A Comprehensive Guide to OPSEC: Threat Modeling, Operational Security, and Privacy

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." — Edward Snowden

Threat Model: Who is hunting us?

Before moving a single finger, we must understand who we are defending against. OPSEC (Operational Security) is not a magic list of rules to follow blindly. It is about making calculated moves based on our specific risks. Installing a random VPN and calling it a day is not enough: that is the amateur way. We must build our defenses based on who is looking for us, what they want, and what happens if they manage to catch us.

What are we protecting?

Are we defending sensitive personal data, confidential company information, not-exactly-legal activities, or simply our sacrosanct right to privacy? Maybe we are journalists, activists, hackers, or just people who want to keep their stuff locked down. Different assets require different levels of protection.

Who is hunting us?

This is where things get serious. There is a huge difference between avoiding a annoying kid on a forum and dodging a full-blown government surveillance operation. Here is the threat spectrum, in short:

• Low Level: Nosy friends, ex-partners, Sunday trolls, script kiddies with no real skills.
• Medium Level: Business competitors, cybercriminals, doxxers, stalkers.
• High Level: Law enforcement, intelligence agencies, industrial espionage, state apparatuses.

Each of these actors operates differently. Some rely on social engineering, others use technical exploits, and others break down your door using legal power. The more powerful our enemy, the more crack-free our OPSEC must be.

What happens if they win?

This is the cost of failure. What is the worst-case scenario if our data, identity, or location ends up in the wrong hands? Getting doxxed and harassed? Losing access to our accounts and digital assets? Ending up on trial, in prison, or worse? If the consequences can ruin our lives, let's not play around. This is where compartmentalization, anonymity, and the most rigid security protocols come into play.

Building the defense

The threat model is not a theoretical exercise: it dictates every single OPSEC decision. If our biggest threat is someone trying to peek at our messages, we don't need NSA-grade security. But if we are up against a nation-state, the rules must be ironclad.

Before applying any security measures, let's map out our threat model:

• What are we protecting?
• Who is hunting us?
• What is the worst thing that could happen?
• What resources and capabilities does our adversary have?

Only when we have clear answers to these questions can we start structuring a security strategy that actually works. Everything else is just security theater.

Stylometry: The invisible threat to anonymity

Stylometry is a technique used to analyze writing patterns to identify the author, even when using a pseudonym. It can track our posts, emails, and comments on social media across different platforms, even if we think we are anonymous. Elements like sentence structure, word choice, and punctuation habits create a unique digital footprint that can be traced back to us. If our writing style can be identified, so can our identity.

How to fight stylometry

To protect ourselves, we can create a unique writing style to associate exclusively with our anonymous identity. Start by analyzing our natural writing habits: observe our vocabulary, sentence structure, and tone. Once we identify the patterns that could betray us, we deliberately change them.

For example, if our writing style betrays that we are 25-year-old gamers, let's modify it to look like forty-somethings with a completely different life experience. The key is consistency. Adopt this new style in all communications under that pseudonym. A single slip-up in tone or vocabulary can blow our cover.

Remember that despite our best efforts, it is very easy to slip back into our natural writing style. If a stylometric tool detects inconsistencies, it can reconstruct our original style and trace it back to our real identity.

Furthermore, AI-driven de-anonymization techniques represent an even greater threat today. AI can analyze massive datasets to find subtle correlations, such as posting times, geographic locations, or recurring phrases across different platforms, linking accounts that seem to have nothing in common.

Tip: Avoid real-time communications (live chat) as much as possible: that is where it is easiest to make a misstep and reveal your identity or writing style. Write your messages first in an offline text editor (like Notepad), edit your style calmly, and only then copy and paste it to publish.

Building an Alias: Creating a credible and secure fictional identity

Creating a new identity is not about throwing random details together: we must build a credible character. Start with the basics like name, age, and geographic location. Then, create an email address dedicated exclusively to this alias, avoiding any elements traceable to our real life.

