behind it.
  • Avoid cloud storage and services under jurisdictions with weak privacy protections or aggresive surveillance laws. (I.e. Five eyes countries)
  • Use strong, memory-hardened full disk encryption.
  • Never reuse virtual systems or passwords across identiies.
  • Do not talk to law enforcement without legal counsel, regardless of perceived innocence.
  • Seperate legal jurisdictions between your real-world location and where data or services are hosted.
  • Be aware of legal asymmetries - some services may comply with data requests silently, whilst other services fight them in court.

Basic jurisdiction difference:
US - Strong subpoena epowers.
EU - GPDR adds some protiection, however data can be handed over via MLAT or national laws.
Switzerland - More privacy-friendly, but some services have co-operated under pressure.
Russia/China - State access to data is broad.


  1. Device & Hardware

BIOS Lock/UEFI Password - Protects firmware against unauthorized modification.
TPM - A hardware chip that stores cryptographic keys securely. Can increase security but also create vendor lock-in and potential backdoors.
Device Fingerprinting - Unique IDs from hardware.
Clean Machine - A system with no PII, telemetry or history on it.

Practices:

  • Use generic widely available hardware for anonymity.
  • Physically remove or disable mics, webcams and wifi adapters unless needed.
  • Regularly re-flash firmware with trusted builds to guard against persistent threats.
  • Maintain seperate devices for each identity, or operational compartment.
  • Avoid biometric authentication. Always use strong passphrases with FULL-disk encrption.
  • Never use hardware provided by untrusted sources.
  • don't use temu shit

  1. Software & Tools

*Operating Systems:
https://tails.net/
https://www.qubes-os.org/
https://www.whonix.org/

*Encryption & Password Management: - Personally I don't keep my passwords in a password manager, I use a physical book inside my safe.
https://veracrypt.io/en/Downloads.html
https://keepassxc.org/
https://en.wikipedia.org/wiki/Pretty_Good_Privacy

*Metadata & File Anonymization:
https://github.com/tpet/mat2
Metadata is automatically stripped off images once they are sent on discord.

*Secure File Sharing:
OnionShare

*Application Isolation&Hardening:
Sandboxing
AppArmor/SELinux
Debloated Software

*Search Engines:
DuckDuckGo - Great for privacy, but personally I prefer startpage
Startpage - my personal choice

*Email Services:
riseup.net
cock.li
cyberfear.com
onionmail.org
whor.email - No longer federally monitered

To avoid being hijacked, I recommend only use a tempmail if it's a temporary account.
*Temp Email services:
tempmail.lol
easymails.cc
donarev419.com - DO NOT USE YOUR ACTUAL GMAIL, THESE ARE TEMPORARY ACCOUNTS - YOU WILL GET HIJACKED IF YOU USE THIS AS A MAIN EMAIL SERVICE
anonymmail.net

*Mobile Numbers:
smspool.net - takes crypto
textnow
googlevoice - you can manipulate this to be secure

*Browser:
Librewolf - personal recommendation
Tor
Fennec

*Extensions:
Ublock

*VPN:
Mullvad VPN - Cleanest - 5.99/month
Proton VPN - Accepts subpoeanes like a baby when handed candy
Everything else - Fucking useless

*Use mullvads SOCKS5 proxy separately in each browser:
– For Firefox, configure it via Mullvad’s official site (mullvad.net)
– For Chromium and Brave, set it up using the hensm maintained proxy at https://github.com/hensm/mullvad-proxy

If a website blocks VPN-based registrations, you can still mask your real IP by using private residential SOCKS5 proxies. these assign you IP addresses from real ISPs:
https://socksescort.com/ - Paid - SocksEscort proxies have been found to be malware-based. This may oppose you risks. I would rather use v
https://bigmama.network/ - Paid ----------
Oxylabs
SOAX
Your traffic will flow like this:
You VPN SOCKS5 proxy -> Website

*Messaging Apps:
Signal - Accepts subpoenaes, but literally hands over nothing.
SimpleX.chat - Accepts subpoeanes, but little userdata is kept
Tox.chat - Does not accept subpoenas
Wire.com - Accepts subpoenaes
Element.io - Can't subpoena users, only entities running homeservers
Session - Accepts subpoeanes, but little userdata is kept.
Telegram - Federally monitered

*Windows:
https://github.com/Raphire/Win11Debloat
privacy.sexy

HOWEVER.
Windows telemetry is APT grade malware. You CANNOT get rid of it without government intervention.

