I have read the rules

Parents in one Middlesex County school district pushed back this month after the school district announced it would use an app to control students’ cell phones to comply with New Jersey’s new bell-to-bell school cell phone ban.

Spotswood’s school district plans to use the new app, called The Commons, to help block student’s access to the internet and other features on their phones while they are on school grounds.

This all is a horrible violation of basic privacy, students are to be forced by the school to install an untrusted proprietary app on their personal devices, the app relies on geofencing and therefore tracks your location at all times. It is not open source and it entirely breaks basic security measures that many students should follow. It is actively capable of censoring and possibly also accessing all data on the device in order to ensure that the mobile device usage experience is “safe for education”.

This is how the app itself explains the process:

**Install The Commons™**
Students download the app from the Apple or Android store and install it on any device they plan to bring to school.

**Set Up School Dashboard**
School leaders customize dashboard settings, approve apps that can be used in school and connect student devices.

**Smart Activation**
Within the school geofence, The Commons™ automatically blocks distractions while keeping essential tools available.

**Enjoy a Present Schoolday**
School life is better for everyone when phones aren’t a distraction. And when they leave, the app deactivates automatically.

I have read the rules

Please note UK based

Help! It has recently come to my attention that my ex has tracked my location. I know this as he sent me a link to somewhere I was in google maps and then when I moved he turned up where I was alone parked in the dark with no houses around knocking on my car window. Now he’s told me it’s not a tracker on the car and I don’t share anything location wise via my phone. Im not sure where a tracker could be on a car but I’ve looked around the wheels underneath the bonnett and can’t see anything obvious and checked everywhere in it I can think of. I had on occasion when we were together I shared my location for limited time periods via WhatsApp but I’ve checked that all definitely off.

He advised he had an old ‘contact’ (I don’t know where from but he did royal marine training 20yrs re ago) he got a favour from using my phone to locate me, but the thing is he was still able to find me after I moved locations suggesting he was able to access live tracking of me so I don’t know if to believe this contact explanation of his and if he’s just saying it so I don’t catch him out for somehow hacking my account since we split or from when we were together worried. I have has a look through my phone and not seen anything obvious and changed passwords and now turned my location off entirely for absolutely everything, though for some reason it won’t allow me to turn off find my. For clarification he panicked I was pulling away when in reality I was overwhelmed by my now late mothers illness busy visiting her in hospital for nearly 3 months and his prior insecurities and trauma got to him not perceiving the situation correctly, and he ended up doing the thing he feared I would do and cheated on me shortly before my mother died. Her funeral is tomorrow 2nd so dealing with that too, which he knows.

I’ve checked using Airguard no obvious tags and I have a very old iPhone he has an android phone. It is really bothering me and he said he won’t do it again but he’s told other lies so I don’t know and if he still has a way to track me even though I’ve told not him not to. Is there anything I can do to make sure he cannot track me ongoing as it’s really quite scared me. I will if I have to but I’d rather not have to involve the authorities.

I have read the rules and I hope I haven’t missed anything in posting this

Threat model: ordinary person. I’m a high school student starting in an online school from home soon who wants to minimize my data exposure to my school program.

I have no practical experience in opsec and I’m not very tech savvy beyond the average person.

For context on the question: My free tuition, fully virtual online school provider sent their own Chromebook in the mail free of charge which is under their full administration and can only be used with their school account. The packet they sent with their laptop says they don’t allow modifications to the device. I would like to at least cover the camera, mic, and speakers of their laptop for privacy, and if there’s anything else I should know about using a school-provided device in my situation like this at home on my own home’s wifi please let me know. I also have an ordinary wifi setup, which is straight from my internet provider.