To fill in the blank details, we can use tools like the Fake Person Generator (https://www.fakepersongenerator.com). For profile pictures, absolutely avoid archive or stock images: use generative AI tools like Stable Diffusion or Midjourney to create realistic but non-existent faces.

Make sure there is no overlap between our real identity and the fictional one. Pay attention to the smallest details: habits, schedules, or word choices that could connect the two lives. The more meticulous we are, the harder it will be for anyone to connect the dots.

Behavioral and Biometric Profiling

When trying to remain anonymous online or managing multiple identities, it's not just what we write that counts, but also how we write it. Even under the Tor network, our anonymization can be compromised by behavioral and biometric profiling. The way we interact with our devices (typing speed, intervals between keypresses, and even mouse movements) can reveal much more than we think. We must be unpredictable.

Thanks to advances in AI, behavioral profiling is no longer limited to physical input data. Browsing habits, session lengths, and metadata can also be analyzed across platforms to de-anonymize users. AI excels at detecting patterns invisible to the human eye.

What is keystroke profiling?

It is a tracking technique based on keystroke dynamics, in particular the time that elapses between pressing one key and another. Research shows that typing rhythm and duration are as unique as a fingerprint. Algorithms only need a few minutes of measurement to identify a person, even if they change browser, IP address, or website. This is a direct threat to Tor users.

The risk increases when the same patterns are recorded on multiple sites. Trackers can compare and link identities, associating different nicknames or accounts with the same physical person. It's not just site owners collecting this data: advertising networks also integrate specific JavaScript scripts to capture typing times. Many banking institutions already use this technology to detect fraud by analyzing login patterns.

How to limit keystroke profiling

If you are concerned about this type of tracking, you can adopt these countermeasures:

1. Write offline in a text editor: Draft your texts offline in Notepad, then copy and paste the result into the browser. This prevents the website from recording typing intervals in real time. If this practice becomes common, it makes profiling much more complex.
2. Use browser extensions: Some extensions attempt to obfuscate typing dynamics by introducing random delays to keypresses. However, be careful with Chromium-based browsers (like Chrome), as websites can bypass or disable such extensions.
3. Disable JavaScript: This is the most drastic but effective measure. Without active JavaScript, websites cannot run scripts that record typing times. Keep in mind, however, that techniques that do not require JS may emerge in the future.

Locking Down Social Media: Minimizing the digital footprint

Let's face it: avoiding social media entirely today is almost impossible, unless you decide to go live in the woods. But that doesn't mean we have to give away our lives. We can minimize the disaster by following these rules:

• Delete old accounts and create new ones using Tor exclusively. If a temporary phone number is needed for verification, remember that these services leave a financial trace: to remain anonymous, pay in Monero (XMR) on sites like https://www.smscodes.io or https://crypton.sh.
• Disable all data sharing options and those settings disguised under the label "improve your user experience".
• Make all our profiles private.
• Never use our real name, photos, or personal info across platforms. If possible, use separate devices or virtual machines (VMs) for each alias to prevent tracking via device fingerprinting.
• For profile pictures, do not use personal photos or images that might reveal details about our location (like a photo taken from our home window).
• Do not enter personal details such as age, hobbies, or interests in the bio. Leaving these fields blank is the safest choice.
• Remove geolocation from all posts and images.
• Avoid accepting friend requests or followers from strangers.
• Enable two-factor authentication (2FA) on every single account, using offline apps like Aegis or FreeOTP.
• Use different usernames on each platform to prevent OSINT tools like whatsmyname.app from mapping our presence on the web.
• Use strong, unique passwords for each service, randomly generated.

Strong passwords: How to avoid common traps

If we reuse the same password across multiple platforms, we are making tracking work incredibly easy. Passwords must be unique for every single account. A password manager like KeePassXC allows us to generate and save strong credentials in a local encrypted database. For even greater security, manage the database on an offline virtual machine (like Whonix) to prevent any data leaks. If generating passwords manually, use tools like pwgen or the Diceware method.

