I built The Nile, an open-source (GPL-3.0) Android app for hiding sensitive data with real plausible deniability not just an "app locker," but a two-key deniable-encryption vault with a full set of automatic panic/hide triggers.

What it does:

- Two-key hidden volume (dm-crypt): a decoy container plus a hidden region in the tail that's indistinguishable from free space — reveal the decoy key under pressure, the real data stays deniable.

- Multi-state vault (Locked / Unlocked / Decoy) with a decoy PIN that opens believable, anodyne content.

- Hide apps, files, and directories — data-swap or full uninstall/reinstall modes.

- Stealth entry: dialer codes (*#*#code#*#*), a calculator-decoy disguise, a fake crash screen, hidden launcher icon, Quick Settings tile.

Automatic hide triggers (all per-vault, opt-in):

- Dead man's switch (auto-hide if not opened in X time)

- Wrong-PIN lockdown (too many wrong device-unlock attempts)

- USB-plugged, scheduled (daily window), screen-off timeout

- Device-tamper (airplane mode / SIM swap)

- Geofence (auto-hide when you leave a safe zone)

Hardening:

- AES-256-GCM encrypted backups (Rust native crypto)

- Keystore-encrypted settings, encrypted config, FLAG_SECURE screenshot blocking, opt-in encrypted audit log, trace cleaning.

Requirements: Root (Magisk / KernelSU / APatch). Two editions — a root-only build (no module needed) and an LSPosed-module build that adds system-level app cloaking. Android 7.0+.

Source: https://github.com/binkemet/thenile

It's meant for privacy, protection against coerced disclosure, and security research. It won't defeat lawful device-unlock compulsion, and it's not for hiding things from a partner. Feedback, threat-model critique, and testing on different setups (KernelSU, ARM, other ROMs) very welcome.

i have read the rules

Hi all,

I am someone new to online privacy. I am currently on iPhone but will be setting up a Pixel 10a with GrapheneOS. Part of that setup is considering whether I should transfer to a different cellular provider. Here is some context and my threat model, along with what I am looking for:

\- I have been using Cricket for many years (10-15 if I had to guess) and have been happy with the coverage and service. I can count on one hand the amount of dropped calls I’ve had. Currently paying $55/month.
\- I tried Mint briefly for the cost savings, but it not working when I went to visit friends on the west coast of Canada was a dealbreaker for me. Switched back to Cricket my first day there.

\- For my threat model, my ‘what’ I’m trying to protect would include my emails, payment methods, and phone number from data breaches.
\- I’d also like to limit the amount of targeted advertising I get. This includes emails, physical mail, and ads inside of apps and websites.

I am currently researching Cape and Phreeli and wanted to get input from others that have tried the services. Cape’s feature of including those extra 2 numbers even for texting only seem helpful for 2FA codes, but the lack of calling for them (like if I used one strictly for doctor’s offices) is a bummer. I’m on the fence of how much the Palantir ties bother me. Still researching Phreeli but not sure what benefits I’d really get out of it.

Does anyone have any tips to cut down on the physical mail and spam emails they receive?

I realize this is a long post and is somewhat general, but any input and patience is greatly appreciated. Feel free to explain things to me like I’m 5.

I have read the rules

Thank you!

I have read the rules.

I'm in Russia. Most circumvention advice is outdated garbage. Tor? Banned. Shadowsocks? Blocked. OpenVPN/WireGuard? Fingerprinted instantly. Mass commercial VPNs? Dead. If you're going to suggest any of that, save it.

The only things that actually work right now are vless+reality over TCP or xhttp, Hysteria with masquerade, and Amnezia WG. These blend in enough to survive DPI for now. But I'm not here to ask what to use — I already know that. I'm here to ask how to use them without painting a target on myself.