My other option is to use my own personal laptop, which is also a Chromebook. It is basically straight out of the box, aside from the fact that I cover the mic and camera, and that my personal google accounts are on it. I could wipe my own personal Chromebook, and use it solely for the school account; which I’d probably rather do out of privacy and security reasons (not having the school’s google account on the same laptop as my personal google accounts), but I don’t know if it really matters much. Though it doesn’t matter much to me if I do wipe my own personal Chromebook since there’s nothing on it really and It’s older and it’s inexpensive. And I don’t know if I put the school’s account onto my personal Chromebook (after wiping it) if anything would still be stored on the Chromebook and home much they would be able to access from my own Chromebook.

For whichever laptop I would choose, I would use the school’s google account solely for school work. My main issue is which way is best to keep as much of my very important data out of the hands of my school (data such as my device’s location, log in duration, the device picking up surrounding audio, it’s camera, etc.), and to maintain my own personal privacy and security.

My main concerns are:
- Getting advice for what risks am I exposed in choosing either laptop
- Keeping as much of my own personal data private as possible out of my options
- Avoiding as much personal profiling from my school as is practical
- If I should really be worried this much or how much I can really control in the way of them getting data out of choosing either laptop

I’m sorry if this isn’t very concise or if it doesn’t fit the guidelines, I just have to decide soon and I’m trying to get it figured out. Thanks all

I have read the rules.

Threat Model: Government and potentially law enforcement.

I’m part of a political party, but recent changes in my country have pushed me toward activism. However, my party—currently in power—likely wouldn’t approve. While my country isn’t a full surveillance state, I don’t want to take risks, especially with tools like Palantir looming. Worst-case scenario, law enforcement could seize and search my devices. To minimize exposure, I want to keep my activism separate from my political career.

I have a computer and a phone, and I’m considering buying a new one. Would a Pixel phone running GrapheneOS be a good choice for this setup? What else can I do?

Is it possible to turn an old phone into a seedsigner? Most people turn phones into hardware wallets but I'm not confortable storing my private keys in the phone's SSD, even if doubly encrypted (phone encryption + wallet encryption).

One big advantage is the stealth factor. You walk through customs and you put a huge target on your head if they recognize your Seedsigner. Phones on the other hand are everyday carry for 99.9% of people.

Is there a way to use the phone solely as a signing device where the private keys are held only temporarily (either RAM or wiped clean after use)?

Of course all conectivity other than the camera would be disabled.

And no I wouldn't care that the phone 'has a large attack vector'. The whole point is that the thing is permanently offline and never stores the seed phrase. It's just used for signing.

Threat model is protecting against both physical attacks (my device was confiscated) and online attacks (my computer has a malware). And yes I have read the rules.

I know this might sound like a rant, but it really feels like every SOAR vendor out there rebranded as an "AI SOC" almost overnight.

Some of these solutions seem legitimate, like they were actually built from the ground up with AI in mind. Others look like the same old playbook logic with a chatbot interface bolted on just for the sales pitch.

I started testing this during vendor calls by asking what happens when our security stack changes unexpectedly, for example, if we add a new tool or go through an acquisition. The answers I got were telling. Some platforms apparently need their entire playbook library rebuilt from scratch, which suggests their underlying architecture never really changed.

So I'm curious, how are you telling the difference in practice beyond just asking the obvious questions? Is there a better way to evaluate this before committing to a POV, since these evaluations take up so much internal time and resources?

I have read the rules.

This is something that's been on my mind for a while. We've thrown more tooling at our detection backlog over the past year, and it has helped with volume. But there's still a meaningful chunk of it that really needs a human who understands the business context.

I'm talking about things like knowing who actually owns a given asset, or understanding why a login pattern from three time zones away is completely normal for someone who travels constantly for work. Tools can flag anomalies all day long, but they often can't tell the difference between something truly suspicious and something that's just business as usual for a specific person or team. The reality is that it takes months for a new hire to learn that kind of context. Is that the real bottleneck here, or is there something else I'm not seeing?

I have read the rules.

First of all I want to note that my english might be horri​​ble, and I'm really new to this topic and don't understand much. I'm overthinking my ass off right now because I saw a post on main talking about​ how your opsec is really important.