Anonymous Payments

In the world of digital payments, Monero (XMR) is the only serious choice thanks to a cryptographic architecture that hides the sender, receiver, and transaction amount by default. Here is how to acquire Monero without leaving a trace:

Option 1: Peer-to-Peer (P2P) Exchanges without KYC

Use P2P platforms like BitValve, HodlHodl, or LocalCoinSwap which allow purchasing crypto without requiring identity documents (KYC). We can buy a more common cryptocurrency (like Litecoin or Bitcoin) and then use an anonymous swap service like Trocador to trade it for Monero, sending the funds directly to our personal wallet.

Option 2: Decentralized Exchanges (DEX)

We can buy Monero directly on decentralized marketplaces like Bisq or Haveno. They do not require KYC, operate directly between buyers and sellers, and allow us to withdraw funds to our personal wallet without intermediaries.

Fundamental precautions:

• Personal wallet: Always send our funds to a Monero wallet for which we own the private keys, preferably configured on a secure machine (a hardware wallet or an air-gapped device).
• Dedicated devices: For critical financial transactions, do not use our personal devices. Set up a clean, dedicated machine, such as a laptop configured with Qubes OS + Whonix.
• Anonymous spending: For online purchases, use merchants that accept Monero directly. We can use Trocador to buy prepaid gift cards paying in XMR, providing us with an additional layer of privacy.

Connecting to the Monero Network: 3 Paths Compared

1. Remote node (via Whonix): This is the most convenient choice. It offers good security if used under Whonix to avoid IP address leaks. We can find remote nodes on portals like https://monero.fail/, keeping in mind the risks of tracking by malicious nodes.
2. Local node: Theoretically the most secure option, but it requires downloading the entire blockchain to our computer (hundreds of gigabytes). Doing this over Tor is extremely slow, and doing it in the clear reveals to our ISP that we use Monero. Also, we will have to wait for synchronization at every reboot.
3. Dedicated VPS Node: This consists of running a Monero node on a VPS connected to the clearnet (which keeps the blockchain updated), to which we connect exclusively via a Tor Onion service to query the wallet securely.

Smart Management of Earnings

If we obtain money from activities related to Tor or anonymous projects, the first golden rule is: keep a low profile. Avoid any flashy displays of wealth. Buying luxury cars, real estate, or expensive goods is the fastest way to get noticed by tax audits or law enforcement. Keeping these earnings outside the traditional banking system is fundamental to preserving anonymity. Accumulate cash in a safe place for emergencies.

Integrate these funds into our daily life imperceptibly: make small improvements, buy common consumer goods, or work equipment that blends in with our usual expenses. Use cash as much as possible to avoid tracking, and prefer generic receipts over invoices in our name.

Web Browsing: Keeping our privacy intact

The most popular commercial browsers (like Chrome or Opera) are data-guzzling monsters. To improve our daily security, switch to privacy-oriented browsers like LibreWolf or Brave.

If we need to manage multiple profiles or fake identities simultaneously, the best solution is anti-detection browsers like Dolphin{anty}, Incogniton, or Ghost Browser, designed to mask device fingerprints and prevent cross-tracking.

• Search engines: Avoid Google and commercial engines. Use privacy-respecting alternatives like SearXNG or DuckDuckGo.
• Recommended privacy extensions:
  • uBlock Origin (the ultimate content blocker)
  • NoScript (to control JavaScript execution)
  • Privacy Badger (to block invisible trackers)
  • Cookie AutoDelete (to delete cookies when closing tabs)
  • ClearURLs (to remove tracking parameters from web addresses)

Data Protection and Secure Deletion

When we delete a file from our system, it doesn't disappear. The operating system simply marks the space occupied by that file as "free", but the data remains on the disk until it is overwritten by new information. If we stored sensitive files without encryption, their fragments will remain detectable for a long time.

The best solution is to use an encrypted file system from the start. If we have already stored files in the clear and want to delete them, we must use a secure deletion tool (shredder) that overwrites the empty space multiple times (e.g., following the NIST 800-88 standard). For sensitive operations, always work inside live operating systems like Tails or secure configurations like Qubes OS + Whonix.