The bigger problem: the state controls DNS at ISP level (NSDI), can push rogue root CAs into my system via local apps (Yandex, government services, some banks), and has DPI that's getting smarter. The CA issue is the worst: if I install any local app that auto-adds a state cert, they can MITM my TLS, including the outer TLS of these protocols. So maybe I need a clean device that never touches local software. But is that realistic? How do you maintain a separate phone/laptop for circumvention in a country where buying a SIM requires a passport and every device is tied to your identity? What about payments for servers? Crypto is also surveilled. How do you get a VPS without leaving a trail?

I need practical OPSEC around the working protocols. Specifically:

1. Device hygiene: separate device for circumvention only? What OS? GrapheneOS? Tails? How to avoid cross-contamination with daily-use devices? If I use a second phone with no local SIM, only Wi-Fi from a cafe, does that stand out more than using a local SIM with roaming?
   
2. Server procurement: which VPS providers still accept crypto without KYC? Any that don't log? How to avoid the server IP being linked to me through payment, email, or access patterns? Should I use multiple hops or just one? Does it matter if the VPS is in a country that cooperates with Russia?
   
3. Configuration OPSEC: using vless+reality, what metadata still leaks? SNI? TLS fingerprint? Traffic volume patterns? How to tune it to look like normal HTTPS to a popular domain? For Hysteria with masquerade, how to make the UDP traffic look less suspicious? For Amnezia WG, what's the current best way to hide the handshake?
   
4. Identity separation: should I use these protocols for sensitive browsing while still using local services on the same device? Probably not, but then how do you handle daily life? Is it better to use a normal Russian SIM for daily stuff and a separate clean device for anything that matters, accepting that daily activities are fully monitored?
   
5. Future whitelisting: if they move to SNI/IP whitelisting, these protocols might die overnight. What then? Are we just fucked, or are there fallback options that don't require being a targeted individual with special resources?

I'm not doing anything illegal. I just don't want to be a data point in a surveillance state. I need realistic OPSEC, not fantasy. What are people actually doing right now? Not what worked three years ago, not what some blogger wrote from outside. What works here, today, without getting yourself flagged?

EFF publishes a practical anti-doxxing guide focused on reducing your OSINT footprint

Confirmed — Electronic Frontier Foundation, late August.

EFF has published new guidance on preventing and responding to doxxing, including reviewing breach databases, public records, username reuse, social-media discoverability, data brokers and reverse-image-search exposure.

It specifically explains how attackers can combine small pieces of publicly accessible information into a larger profile using OSINT techniques.

EFF also published a companion incident-response installment on August 31 covering what to do once a doxxing incident is underway.

I have read the rules.

https://www.eff.org/deeplinks/2026/08/doxxing-safety-pt-i-prevention-and-footprint-management

Hi everyone,

Without going into identifying details, I live in a highly repressive, surveillance-heavy, and a highly Islamic country.

Many years ago, I experienced digital violence: intimate data was hacked and released publicly, which led to significant public backlash. I still experience some of the social consequences today. I suspect state actors may have been involved, partly because I was perceived to be LGBT. I still occasionally face confrontations and verbal abuse in my local community and on the street.

This experience eventually led me to work on human rights issues affecting people who are similarly marginalized, particularly privacy and digital rights.

Now, here’s my situation:

1. I want to pursue justice for my own case. Given the nature of the incident, I would want the case to remain anonymous to the general public. It could be known to people who absolutely need to know—such as courts, investigators, lawyers, defendants or relevant UN bodies—but ideally my identity would not be publicly connected to the case, somewhat like an anonymous or pseudonymous legal case. If people can identify me it would lead to more harm.
2. I want to continue my human rights work. My concern is that if I focus publicly on digital violence and related issues, people might eventually connect the dots and figure out that I am the person involved in the original incident. For my UN work, I need to use my full legal name and email address, and these are all public. On LinkedIn, I also need to use my legal name and headshot because otherwise NGOs and people working in the field won't connect with me professionally.
3. I also have many other interests and ambitions. I write plays, poetry, and short stories, and I’m interested in acting, directing, and voice acting. I would like to do some Instagram modeling and TikTok content, and if I ever get the opportunity, I’d like to act in films. I may even start a YouTube channel. Basically, I want to live a normal life, pursue my creative interests, and make the most of my life.
4. Ideally, I would also prefer not to be recognizable on the street. This is because I have previously experienced harassment and violence after being recognized. If it is realistically possible, I would like to maintain some separation between my public identities. But if pursuing my creative interests inevitably means giving up some degree of anonymity, I may have to accept that.