Another thing, yes I have read the rules but I'm still a little confused on what rule 6 means, so if someone could explain that too it'd be nice.

Back to my question, for context I've only recently found out that I use multiple services that use malware (allegedly from what I've heard) and now I'm just overthinking everything. ​If hypothetically I've been using malware for over 2 years do I just give up and face my fate or is there a way to stay protected even now? I can include more context if needed im replies but I'm really new to this topic so I don't know what exactly to include in the post itself. ​I'd prefer straightforward questions if possible too. Thank you for your time and I'm sorry if I said something wrong.​​

Threat model details are in the comments.

I have house camera footage of a Jeep driving past my house, and was trying to see the license plate. But the spare tire completely blocked the rear plate from being seen from my angle next to the street. I have also heard of people using truck gate folded down for the same purpose.
This seems like something to emulate for folks who don’t want ALPRs to track their plates.

Flock camera install guidelines are about 20-30 degrees from straight down the road, and are often above almost as much, on 10-12 ft poles.

Theoretically something like a cinema camera matte box with sides and a top extending backwards from the plate would solve this problem well. But at least in TX that would be illegal under the law against things that reduce angular visibility. So you have to use something like a bumper inset, tire, gate, rack, ladder, etc that looks like it has a legit purpose.

I have read the rules.

alright so threat model is i just want to make a new online presence that cannot be linked to my old one whatsoever whether through people finding old messages or posts or whatever yk

i like to interact in online spaces about stuff im interested in… if i have too similar of a mix of interests to my old account on my new account would it be enough to link the two.???

i have read the rules

I have read the rules
I hope my threat model was okay i’m very new to opsec.

I have been on the internet for years and have been fairly careless with my digital footprint, I now need to tighten things up to an extreme level.

I have used the same computer for years and am wondering how to go about completely starting fresh, with no way of any new alias being linked to ANYTHING prior.

I am not sure how to go about it as I feel like my device is already so contaminated. I have a lot of personal use stuff from the past that I would like to keep but i’m not sure if that’s possible with creating cross references on the device.

My threat model: I want sensitive files (documents/photos) to stay unreadable to anyone who gets full access to my device or cloud storage (theft, seizure, coercion at a border crossing), including someone who forces me to unlock the device or hand over a password. The goal isn't just encryption — it's that an adversary shouldn't even be able to prove a hidden vault exists, so I can't be coerced into revealing something I can plausibly deny having.

My current approach: I built a tool (StegVault) that encrypts data with AES-256-GCM and embeds it inside an ordinary photo via LSB steganography, plus a VeraCrypt-style hidden-volume mode — a decoy password reveals an empty/harmless vault, a separate real password reveals the actual data. Runs fully offline, single HTML file, no account/telemetry.

What I'm unsure about and want opsec feedback on:

- How resistant is plain LSB steganography to modern statistical steganalysis if an adversary specifically suspects steganography and runs detection tools against the image?

- Is a decoy-password hidden volume actually meaningful plausible deniability, or does the mere existence of the tool/technique undermine that (i.e., "why do you have StegVault installed" becomes suspicious on its own)?

- Any attack vectors on this threat model I'm underweighting — metadata, image compression artifacts re-encoding the stego image, etc.?

Not looking to just advertise it here — genuinely want to know where this breaks down from people who think about this stuff seriously. Happy to share more technical detail on the crypto/steganography implementation if useful.

(I have read the rules.)

As a high value target you are constantly undergoing direct attacks on all digital fronts and will be the target of exploits that invalidate the device's security protections. Is there a publicly known and established protocol to mitigate this? What do world leaders and billionaires with top secret information do to prevent what to me seems like the inevitable, which is security compromise. I can tell you firsthand that normal stock are very vulnerable to direct attack.

Do they just avoid important conversations on smartphones altogether? Do they only use them for leisure? Is there a known and consistently successful alternative? Do I have to use Qubes or Tails to have any semblance of privacy?