Encrypted storage: The key to protecting our data

Encrypted storage is mandatory. The operating system constantly generates temporary files, logs, swap, and hibernation files that can reveal our activities even if we deleted the main files. Without full disk encryption, anyone with physical access to the machine can extract this data.

Always use open-source encryption software, where the code can be verified by the community. For Windows systems, the classic choice is VeraCrypt, while for Linux users, the standard of reference is dm-crypt/LUKS.

Mobile Security: Fortifying the smartphone

• Avoid iPhones: Despite Apple's marketing on privacy, the iOS ecosystem is completely closed and proprietary. We cannot know what is collected in the background, we cannot verify the code, and we cannot obtain root privileges to control the system. Additionally, the device is tightly bound to iCloud services.
• Beware of generic ROMs: ROMs like LineageOS seem attractive for privacy, but they often require leaving the phone's bootloader unlocked. This leaves the device vulnerable to physical forensics tools (like Cellebrite), which can extract all data bypassing encryption if they have physical access to the device.
• The sovereign choice: GrapheneOS: For the highest level of privacy and security, install GrapheneOS (available on Google Pixel devices, model 6 and up). This setup offers excellent encryption and hardware resistant to forensic attacks. If we are on a tight budget, buy a used Pixel device (paid in cash) and make sure never to insert a SIM card previously registered in our name.

Secure Messengers and Email: Protecting conversations

To exchange messages, use applications like Signal (or its advanced fork Molly), Session, or federated XMPP systems that offer end-to-end encryption (with OTR or OMEMO) and can run under the Tor network (onion service).

If you are still using Gmail, Outlook, or similar for confidential communications, stop immediately: they are a disaster for privacy. Move to security-oriented email services that do not require personal data, such as TorBox, cock.li, or morke.org.

And remember: PGP is our friend. Learn it, use it, live it.

Warning: Beware of proprietary services that promise "perfect security" or ready-to-use super-encrypted phones (like the old Encrochat, Anom, or Phantom Secure). Many of these turned out to be "honeypots" (traps) created or operated by law enforcement to intercept criminals. Rely only on open-source, decentralized, and widely audited solutions.

VPNs: Safe, but don't trust blindly

Commercial VPN services are advertised as the panacea for all privacy ills. It's mostly marketing. A VPN encrypts traffic between us and their server, but the VPN provider still sees all of our outbound traffic. How can we be sure they don't keep logs, even if they claim otherwise?

If we really must choose one, verify these conditions:

• Real No-Logs Policy: It must have been verified by independent audits or actual court cases.
• Anonymous Payment: They must accept payments in Monero (XMR) without requiring personal emails (like Mullvad does).
• Avoid free VPNs: They sell our data to maintain themselves.

If we want real control, we can rent a VPS in a non-cooperative jurisdiction (like Russia) and configure our personal VPN server, so we are the only ones managing the logs and security of the infrastructure.

Important: Remember that our internet service provider (ISP) won't see what we do, but they will still know we are connected to a VPN. If we need absolute anonymity and state-level security, consider VPNs useless or harmful. Use VPNs for daily browsing, but switch to Tor/Whonix when the stakes get high.

Network Security

Our home network is the backroom of our digital life. If it is compromised, we are done.