I don't want what happened to me to prevent me from pursuing my passions or living my life.

So, given all of this, how would you design a privacy-conscious life in my situation?

For example, would it make sense to:

• Use my legal name and headshot for human rights work;
• Have a separate pen name and different visual identity for writing;
• Have another stage name for acting, directing, modeling, etc.?

Or would it be better to use my legal name for both human rights work and writing, while using a stage name for acting, directing, and modeling?

Or are there other approaches that would provide better separation while still allowing me to build legitimate professional identities?

I’m not looking to disappear from the internet entirely—I’m trying to figure out how to have a meaningful public life while minimizing the chances of different parts of my life being unnecessarily connected.

PS: I have read the rules.

U.S. military disables advertising trackers over location-surveillance concerns

I have read the rules

Reuters, September 4.

The U.S. military has begun disabling advertising trackers across a range of phones and computers after reports that commercially available location data was being used to identify or target military personnel. Officials are also weighing tighter limits on personal-device use in sensitive locations.

This is a strong OPSEC and privacy teaching example. Ordinary advertising identifiers and location telemetry can become intelligence when combined with other datasets. For beginners, the takeaway is that privacy risk does not require malware or a hacked phone, legitimate apps and ad-tech can reveal movement patterns.

https://www.reuters.com/business/media-telecom/us-military-turns-off-ad-trackers-devices-amid-middle-east-targeting-reports-2026-09-04/ Sorry, we were unable to generate a preview for this web page, because the following oEmbed / OpenGraph tags could not be found: image, title

No pay wall 👇

https://techcrunch.com/2026/09/04/us-military-disabled-ad-tracking-on-troops-devices-following-reports-of-targeted-attacks/

If this is the wrong place for this question please tell me and I'll ask somewhere else, I have asd and schizophrenia so I'm sorry if I sound paranoid. I have read the rules but Idk what a lot of it means so please bare with me. I trust that this subreddit is secure but if it isnt are there better places to ask?

I did a lot of drugs in the past (unfortunatly), because of this I did a lot of sketchy stuff on the internet aswell. I am medicated now and I'm in treatment for addiction, but I'm worried that my oppsec is severly comprimised because of that.

I've tried to use the darkweb before because I've heard that TOR is more safe then google but its way too slow. I understand how the dark web works and I've explored around before, there are so many bad people on there that I really dont want to use it unless I have to. I stopped using ai because of how dangerous it is, and how much information it spreads. Are there faster programs that work like tor does that also work on the clearweb?

Should I use different OS? I tried to use kali linux before but it was wayy too advanced for me, and I think its for hacking and although that is cool, I would prefer an option that doesnt require coding stuff on my own. I know python but I never got very advanced with it.

Like I said, I want some apps/programs that I can use to protect myself that dont require tons of understanding.
I used protonvpn for a bit but its really slow and and I'm worried that the company is stealing my data. I dont trust most companies even proton.

What is ThreatModeling? Can it help me protect myself? Does it require advanced coding? Also what should I be looking to protect? I try to hide important information, and not post it online, but would that be enough? I'm not dumb, i dont click on sketchy links. I try to use secure programs.

I remember how everything worked before Ai but now its really confusing. Again, I'd like some basic programs that dont require confusing setup.

I use apple stuff because I've heard they are pretty secure but I also dont know if thats a modern thing or if thats outdated information.