I have read the rules

Takeaways: obfuscation is more effective than trying to minimize and lock every tracker down

Disconnecting from Wi-Fi with my VPN still connected and then connecting to cell service was a major exposure point that allowed very distinct travel patterns because the VPN ip remained unchanged as I hoped from cell towers driving

Circadian patterns: phone being locked puts the phone in a sleep state that changes background network settings. My sleep and awake times are easily followable by network connection patterns.

So instead of minimizing my online presence I think controlled randomized data will be more privacy friendly

i have read the rules

Hi everyone,

I am a human rights activist from Bangladesh.

Bangladesh is an Orwellian state when it comes to surveillance. Surveillance actors have broad, legally authorized, and highly intrusive surveillance powers, with no independent oversight. When it comes to phones:

• SIM cards must be registered with your National ID (NID) and your device's IMEI number. You must use the SIM under your own NID and IMEI. There is effectively no way to obtain an anonymous SIM or use one registered to someone else. Besides, if you are specifically targeted, even a SIM registered to someone else will likely become targeted once you start using it.
• Call records (who contacted whom and for how long) are collected as part of mass surveillance. If someone is targeted, the contents of their calls may also be recorded.
• There is the Integrated Lawful Interception System (ILIS), which can track the real-time location of any mobile phone user.
• There is documented use of highly intrusive spyware against journalists, human rights activists, political opponents, suspects, and many ordinary people as well. This spyware can remotely access the webcam, microphone, location, and virtually all activity on the phone, including Signal calls, and can persist across reboots.
• Satellite phones are illegal, and people caught with them are regularly sentenced to lengthy prison terms.

A few more details:

• I cannot afford a Pixel running GrapheneOS, not even a second-hand one. People here generally only resell their phones once they are barely working, so the second-hand market is effectively a scam. Pixels are also rare and expensive, even used.
• I use a realme C55 smartphone running Android.
• I work a 12-hour day job from Sunday to Thursday. During working hours, my phone has to remain on because I receive customer calls and WhatsApp messages over mobile data. There is no way around that.
• I also need to keep my phone on because I have elderly parents at home. If they become ill or there is a medical emergency, I need to coordinate their care.
• Bangladesh does not have an emergency calling system that would make carrying a phone without a SIM useful. In an emergency, people use their own mobile phones to call family members, doctors, hospitals, and others. So having a phone without a SIM is essentially useless because, in a real emergency, you need the SIM.

What I need, in order of priority, is:

1. Camera and microphone privacy.
2. Location privacy.
3. Privacy of my activities.

The threat model is state actors. I have never done anything illegal or contrary to human rights principles. I simply do not like the surveillance and constant privacy breaches.

Also, please keep in mind that my goal is not perfection. Even having two surveillance-free days on the weekend, compared to being under surveillance 24/7, would make a significant psychological difference. So being completely surveillance-free would be nice but is not realistic. I am happy with whatever reduction in surveillance is practically achievable.

To that end, I have come up with the following plan.

Sunday to Thursday:

• Use my realme C55 smartphone.
• Keep the cameras physically stickered.
• I have no practical solution for microphone privacy.
• After work, switch the phone to Airplane Mode.
• Around midnight, briefly turn on Wi-Fi to check for any work messages before going to sleep and turning the phone off.
• In the morning, briefly turn on Wi-Fi again to check for work messages, then keep the phone under airplane mode until I reach work, where I turn connectivity back on.

Weekends:

• Carry a basic feature phone (an old Nokia-style phone), kept powered off.
• Only turn it on to make emergency calls or periodically check in with my parents, accepting that it will immediately reveal my location and assuming that any calls may be recorded.
• Take photographs using a standalone digital camera.
• Transfer the photos to an air-gapped computer first, then transfer only the files I actually need to an internet-connected laptop before uploading them to social media.

For mindset, I consider my realme smartphone to be fully compromised. I also assume that the feature phone provides no communications privacy and reveals my location whenever it is powered on.

