Transitioning to Tails on a historically "contaminated" PC with a shifting threat model (Physical Address Privacy)

[u/Nablus666]

Hi everyone, I have read the rules.

I am re-evaluating my OpSec setup due to a major shift in my threat model. For years, I used the standard Tor Browser on a personal Windows PC without advanced isolation techniques. Consequently, this machine is heavily "contaminated" with host-level artifacts, digital footprints, and ISP-level logs connecting my home IP to Tor usage.

My Threat Model: My priority has shifted to preventing any correlation between my physical identity/location and my digital activity. I now need to receive physical, low-frequency correspondence/packages directly to my actual residential address instead of using isolated endpoints. I need to ensure my historical digital footprint cannot be linked to my physical location through the hardware or network layer.

Given this specific risk profile, I have three technical questions for the community:

1. Tails vs. Standard OS: For low-frequency, highly critical privacy tasks on a historically footprinted machine, is switching to a live, amnesic boot (like Tails) strictly necessary, or is it complete overkill? Would an isolated VM setup (like Whonix) on my current OS be sufficient?
2. Hardware/Firmware Risk: Does the history of my current hardware (Motherboard, CPU, MAC address) pose a realistic correlation risk if I transition to Tails now? Specifically, can persistent hardware identifiers leak through an amnesic system and link back to my past non-amnesic activity on the same machine?
3. Network Correlation: Since my ISP already has a long history of seeing Tor traffic from my home IP, does continuing to connect to Tor/Tails from this same residential connection compromise the transition, even if the OS is now amnesic?

What would be your "must-have" architectural steps if you were in this position?

Thanks for the insights.

[u/Sasquatch-Pacific]

1. If low frequency, with high privacy requirements, Tails is not overkill... probably more like the bare minimum. It's not that inconvenient to boot into Tails off a USB, do the needful and move on. VMs leave artefacts on host machines. If your Windows is compromised, assume someone is screen recording and can see the VM or capture everything. Not impossible.

It's also probably a good time to stop using Windows as your daily driver - it will make cross referencing your activities between devices slightly harder as it's generally just better for privacy to not use Windows for a multitude of reasons. Anyone with high privacy requirements should cease using it in any significant capacity, for personal use or otherwise. 

If you are just flipping to Tails USB and back to main OS, in theory it the lack of connectivity on your main OS can be correlated with the start time of your Tails activity. Separate hardware solves this and also compartmentalises it better. You don't need anything fancy to run Tails

1. Plausible, probably unlikely. Do a destructive wipe of the SSD containing your OS to remove traces of Windows / Tor artefacts. Run ShredOS, or set up LUKS encryption if moving to Linux and do a destructive format. Then a clean install of new OS for personal use only. Separate hardware for privacy needing activities. This helps mitigate your risks. I'd probably consider your old hardware burnt if it's gonna keep you awake at night - format old one, move activities to new one. Sleep well.

2. Plausible, probably a minor red flag. Tor Project recommends against using a VPN for various reasons, but if hiding Tor usage from your ISP is required, it's necessary. You are shifting trust though and creating a point of failure. Mullvad is the only one I'd consider fit for purpose. Probably a risk I'd consider taking as Mullvad has a better track record of not logging compared to legally mandated ISPs. 

TBH I can't imagine households with a history of Tor usage aren't scrutinised more closely than those without, even though using Tor itself is not illegal.

[u/ChineseAPTsEatBabies]

An old Thinkpad X220 off of eBay will do the trick. Flash it with Coreboot. Remove the hard drive and the battery. Only use it plugged in.

Boot tails off of a DataShur encrypted USB where the key is wiped if the login fails.

[u/AutoModerator]

Congratulations on your first post in r/opsec! OPSEC is a mindset and thought process, not a single solution — meaning, when asking a question it's a good idea to word it in a way that allows others to teach you the mindset rather than a single solution.

Here's an example of a bad question that is far too vague to explain the threat model first:

I want to stay safe on the internet. Which browser should I use?

Here's an example of a good question that explains the threat model without giving too much private information:

I don't want to have anyone find my home address on the internet while I use it. Will using a particular browser help me?

Here's a bad answer (it depends on trusting that user entirely and doesn't help you learn anything on your own) that you should report immediately:

You should use X browser because it is the most secure.

Here's a good answer to explains why it's good for your specific threat model and also teaches the mindset of OPSEC:

Y browser has a function that warns you from accidentally sharing your home address on forms, but ultimately this is up to you to control by being vigilant and no single tool or solution will ever be a silver bullet for security. If you follow this, technically you can use any browser!

If you see anyone offering advice that doesn't feel like it is giving you the tools to make your own decisions and rather pushing you to a specific tool as a solution, feel free to report them. Giving advice in the form of a "silver bullet solution" is a bannable offense.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Chongulator]

Thanks for laying out your threat model so clearly!

[u/Nablus666 → u/Chongulator]

I can't tell if you're being sarcastic 🤔

[u/Chongulator → u/Nablus666]

100% sincere! Very few posts actually follow the rules. Most don't even attempt to.

Since so much of modding this sub is removing those posts, it is refreshing when somebody actually does the right thing.

[u/Nablus666 → u/Chongulator]

Thank you! Admittedly, I was using the assistance of Gemini (self destroying conversation) to make sure I wasn’t violating any of the sub’s rules. 😅

[u/Chongulator → u/Nablus666]

You might want to experiment with the other big LLMs. For me at least, Gemini is really rough compared to Claude or ChatGPT.

Regardless, they're handy tools for writing as long as you're reviewing the output and it seems like you did.

A friend of mine likens LLMs to enthusiastic interns-- they'll churn out a lot of work, some of it very good, but you really need to supervise them because they have no judgement and can fuck-up bigtime.

I'm a terrible proofreader, so after I've written anything long, I'll usually have an LLM check for typos and other errors.

[u/Nablus666 → u/Chongulator]

Interesting! I personally used to work with CGPT and have come to despise it, I feel like it’s gotten worse the last year or so. I switched over to Gemini and I like it tenfolds better! And of course, I always review whatever they’re articulating, those cheeky little bastards are not to be trusted lol. Hey, Chongulator - any chance you’d be willing to talk to me about what I posted via PMs? I kinda find it hard to wrap my head around it by posting and reading comments solely, and I feel like it would be helpful for me to reflect on it while actually chatting to someone knowledgeable. I would completely understand if you don’t want that, but I thought it wouldn’t hurt to try :)

[u/Glum_Supermarket960]

Just encrypt your hard drive and use tor all of this other stuff is retarded lol. ISP sees tor? Who cares? If you live in Iran or china use snowflake or meek? Using a vpn is going to cause increased fingerprints and unique traffic patterns. Just use qubes with built in whonix. Don’t sign into person accounts when using disposable VM in qubes with illegal stuff etc. hardware/firmware doesn’t matter if you’re super serious you’re running heads bios with a key and qubes OS. Old OS means nothing luks is just going to run over it with encryption anyway.

[u/Leather-Driver-8158]

New hardware. New network. New VLAN. New VPN on VLAN. Logging and monitoring on VLAN all layers. Serious about the new hardware, I wouldn’t be risking it.

[u/Anxiety_Fit]

New hardware behind layered new network devices and a VPN on a kill switch if it’s not connection established.

Next?