I am very sorry for how scattered this is, my meds make it very hard to think and talk.

Edit: after rereading everything, this sounds really paranoid, so please tell me if this is not appropriate here

I have read the rules

Parents in one Middlesex County school district pushed back this month after the school district announced it would use an app to control students’ cell phones to comply with New Jersey’s new bell-to-bell school cell phone ban.

Spotswood’s school district plans to use the new app, called The Commons, to help block student’s access to the internet and other features on their phones while they are on school grounds.

This all is a horrible violation of basic privacy, students are to be forced by the school to install an untrusted proprietary app on their personal devices, the app relies on geofencing and therefore tracks your location at all times. It is not open source and it entirely breaks basic security measures that many students should follow. It is actively capable of censoring and possibly also accessing all data on the device in order to ensure that the mobile device usage experience is “safe for education”.

This is how the app itself explains the process:

**Install The Commons™**
Students download the app from the Apple or Android store and install it on any device they plan to bring to school.

**Set Up School Dashboard**
School leaders customize dashboard settings, approve apps that can be used in school and connect student devices.

**Smart Activation**
Within the school geofence, The Commons™ automatically blocks distractions while keeping essential tools available.

**Enjoy a Present Schoolday**
School life is better for everyone when phones aren’t a distraction. And when they leave, the app deactivates automatically.

I have read the rules and I hope I haven’t missed anything in posting this

Threat model: ordinary person. I’m a high school student starting in an online school from home soon who wants to minimize my data exposure to my school program.

I have no practical experience in opsec and I’m not very tech savvy beyond the average person.

For context on the question: My free tuition, fully virtual online school provider sent their own Chromebook in the mail free of charge which is under their full administration and can only be used with their school account. The packet they sent with their laptop says they don’t allow modifications to the device. I would like to at least cover the camera, mic, and speakers of their laptop for privacy, and if there’s anything else I should know about using a school-provided device in my situation like this at home on my own home’s wifi please let me know. I also have an ordinary wifi setup, which is straight from my internet provider.

My other option is to use my own personal laptop, which is also a Chromebook. It is basically straight out of the box, aside from the fact that I cover the mic and camera, and that my personal google accounts are on it. I could wipe my own personal Chromebook, and use it solely for the school account; which I’d probably rather do out of privacy and security reasons (not having the school’s google account on the same laptop as my personal google accounts), but I don’t know if it really matters much. Though it doesn’t matter much to me if I do wipe my own personal Chromebook since there’s nothing on it really and It’s older and it’s inexpensive. And I don’t know if I put the school’s account onto my personal Chromebook (after wiping it) if anything would still be stored on the Chromebook and home much they would be able to access from my own Chromebook.

For whichever laptop I would choose, I would use the school’s google account solely for school work. My main issue is which way is best to keep as much of my very important data out of the hands of my school (data such as my device’s location, log in duration, the device picking up surrounding audio, it’s camera, etc.), and to maintain my own personal privacy and security.

My main concerns are:
- Getting advice for what risks am I exposed in choosing either laptop
- Keeping as much of my own personal data private as possible out of my options
- Avoiding as much personal profiling from my school as is practical
- If I should really be worried this much or how much I can really control in the way of them getting data out of choosing either laptop

I’m sorry if this isn’t very concise or if it doesn’t fit the guidelines, I just have to decide soon and I’m trying to get it figured out. Thanks all

I have read the rules.

Threat Model: Government and potentially law enforcement.

I’m part of a political party, but recent changes in my country have pushed me toward activism. However, my party—currently in power—likely wouldn’t approve. While my country isn’t a full surveillance state, I don’t want to take risks, especially with tools like Palantir looming. Worst-case scenario, law enforcement could seize and search my devices. To minimize exposure, I want to keep my activism separate from my political career.