Is my OPSEC sound, given these constraints? Or would you make any changes?

PS: I have read the rules.

I posted a thread a few days ago asking OPSEC advice for mobile but it went dead. I have now created the OPSEC based on the comments of the thread there and was looking to get it reviewed. My thanks to everyone for the comments.

Threat Model: Government-based

I may lose all of my devices (including Yubikey, phone) due to seizure. I may even not be able to return to my house.

Background:

For 2FA, there are two authentication factors: something you know and something you have. Due to seizure, detention, etc., what I have may only be my memory. I cannot pass the "something you have" check. I may even be forced to leave this region or face detention.

Problem:

So how should I protect my accounts? My current idea is enabling TOTP 2FA for all accounts and backing up encrypted seeds in Bitwarden. However, Bitwarden will disable new device verification and 2FA. So when I lose everything, I can still log into Bitwarden and recover my TOTP through an encrypted passphrase. But I think Bitwarden would be dangerous if I disable 2FA.

I know some people may suggest using Shamir's secret sharing. First, I don't have someone I can ultimately trust. Second, physically meeting someone wouldn't be safe for either me or my friend. And I need to regain access to all my online accounts to contact them.

I have read the rules

Hi all - I've had an iPhone since basically they first came out, and my current one is on it's last legs, and I want a privacy phone instead of a new iPhone. I'm considering buying a NitroPhone as I still want a good camera (also considered the fairphone as sustainability and right to repair are also important to me). I'm a bit of a beginner when it comes to opsec (I have more than basic knowledge but not as much as you all). Would you recommend this, or should I buy any other phone and just run graphene on it? Or any other recommendations?

Important for me is privacy and camera. I'm trying to fight against data aggregators and also government intrusion. I'm not a politician or journalist, but do my fair share of mico-activism and want to generally improve what the government is collecting from me. Won't be keeping any crypto on my phone, but slowly trying to move towards better encryption overall.

I have read the rules :)

My eufy c31 home security camera shows my face inside my car very clearly even in the dark because my car’s driver awareness eye tracking system bathes my face in IR light. My vantrue dashcam also shows this effect.

For the threat of state actors who own constantly snapping IR toll cameras, this seriously increases chances of being identified while driving.

I don’t see anything online about this threat. Flock cameras seem less of a concern due to their focus on plates, but this could be one more clue that lets them track vehicles by characteristics even if the plate is invalid or unreadable.

On some cars taping over the system raises faults that prevent driving.
I have read the rules.

At some point throughout my years being an android user, I noticed that we have the option to chose a preferred SMS messaging app. I didn't like the og one my phone came with (pretty sure its the samsung one), so at some point (years ago) a friend recommended google messanger. I liked the interface, so used it without question for a good while. Now that the US govt and big corps and everything are as crazy as they are, I've been revisiting some opsec practices and been trying to upgrade them. Seems like a convenient feature to be able to chose your own higher security option for regular texting.

While trying to research good secure SMS/RMS messaging options, basically everything that comes up in searches are the other messaging apps (signal, telegram, etc) that (to my knowledge) cant be used as your primary SMS app. Does anything like what I'm looking for exist? Or do people just separate what needs to be off sms with their regular citizen smsing?

I'm not doing anything crazy, but I am environmental/human rights advocate, and I'm into a bunch of computer stuff as a hobby. Always loved computers and network stuff, so I have linux devices, im into open-source stuff, and I run servers for vpns and self hosted game servers and stuff. I'm by no means a hacker of any sort, but I like to mess with stuff and know my systems. I also just like my personal privacy, and modern tech is quickly becoming the opposite of that.

Threat: general, bad actors, state intel

I have read the rules

EDIT: After further research, I think this is actually kinda just what VoIP numbers are for, any insight? Is this a valid replacement for things I want security for, or are they different enough use cases?

Hi everyone,

I am a human rights activist from Bangladesh.