*Services To Avoid:
Microsoft owned
Google owned


  1. Data Handling

Encryption - Always encrypt sensitive data at rest and in transit using strong well reviewed cryptographic tools.

Data Minimization - Collect and store only the minimum amount of data necessary for the operation to reduce exposure risk.

Steganography - For extremely sensitive data, consider hiding information inside innocuous files to add an extra layer of the concealment.

Data backups - Personally I don't do this. But if you REALLY need to, keep encrypted backups in seperate secure locations.


  1. Telecom & SIM Cards

Telecom and SIM card security are very critical because mobile devices often leak location, identity and metadata.

Principles:

  • Use Burner SIMs
  • Limit PII
  • Avoid Sim Swapping Risks
  • Silent SMS Monitoring
  • Baseband Attacks
  • IMSI Catchers
  • Encrypted messaging, i.e. E2EE over phone
  • Burner Phones
  • Network Awareness.

Your risks:

  • SIM Swapping Attacks
  • Location Tracking
  • Data interception
  • Firmware exploits
  • Linking multiple SIMs or device to a single ID

To avoid;

  • Rotate burner SIMs frequently, then discard after use
  • Use faraday bags to isolate devices when not in use.
  • Seperate phone sfor different operational IDs
  • Pair encrypted messaging apps with burner devices for secure COMMs.
  • Disable automatic network connections

  1. COMSEC

Common COMSEC Risks:

  • Metadata leakage revealing communication patterns
  • Compelled data disclosure via subpoenaes, warrants etc
  • MITM attacks
  • Use of NON-E2EE messaging exposing content
  • Reuse of identifiers linking seperate IDs

Follow these practices:

  • Use E2EE messaging apps
  • OTR provides encryption with the deniability for instant messaging.
  • Onionshare to share files, or any file host if metadata is stripped and the file is not private

  1. Threat Modeling

The process of identifying understanding and prioritizing threats to your assets or IDs.

Principles:
Identify threats.
Assess capability.
Map all possible methods.
What assets are at risk?
Do the defense-in-depth method.
Risk appetite - decide what level of risk you're willing to accept

Practices:

  • Create detailed profiles of threat actors.
  • Map all possible attack paths.
  • Use scenario planing to test responses.
  • Apply layered security controls to reduce single points of fail
  • Continuously gather intel to stay informed of emergeing threats.

  1. Physical Security

Home SD - A Shotgun with buckshot. Wide spread, so its forgiving if your aim isn't perfect. Also not as high energy as slugs, so theyre less likely to go through a wall - they are also still more powerful than birdshot.
If you want the handgun route, get hollow-points for the same reason above.

https://www.pewpewtactical.com/best-handgun-beginners-home-defense/
https://www.quora.com/What-is-the-best-handgun-for-a-quick-draw-and-self-defence-for-someone-alone-with-no-support

Practices:

  • Keep weapons and gear accessible, but secure
  • Stay informed on local laws regarding self-defense and weapons
  • keep a microwave in your room incase you need to microwave your hard drive (this is a joke)

  1. Financial

Privacy-centric coins:

  • Monero (XMR)
  • Zcash (ZEC)
  • ARRR
  • Firo

Check the terminology at the top of the doc.

  • Using physical cash remains one of the most anonymous ways to conduct transactions.