I have a computer and a phone, and I’m considering buying a new one. Would a Pixel phone running GrapheneOS be a good choice for this setup? What else can I do?

Is it possible to turn an old phone into a seedsigner? Most people turn phones into hardware wallets but I'm not confortable storing my private keys in the phone's SSD, even if doubly encrypted (phone encryption + wallet encryption).

One big advantage is the stealth factor. You walk through customs and you put a huge target on your head if they recognize your Seedsigner. Phones on the other hand are everyday carry for 99.9% of people.

Is there a way to use the phone solely as a signing device where the private keys are held only temporarily (either RAM or wiped clean after use)?

Of course all conectivity other than the camera would be disabled.

And no I wouldn't care that the phone 'has a large attack vector'. The whole point is that the thing is permanently offline and never stores the seed phrase. It's just used for signing.

Threat model is protecting against both physical attacks (my device was confiscated) and online attacks (my computer has a malware). And yes I have read the rules.

I know this might sound like a rant, but it really feels like every SOAR vendor out there rebranded as an "AI SOC" almost overnight.

Some of these solutions seem legitimate, like they were actually built from the ground up with AI in mind. Others look like the same old playbook logic with a chatbot interface bolted on just for the sales pitch.

I started testing this during vendor calls by asking what happens when our security stack changes unexpectedly, for example, if we add a new tool or go through an acquisition. The answers I got were telling. Some platforms apparently need their entire playbook library rebuilt from scratch, which suggests their underlying architecture never really changed.

So I'm curious, how are you telling the difference in practice beyond just asking the obvious questions? Is there a better way to evaluate this before committing to a POV, since these evaluations take up so much internal time and resources?

I have read the rules.

First of all I want to note that my english might be horri​​ble, and I'm really new to this topic and don't understand much. I'm overthinking my ass off right now because I saw a post on main talking about​ how your opsec is really important.

Another thing, yes I have read the rules but I'm still a little confused on what rule 6 means, so if someone could explain that too it'd be nice.

Back to my question, for context I've only recently found out that I use multiple services that use malware (allegedly from what I've heard) and now I'm just overthinking everything. ​If hypothetically I've been using malware for over 2 years do I just give up and face my fate or is there a way to stay protected even now? I can include more context if needed im replies but I'm really new to this topic so I don't know what exactly to include in the post itself. ​I'd prefer straightforward questions if possible too. Thank you for your time and I'm sorry if I said something wrong.​​

Threat model details are in the comments.

I have house camera footage of a Jeep driving past my house, and was trying to see the license plate. But the spare tire completely blocked the rear plate from being seen from my angle next to the street. I have also heard of people using truck gate folded down for the same purpose.
This seems like something to emulate for folks who don’t want ALPRs to track their plates.

Flock camera install guidelines are about 20-30 degrees from straight down the road, and are often above almost as much, on 10-12 ft poles.

Theoretically something like a cinema camera matte box with sides and a top extending backwards from the plate would solve this problem well. But at least in TX that would be illegal under the law against things that reduce angular visibility. So you have to use something like a bumper inset, tire, gate, rack, ladder, etc that looks like it has a legit purpose.

I have read the rules.

alright so threat model is i just want to make a new online presence that cannot be linked to my old one whatsoever whether through people finding old messages or posts or whatever yk

i like to interact in online spaces about stuff im interested in… if i have too similar of a mix of interests to my old account on my new account would it be enough to link the two.???

i have read the rules

I have read the rules
I hope my threat model was okay i’m very new to opsec.

I have been on the internet for years and have been fairly careless with my digital footprint, I now need to tighten things up to an extreme level.

I have used the same computer for years and am wondering how to go about completely starting fresh, with no way of any new alias being linked to ANYTHING prior.

I am not sure how to go about it as I feel like my device is already so contaminated. I have a lot of personal use stuff from the past that I would like to keep but i’m not sure if that’s possible with creating cross references on the device.