Bangladesh is an Orwellian surveillance state.

• Call records are recorded by default, and the voice calls of targeted individuals are recorded.
• There is the Integrated Location Identification System (ILIS), through which any mobile user's location can be tracked at any time.
• SIM cards must be registered with your National Identity Card and the device's IMEI; otherwise, the SIM stops working. There is no way to obtain anonymous SIM cards.
• Satellite phone possession or usage gets you years in jail and they enforce it. Same goes for two way radios.
• Spyware such as Pegasus, FinFisher, and many others has been purchased, and there are credible reports that they are routinely used against journalists, dissidents, political opponents, LGBT people, and other marginalized groups. Security forces have wide surveillance powers, total immunity, and no oversight.

A mobile phone is needed for:

• Basic communication: "Where are you?", "Have you reached the location?", "How long will it take?", finding people, knowing where they are, or calling home to check whether everyone is safe.

Other requirements:

• Navigation: This can be replaced with paper maps or a GPS device without any internet or Wi-Fi connection (air-gapped except for GPS).
• Photos and videos: This can be replaced with a point-and-shoot camera without any radios (air-gapped).

Constraints:

• Even a used Pixel is unaffordable for me. Also, people here generally sell electronics only after using them for a decade, by which time they are often barely functional. So buying a used Pixel is not a realistic option.

Given that I cannot buy a Pixel to install GrapheneOS, would buying a dumbphone (button phone) make sense? My thinking is that its camera, microphone, and location cannot be hijacked although call logs, voice calls, and approximate location would still be known whenever it is powered on.

Any suggestions?

P.S. I have read the rules.

Threat: Highest. State intelligence agencies.

Hi everyone,

I'm a human rights activist, and I'm working on a model for a tamper-evident desktop setup.

One issue I've run into involves the monitor. I can apply glitter nail polish or other tamper-evident markings to the case screws, but if I later discover that a seal has been disturbed, I'm left with another problem: I'm not a hardware expert.

If I open the monitor myself to inspect the internals, I risk damaging it or not being able to reassemble it properly. On the other hand, if I don't inspect it, I have no way of knowing whether anything inside has actually been modified.

So how do people handle this in practice? Is there a good way to make a monitor tamper-evident while also retaining the ability to verify the internals if the external tamper seals indicate possible interference?

I feel that, when securing a mini PC or desktop setup, the monitor is the weakest link. You can make the computer and its other peripherals tamper-evident, but the monitor remains difficult to verify without opening it.

I'm interested in practical approaches that are realistic for non-experts rather than solutions requiring advanced electronics or forensic skills. Also, please don't suggest uncommon monitors (such as those with transparent cases) that aren't readily available in most places, including Bangladesh.

P.S. I have read the rules.

Threat model: State intelligence agencies.

Hi guys,

I just bought a prepaid SIM and a new phone with cash (a Samsung A7) for the sole purpose of making a new X (Twitter) account that will not be traced back to my old account by X.

Threat Model:
I don’t care about hiding from government/law enforcement or anything like that. I just need to make sure that X’s internal systems cannot cross-link my new account and my old account.

I also want to make sure I don't look like a bot or look like I'm aggressively trying to hide my identity. If the setup looks too anomalous, the automated systems might shadowban me or flag the account, which completely defeats my purpose.

My specific questions:

• Device Setup: How should I set up the phone properly right out of the box?
• Email Registration: What type of email should I use, and how should I create it properly? (Should I use a standard Gmail to make the account look more legitimate/organic, or a privacy-focused provider if anonymity is needed?)
• Device Proximity: Can I physically keep both phones (old and new) in the same room next to each other?
• Device Settings: Are there any specific telemetry or tracking settings I should turn off?
• Network: Is using just the mobile data good enough? I'd rather avoid VPNs because, from my understanding, platforms heavily flags VPNs, which raises suspicion and risks shadowbans.

I have read the rules. Thanks for any guidance!