• Eliminate ISP routers: Routers provided by phone companies are full of backdoors, poor firmware, and unpatched vulnerabilities. Replace them with a device that supports open-source firmware (like a GL.iNet router or a board configured with OpenWRT), flashed manually from a trusted offline machine. Disable any automatic updates not controlled by us.
• Configure OpenWRT or OPNsense firmware: Change default credentials immediately. Disable remote management and access to the admin panel from the WAN port.
• Isolate IoT devices: Smart TVs, voice assistants, smart thermostats, and cameras are spies disguised as appliances. They constantly communicate with external cloud servers. Configure a VLAN (Virtual LAN) dedicated exclusively to these gadgets, separating them completely from our main work network.
• Configure the firewall: Apply a restrictive policy. Block all outbound traffic by default, authorizing only strictly necessary services and ports.
• Monitor traffic: Learn to use tools like Wireshark, Suricata, or Zeek. If we notice suspicious connections to unknown servers or unauthorized foreign data centers, cut the connection immediately.
• Secure DNS resolution: Avoid Google (8.8.8.8) or Cloudflare (1.1.1.1) DNS, which record our browsing history. Use privacy-respecting services like Quad9 (9.9.9.9), Mullvad DNS (194.242.2.2), or configure a local recursive server like Unbound. Encrypt DNS queries via DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT).
• Physical cabling: Wi-Fi is insecure by definition. If we seek the highest level of security, use Ethernet cables. If we must use Wi-Fi, configure WPA3 security at a minimum, use an SSID (network name) composed of random characters, and absolutely disable WPS (Wi-Fi Protected Setup), which is a factory backdoor.

Tor and I2P

If we need network-level anonymity, we must use Tor or I2P. But keep in mind that they are not magic:

• Timing correlation attacks: If a powerful adversary (like a government agency) controls both the entry and exit nodes of the Tor network we are using, they can analyze packet timings and trace our identity.
• Malicious nodes: Many exit nodes are run by security agencies or researchers to analyze transit traffic. Never transmit cleartext data over the Tor network.
• Browser configuration: Always disable JavaScript (JS) in the Tor browser to prevent exploits that could reveal your true IP address.

Metadata and Digital Signatures in Images

When we take and share a photo, we are not just sending pixels. We are sending a mountain of invisible information:

1. EXIF Data

EXIF (Exchangeable Image File Format) metadata is embedded in image files and contains information about the camera model, shooting settings (aperture, exposure time, ISO), and often the exact GPS coordinates of where the photo was taken. Always remove EXIF data before posting any image online.

2. Sensor Noise (PRNU)

Every camera sensor has unique microscopic imperfections in the silicon. This creates a digital noise pattern invisible to the eye but detectable via forensic algorithms. This pattern acts as a camera "fingerprint". If we publish many photos taken with the same phone, an analyst can link them all to the same physical sensor.

3. Quantization Tables

JPEG files use quantization tables to compress the image. These tables vary depending on the editing software or camera model used to save the file. By analyzing these tables, experts can tell which program (or device brand) generated the image, exposing attempts to disguise it.

Physical OPSEC

Digital security crumbles miserably if our physical security leaks.

1. The "Hacker's Den" (Secure Workspace)

Create a dedicated, inaccessible space for our sensitive activities.

• Desktop computer: Use a dedicated machine that never leaves that room. Remove the battery if it is a laptop to make it a purely stationary device, preventing it from being lost or seized during travel.
• Emergency shutdown: Install a rapid switch (kill switch) to cut off electrical power instantly, forcing encryption in case of emergency.
• Signal isolation: Use Faraday cages or shielded bags to store phones or wireless devices when not in use, preventing location tracking or remote attacks.
• Controlled access: Prevent anyone from accessing the room. Use white noise generators to prevent passive acoustic eavesdropping.
• No crossing of worlds: Do not use devices in this space for personal or daily activities.

2. Always shut down devices

Full disk encryption is useless if the computer is left on or in sleep mode. In that state, the decryption keys are stored in the RAM memory and can be extracted via physical attacks (such as a cold boot attack). Always shut down the machine completely when not in use.

3. Be invisible

When moving around, avoid flashy clothes, brand logos, or memorable accessories. Dress neutrally to blend into the crowd. Anonymity starts with being forgotten.

4. GPS and Public Wi-Fi: Forbidden Zones

Always disable GPS location on our devices. Avoid connecting to public or unknown Wi-Fi networks: they are the preferred grounds for Man-in-the-Middle (MitM) attacks and data interception.