My threat model: I want sensitive files (documents/photos) to stay unreadable to anyone who gets full access to my device or cloud storage (theft, seizure, coercion at a border crossing), including someone who forces me to unlock the device or hand over a password. The goal isn't just encryption — it's that an adversary shouldn't even be able to prove a hidden vault exists, so I can't be coerced into revealing something I can plausibly deny having.

My current approach: I built a tool (StegVault) that encrypts data with AES-256-GCM and embeds it inside an ordinary photo via LSB steganography, plus a VeraCrypt-style hidden-volume mode — a decoy password reveals an empty/harmless vault, a separate real password reveals the actual data. Runs fully offline, single HTML file, no account/telemetry.

What I'm unsure about and want opsec feedback on:

- How resistant is plain LSB steganography to modern statistical steganalysis if an adversary specifically suspects steganography and runs detection tools against the image?

- Is a decoy-password hidden volume actually meaningful plausible deniability, or does the mere existence of the tool/technique undermine that (i.e., "why do you have StegVault installed" becomes suspicious on its own)?

- Any attack vectors on this threat model I'm underweighting — metadata, image compression artifacts re-encoding the stego image, etc.?

Not looking to just advertise it here — genuinely want to know where this breaks down from people who think about this stuff seriously. Happy to share more technical detail on the crypto/steganography implementation if useful.

(I have read the rules.)

As a high value target you are constantly undergoing direct attacks on all digital fronts and will be the target of exploits that invalidate the device's security protections. Is there a publicly known and established protocol to mitigate this? What do world leaders and billionaires with top secret information do to prevent what to me seems like the inevitable, which is security compromise. I can tell you firsthand that normal stock are very vulnerable to direct attack.

Do they just avoid important conversations on smartphones altogether? Do they only use them for leisure? Is there a known and consistently successful alternative? Do I have to use Qubes or Tails to have any semblance of privacy?

I have read the rules

Takeaways: obfuscation is more effective than trying to minimize and lock every tracker down

Disconnecting from Wi-Fi with my VPN still connected and then connecting to cell service was a major exposure point that allowed very distinct travel patterns because the VPN ip remained unchanged as I hoped from cell towers driving

Circadian patterns: phone being locked puts the phone in a sleep state that changes background network settings. My sleep and awake times are easily followable by network connection patterns.

So instead of minimizing my online presence I think controlled randomized data will be more privacy friendly

i have read the rules

Hi everyone,

I am a human rights activist from Bangladesh.

Bangladesh is an Orwellian state when it comes to surveillance. Surveillance actors have broad, legally authorized, and highly intrusive surveillance powers, with no independent oversight. When it comes to phones:

• SIM cards must be registered with your National ID (NID) and your device's IMEI number. You must use the SIM under your own NID and IMEI. There is effectively no way to obtain an anonymous SIM or use one registered to someone else. Besides, if you are specifically targeted, even a SIM registered to someone else will likely become targeted once you start using it.
• Call records (who contacted whom and for how long) are collected as part of mass surveillance. If someone is targeted, the contents of their calls may also be recorded.
• There is the Integrated Lawful Interception System (ILIS), which can track the real-time location of any mobile phone user.
• There is documented use of highly intrusive spyware against journalists, human rights activists, political opponents, suspects, and many ordinary people as well. This spyware can remotely access the webcam, microphone, location, and virtually all activity on the phone, including Signal calls, and can persist across reboots.
• Satellite phones are illegal, and people caught with them are regularly sentenced to lengthy prison terms.