Practices:

  • Prefer decentralized and privacy focused financial tools, to avoid centralized tracking.
  • Use burner wallets and fresh addresses for each transaction.
  • Avoid mixing personal IDs with financial accounts tied to your PII
  • Minimize use of exchanges or services requring KYC
  • Regularly audit and clean transaction histories if possible
  • Be cautious with payment apps and online banking apps as they always collect data

  1. Operating Systems

  1. Tails OS
  • Live OS
  • Forces all traffic through tor
  • Don’t enable persistence unless necessary
  1. Qubes OS
  • Security - focused desktop OS
  • Isolates apps and identities in separate “qubes”
  • High learning curve; hardware compatibility is important
  1. Whonix
  • Tor based anonymity
  • two part system gateway - routes traffic via tor, and workstation is isolated
  • Never use the workstation VM without the gateway

Say no to windows.


  1. Infrastructure

Backend elements of OPSEC
VPS - Virtual Private Server
Reverse Proxy - A server that routes traffic to backend servers

Good workflow practice:
Client Tor/VPN Reverse Proxy Application Server (in sandbox) Encrypted Storage


  1. Browser

Personally, I recommend using Librewolf. However, these are my top 3;
Librewolf, Tor, Fennec

How to edit your about:config;
These settings will maintain security;

media.peerconnection.enabled = false - Disable webRTC
privacy.resistFingerprinting = true - Enable anti-fingerprinting
privacy.trackingprotection.cryptomining.enabled = true - Block cryptominers
privacy.trackingprotection.enabled = true - Enable tracking, protection and blocking.
privacy.trackingprotection.strict = true - Optional, enables stricter blocking.
geo.enabled = false - Disable geolocation requests
dom.event.clipboardevents.enabled = false - Disable clipboard leaking
network.http.sendRefererHeader = 0 - Limit Referer header (reduces xss)
browser.safebrowsing.phishing.enabled = true - Safe browsing protections
browser.safebrowsing.malware.enabled = true - - - ^
network.trr.mode = 2 - DoH
network.trr.uri = "https://mozilla.cloudflare-dns.com/dns-query" - DoH
security.ssl3.rsa_des_ede3_sha = false
security.ssl.require_safe_negotiation = true
security.tls.version.min = 3
tls.version.max = 4
security.tls.enable_0rtt_data = false
browser.formfill.enable = false
browser.cache.disk.enable = false
browser.cache.disk_cache_ssl = false
browser.cache.memory.enable = false
browser.cache.offline.enable = false
browser.cache.insecure.enable = false
plugin.scan.plid.all = false
browser.newtabpage.activity-stream.feeds.telemetry browser.newtabpage.activity-stream.telemetry = false
browser.pingcentre.telemetry = false
devtools.onboarding.telemetry-logged = false
media.wmf.deblacklisting-for-telemetry-in-gpu-process = false
toolkit.telemetry.archive.enabled = false
toolkit.telemetry.bhrping.enabled = false
toolkit.telemetry.firstshutdownping.enabled = false
toolkit.telemetry.hybridcontent.enabled = false
toolkit.telemetry.newprofileping.enabled = false
toolkit.telemetry.unified = false
toolkit.telemetry.updateping.enabled = false
toolkit.telemetry.shutdownpingsender.enabled = false
webgl.disabled = true
privacy.firstparty.isolate = true
security.ssl.enable_false_start = false

Using librewolf, some of these will be enabled automatically. It is always good to check though, here's a video to help guide you:
https://www.youtube.com/watch?v=xxWXLlfqNAo

Search Engines:
Personally I use startpage, but you can use DuckDuckGo. Both are privacy-focused.


  1. Credits

Hey! Thanks for reading my text document, if you liked this or want to see more, please dm me and I can help you with anything you need - answer your queries or simply chat.

Have a great day, and stay secure!

My discord: @isthisahi

06/20/2025

Edit

Pub: 06 Dec 2025 08:59 UTC

Edit: 06 Dec 2025 09:14 UTC

Views: 52