5. Cell Phone Triangulation

The phone network tracks our location by comparing the phone's distance from cell towers:

• One tower: The operator knows which macro-circular area we are in relative to the antenna.
• Two towers: The intersection narrows the field to two possible areas.
• Three towers: Trilateralization pinpoints our exact position with extreme precision.

In cities, this system can locate us within a few meters. To avoid this tracking, store the phone in a shielded Faraday pouch or, better yet, leave it turned off at home before performing confidential operations.

6. Encrypted Storage on the Move

If we must transport data on USB sticks or portable drives:

• Use supports equipped with loops to secure them to the wrist or inside the jacket.
• Connect devices using short, fragile cables that can be torn or destroyed quickly in case of need.
• Always encrypt everything with VeraCrypt or LUKS.

7. Confusing Facial Recognition

In video-surveyed areas, wear dark non-reflective sunglasses, hats with pulled-down visors, or scarves with geometric patterns to confuse biometric tracking systems. Avoid excessively bizarre disguises that would have the opposite effect of getting you noticed.

8. Public Transport vs Private Vehicles

To move around, prefer public transport to owned vehicles. Private cars are constantly tracked by highway license plate readers (tutors) and city cameras. Always pay for tickets in cash so as not to leave bank traces.

9. Emergency and Escape Protocols

• Self-destruct button (Kill Switch): Configure quick scripts to close all active sessions and unmount encrypted volumes instantly.
• Evacuation plans: Plan escape routes and identify safe places to seek refuge if our physical security is compromised.
• Abandoning devices: If we believe we are being followed, turn off and abandon all our phones. Many modern devices continue to transmit location signals even when "turned off".

Psychological Defense Against Social Engineering

Social engineering is not a movie legend. Security agencies and private investigators use it regularly: from fake car accidents to false emergency notifications to flush us out. Manipulation and strategic distrust are tools of survival.

1. Social Engineering in Real Life

• False emergencies: Simulated car accidents, sudden visits by fake agents, or urgent calls from colleagues, neighbors, or maintenance workers to push us into hasty actions.
• Physical infiltration: Fake couriers, internet network technicians, or cleaning staff trying to access our workspace.
• Honeytrap: Fictional attractive profiles online that spend months building a relationship of trust with us only to gather information.
• Quid Pro Quo: People offering seemingly disinterested help to make you feel indebted and push you to reciprocate with confidential information.

2. The Paranoid Mindset

• Machiavellian caution: Consider trust as an exploitable vulnerability. Assume every unexpected interaction is an exploit attempt.
• Compartmentalization: Never talk about work or confidential activities with friends or family. They cannot reveal secrets they do not know.

The Glitter Nail Polish Trick (Physical Tampering)

If we want to protect the physical integrity of our devices (like the screws on the bottom of our laptop) to notice if someone opened them without our knowledge while we were away, use this cheap and effective method:

1. Buy some clear nail polish containing glitter.
2. Apply a small amount of polish over the laptop's fixing screws, covering them.
3. Take high-resolution photos from different angles once the polish has dried.
4. The glitter suspended in the clear polish will settle in a completely random and unique three-dimensional structure, impossible to replicate.
5. If someone unscrews the laptop to install a hardware keylogger (a physical keylogger) and tries to reapply polish, the arrangement of the glitter will never match our original photos.

Credits

• Original Author: Zycher
• Official Website: https://whos-zycher.github.io/opsec-guide/
• GitHub Repository: https://github.com/whos-zycher/opsec-guide
• Support the Author:
  • XMR: 84h9GeLKqoTXZMDBPysNs4Dbu1tqR9dtz3kAkLBguUPFF9BCGVQQBmr4Dr4aCqXm6KinwUS99GMxj86DALubVH27TvN7erA
  • BTC: bc1q6n2kdjh2p4h2chmp7uj3937c8pcxd846d8hgnnp68vfh92dn03pqkw4vd9

[May the Talpone be with you]

Discussion & Support

Discussion and support channel. To discuss configurations or other topics, join us on fluxer.dreadful.work.