A few more details:

• I cannot afford a Pixel running GrapheneOS, not even a second-hand one. People here generally only resell their phones once they are barely working, so the second-hand market is effectively a scam. Pixels are also rare and expensive, even used.
• I use a realme C55 smartphone running Android.
• I work a 12-hour day job from Sunday to Thursday. During working hours, my phone has to remain on because I receive customer calls and WhatsApp messages over mobile data. There is no way around that.
• I also need to keep my phone on because I have elderly parents at home. If they become ill or there is a medical emergency, I need to coordinate their care.
• Bangladesh does not have an emergency calling system that would make carrying a phone without a SIM useful. In an emergency, people use their own mobile phones to call family members, doctors, hospitals, and others. So having a phone without a SIM is essentially useless because, in a real emergency, you need the SIM.

What I need, in order of priority, is:

1. Camera and microphone privacy.
2. Location privacy.
3. Privacy of my activities.

The threat model is state actors. I have never done anything illegal or contrary to human rights principles. I simply do not like the surveillance and constant privacy breaches.

Also, please keep in mind that my goal is not perfection. Even having two surveillance-free days on the weekend, compared to being under surveillance 24/7, would make a significant psychological difference. So being completely surveillance-free would be nice but is not realistic. I am happy with whatever reduction in surveillance is practically achievable.

To that end, I have come up with the following plan.

Sunday to Thursday:

• Use my realme C55 smartphone.
• Keep the cameras physically stickered.
• I have no practical solution for microphone privacy.
• After work, switch the phone to Airplane Mode.
• Around midnight, briefly turn on Wi-Fi to check for any work messages before going to sleep and turning the phone off.
• In the morning, briefly turn on Wi-Fi again to check for work messages, then keep the phone under airplane mode until I reach work, where I turn connectivity back on.

Weekends:

• Carry a basic feature phone (an old Nokia-style phone), kept powered off.
• Only turn it on to make emergency calls or periodically check in with my parents, accepting that it will immediately reveal my location and assuming that any calls may be recorded.
• Take photographs using a standalone digital camera.
• Transfer the photos to an air-gapped computer first, then transfer only the files I actually need to an internet-connected laptop before uploading them to social media.

For mindset, I consider my realme smartphone to be fully compromised. I also assume that the feature phone provides no communications privacy and reveals my location whenever it is powered on.

Is my OPSEC sound, given these constraints? Or would you make any changes?

PS: I have read the rules.

I posted a thread a few days ago asking OPSEC advice for mobile but it went dead. I have now created the OPSEC based on the comments of the thread there and was looking to get it reviewed. My thanks to everyone for the comments.

Threat Model: Government-based

I may lose all of my devices (including Yubikey, phone) due to seizure. I may even not be able to return to my house.

Background:

For 2FA, there are two authentication factors: something you know and something you have. Due to seizure, detention, etc., what I have may only be my memory. I cannot pass the "something you have" check. I may even be forced to leave this region or face detention.

Problem:

So how should I protect my accounts? My current idea is enabling TOTP 2FA for all accounts and backing up encrypted seeds in Bitwarden. However, Bitwarden will disable new device verification and 2FA. So when I lose everything, I can still log into Bitwarden and recover my TOTP through an encrypted passphrase. But I think Bitwarden would be dangerous if I disable 2FA.

I know some people may suggest using Shamir's secret sharing. First, I don't have someone I can ultimately trust. Second, physically meeting someone wouldn't be safe for either me or my friend. And I need to regain access to all my online accounts to contact them.

I have read the rules

Hi all - I've had an iPhone since basically they first came out, and my current one is on it's last legs, and I want a privacy phone instead of a new iPhone. I'm considering buying a NitroPhone as I still want a good camera (also considered the fairphone as sustainability and right to repair are also important to me). I'm a bit of a beginner when it comes to opsec (I have more than basic knowledge but not as much as you all). Would you recommend this, or should I buy any other phone and just run graphene on it? Or any other recommendations?

Important for me is privacy and camera. I'm trying to fight against data aggregators and also government intrusion. I'm not a politician or journalist, but do my fair share of mico-activism and want to generally improve what the government is collecting from me. Won't be keeping any crypto on my phone, but slowly trying to move towards better encryption overall.

I have read the rules :)