0x0e / 0x0eIs the device in my hand working for me or against me?
Devices and Operational Security
Every protocol on this site fails if the endpoint is compromised. Threat modeling, hardened phones, amnesic and compartmentalized operating systems, browsers, file encryption and the habits that hold it all together.
Start here
Guides
Bitcoin Self-Custody, Step by StepNot your keys, not your coins. Holding your own keys is simple; holding them safely, privately and recoverably takes a plan.
intermediate
2-4 hours
Encrypting Files, Disks and BackupsEncryption at rest is what stands between a seized or stolen device and everything on it.
beginner
1 hour
Hardening a Phone with GrapheneOSYour phone knows more about you than anyone. GrapheneOS is a hardened, de-Googled Android that keeps it working for you.
intermediate
1 hour
Nostr Key Custody and RecoveryThe hard part of key-rooted identity is not generating a key. It is keeping the key usable for years without turning every phone, web app, browser extension, and backup file into an account-takeover risk. Nostr is the best live laboratory for this problem because the public key is the account.
Guide
None
Reducing Tracking: Browsers, DNS and FingerprintingMost surveillance is commercial and automatic. A few changes to your browser and network remove most of it.
beginner
30 minutes
Responding to Suspected Device CompromiseMove sensitive activity somewhere safer, record what happened and get help before making changes that could erase evidence or alert an attacker.
intermediate
None
Sanitizing Documents Before SharingMetadata cleanup, safe rendering and redaction solve different problems. Use the right step for each, then inspect the actual file you will send.
intermediate
None
Tails, Qubes OS and WhonixWhen a single mistake or a single exploit would be catastrophic, the operating system has to enforce the discipline for you.
intermediate
1-3 hours
Threat Modeling for Sovereign IndividualsBefore choosing a single tool, write down what you are protecting, who you are protecting it from, and what failure would cost you.
beginner
45 minutes
Verify software before installing itConfirm who signed the bytes you will run, then ask whether those bytes can be rebuilt from the published source.
intermediate
None
Technologies
age: Modern File Encryption
Deep dive
✓ Battle-tested
Apple Secure Enclave (SEP)also in confidential computing
Deep dive
✓ Battle-tested
Hardware Walletsalso in money
Deep dive
✓ Battle-tested
Dangerzone
Deep dive
Usable
Heads Firmware
Deep dive
Usable
OpenWrt
Deep dive
Usable
Passkeys and Security Keys
Deep dive
Usable
Remote Signing (NIP-46 and Friends)also in identity
Deep dive
Usable
StartOS
Deep dive
Usable
YunoHost
Deep dive
Usable
Directory32 curated links
Browser Hardening
- Arkenfox user.js — Firefox privacy, security, anti-tracking, and fingerprint-resistance configuration template
- Tor Browser — Hardened Firefox browser routed through Tor for strong anonymity sets
- LibreWolf — Firefox fork with privacy defaults, telemetry removal, and fingerprinting protections
- Mullvad Browser — Tor Project and Mullvad privacy browser designed to reduce fingerprinting without Tor routing
- uBlock Origin — Efficient wide-spectrum blocker for ads, trackers, malware, and coin miners
- ClearURLs — Browser extension that removes tracking parameters from URLs
- Privacy Possum — Browser extension that reduces and falsifies data collected by commercial trackers
- Privacy Guides — Community-maintained recommendations for defending against mass surveillance
Mobile & Device Hardening
- GrapheneOS — Android privacy and security hardening project for supported Pixel devices
- Orbot — Tor VPN/proxy app for Android by Guardian Project
- Rethink DNS + Firewall — Android encrypted DNS, WireGuard proxifier, app firewall, and connection tracker
- TrackerControl — Android app for monitoring and blocking hidden tracker connections across installed apps
- Exodus Privacy — Platform for auditing trackers and privacy risks in Android applications
DNS & Network Blocking
- HaGeZi DNS Blocklists — Maintained DNS blocklists for ads, telemetry, phishing, malware, and tracking domains
Private Search
- Whoogle Search — Self-hosted, ad-free Google metasearch proxy; final release in 2026 due to Google blocking
Fingerprinting Tests
- CreepJS — Browser fingerprinting test suite for auditing how trackable a browser/device is
- web-fingerprinting — Research collection covering fingerprinting papers, attacks, mitigations, and test suites
- Browser Fingerprinting Resistance Research — Matrix comparing browser protections against common fingerprinting techniques
Passkeys and Security Keys
- WebAuthn Level 3 — W3C public-key authentication specification: credentials, origin checks and backup state
- FIDO passkeys — Definitions and guidance for synced and device-bound passkeys
- FIDO authentication specifications — Official WebAuthn and CTAP specification references
Document Safety
- Dangerzone — FPF tool that renders untrusted documents in isolation and rebuilds PDFs from pixels
- mat2 — Metadata cleanup for supported documents, images and other file formats
- ExifTool — Read and edit file metadata; PDF edits are reversible and need further sanitization
Incident Response
- Mobile Verification Toolkit — Android and iOS forensic tooling for investigators; a negative result cannot prove a device is clean
- Access Now Digital Security Helpline — Free digital-security assistance and incident response for civil society
Router and Boot Firmware
- OpenWrt — Linux router firmware with package management for supported hardware
- Heads — Boot firmware with integrity checks; TPM and token protections depend on board configuration
- fwupd — Firmware-update service for supported devices
- Linux Vendor Firmware Service — Vendor firmware distribution and metadata used by fwupd clients
Self-Hosting Servers
- StartOS documentation — Personal-server service installation, networking, backups and system administration
- YunoHost — Debian-based server administration with packaged applications, users and backups