OPSEC Guide

[urasensei]

If you deal with pretty much anything controversial these days, it's extremely important to have good opsec. No matter how good and how agreeable your views are, there is someone out there that will not hesitate to dox you.

Basic shit​

One of the most obvious tips you should be following is to always use an alter ego seperate from your real identity. If you have been using the internet with the same identity for 5+ years between different communities, there is bound to be something that can lead to people gravedigging and finding embarrassing posts about you, or worse your personal information. Good practice should be to not use a name more than 2 times.

This should also be an obvious tip, but always use different emails! I will get to data breaches in this guide later, but use a different fucking email! You can follow the above tip, but it's completely worthless if you use the same email for all of your identities as they will have a single common link that will link all of them together. You can easily create new emails with Protonmail, Pissmail, uq.ci etc

This might be less obvious but use different passwords! I won't get into detail about how some hashing algorithms shouldn't be used for passwords, but some poorly written sites will store your password in plaintext. In an event of a data breach, anyone will be able to access your password in pure text form. Good websites hash your password (like this site that uses Xenforo which hashes your password) so that your raw unaltered password isn't exposed.

Personally Identifiable Information (PII)​

You should not be posting your personal information (fullname, home address, city, region) online. If you have to (like in your personal life) you should be doing that on your private identity that should not have any links to sites like these. If your full name is exposed, you're above 18 and you live in the United States where privacy laws are non existent they can have your home address, family history, phone numbers and voter records exposed through data broker sites.

You should reveal as little as possible about your real life. Specifying the country you live in will usually not be problematic (unless you live in a country where internet access is rare) but you should still exercise caution.

VPN​

VPNs are an essential to make sure that your identity is not linked to a single IP that only you have. Dynamic IPs may help with this but you still want to mitigate as much risk as possible in regards to this. VPNs will also protect you from IP grabbers as if you use a popular VPN service it could be literally anybody accessing the website. I know people that do not know the difference between a good and a bad VPN.

Avoid these VPNs!​

• Any free VPN - I know that many of you might not be able to afford a VPN, but a free VPN might harm you more than if you were to use your real IP. These "free" VPNs aren't actually free, and instead you pay with your data. Do you really wish that everything you do on the internet needs to be sold to advertisers and data brokers? Corporations ruin the internet enough as it is and you should absolutely never use free VPNs. ProtonVPN is probably your best bet if you want a "free" VPN but you should still use better VPNs if you really care about your OPSEC. For a free "VPN" you should be using Tor instead. (For sites that do not block you for using Tor)
• Sponsored VPNs (NordVPN, ExpressVPN, Surfshark, Tunnelbear) - These VPNs are shilled by YouTubers and you really shouldn't be trusting them as they're pretty damn corporate.

My recommendations​

• Mullvad - I can't recommend this enough. Registration does not require emails, password, name, address, ID, SSN, birth certificate etc! All you have is a string of numbers which you use to login. There is a plethora of payment options like cash, bank transfer, voucher, cryptocurrency and more. They were raided by Swedish police to find customer logs but they have found none.
• Tor - Not really a VPN, but a volunteer network with people hosting their own nodes. It is an absolute must for privacy and if you can't afford to use a VPN you can access controversial websites with Tor instead.

There are other VPNs that you could use like privateinternetaccess and TorGuard, but I haven't tested those yet.

Data breaches​

Any centralized service you use can suffer a data breach at any given time. You should always assume the site you are using will be hacked and all the information you put on it exposed for anybody to see. The more you use a single email and a single IP the more results there will be for the data breaches. There's no good way to avoid data breaches, but a good bet would be to use GDPR right to be forgotten laws to wipe your information completely off the database for any services you might not be using. This will help if the service suffers a breach in the future.

Operating System​

Any can work, but be wary that Windows is known for it's telemetry bullshit so if you're really paranoid you should use a Linux distrobution instead.