"OPSEC je jako šachy v reálném životě – každý krok musí být promyšlen a plánován, aby se předešlo úniku citlivých informací."
— The Opsec Bible
Pochopení OPSEC
OPSEC není jednorázová akce, ale a continuous process, which requires vigilance and adapting to ever-changing threats. It includes understanding potential attackers, identifying what needs to be protected and implementing appropriate measures.
Základní principy OPSEC:
Understanding the risk
Realizing that threats exist and can appear at any time.
Risk management
Identification, assessment and mitigation of potential risks.
Implementation of measures
Deployment of specific tools and procedures to reduce risks.
Check and adjust
Pravidelné kontroly a aktualizace OPSEC postupů.
Low threat
For regular users who want basic protection against:
- • Targeted advertising
- • Data collection by corporations
- • By regular online viewing
Basic settings adjustments are sufficient
High threat
For journalists, activists, whistleblowers facing:
- • State supervision
- • Targeted monitoring
- • Physical threats
Complete abandonment of mainstream services
Privacy
Soukromí zahrnuje ochranu osobních údajů před neoprávněným přístupem, použitím a sdílením. Je základním kamenem OPSEC.
Open-source software and hardware
- • Use open-source software so you can check what it's doing
- • Avoid closed-source software - it may contain backdoors
- • Use Linux with hardening tools (Kicksecure, Whonix)
Encryption
- • Encrypt communications and data with end-to-end encryption
- • UseAge a PGP/GPGfor encrypting files and messages
- • Encrypt entire drives withVeraCryptorLUX
DNS protection
- • Use DNS encryption (DoT, DoH, DNSCrypt) to protect against ISP snooping
- • Consider DNS over Tor for maximum privacy
- • Do not use your ISP's DNS
Virtual machines
- • Use VMs to separate different activities and increase security
- • WhonixQEMU VMs are recommended for anonymous use
- • Qubes OSfor maximum insulation
Password management
- • Use a password manager (KeePassXC, Bitwarden)
- • Generate strong, unique passwords (20+ characters)
- • Never use the same passwords for multiple accounts
- • Enable 2FA wherever possible
Secure file sharing
- • Share files securely withSyncthingvia VPN or Tor
- • Use for anonymous sharingOnionShare
- • Remove metadata from files before sharing
Front-end privacy
Use alternative front-ends for popular services:
Privacy risks
From insecure sources or misconfigured settings
Closed-source software may contain vulnerabilities
Unauthorized physical access to devices
ISP tracks activities without VPN or Tor
Anonymity(s)
Anonymity ensures that your identity and activities remain hidden. Unlike privacy (hiding content), anonymity hides who you are.
Tor Browser
- • Use Tor Browser to browse the web anonymously
- • Set the security level to"Safest"
- • Disable JavaScript for maximum security
- • Use bridges (obfs4, meek-azure, Snowflake) in censored countries
- • Never log into personal accounts through Tor
Anonymous virtual machines
- • UseWhonixQEMU VMs for anonymous use
- • Tails OSfor temporary sessions without tracks
- • Separate anonymous activities from the host system
Anonymous Finance
- • UseMonero (XMR)for anonymous financial transactions
- • Avoid centralized exchanges (CEX) requiring KYC
- • Consider Decentralized Exchanges (DEX) asHaven
- • For P2P exchange usebisqueorRetoSwap
Residential proxy
- • Get a residential proxy anonymously to access Tor blocking sites
- • Helps bypass geo-restrictions and censorship
- • Services likeThe VPN Mysteryoffer residential IP
Hidden Services (.onion)
- • Access .onion sites for better anonymity
- • UseSimpleXfor anonymous chats
- • Use anonymous emails (DNMX, Mörk)
Anonymity risks
WebRTC, DNS leaks, misconfigured Tor
Even encrypted content has visible metadata
Real-world activities reveal online identity
ISP can correlate connection times
Plausible Deniability
Deniability is the ability to deny any knowledge or participation in activities. It is crucial in sensitive activities and investigations.
Temporary systems
- • UseTails OSfor temporary, sensitive use
- • Tails can be run from USB and leaves no traces of use
- • All data is deleted on shutdown
Deniable encryption
- • UseVeraCryptto create hidden volumes for sensitive data
- • Outer volume contains innocent data, inner hidden volume contains sensitive data
- • Unable to prove the existence of a hidden volume
Steganography
- • Hide data in images or videos
- • Tools:Steghide, zuluCrypt
- • Allows sensitive information to be transmitted without arousing suspicion
Duress mechanisms
- • Set upduress PINfor quick data wipe (GrapheneOS)
- • Helps when you are forced to disclose data
- • Consider an app's "panic button" for emergency situations
Risks of rejection
Threat of violence or coercion to disclose data
Experts can recover deleted data
Forgetting duress mechanisms
Data loss before backup
Decentralization
Decentralization reduces dependence on centralized entities and increases resistance to censorship and control.
Decentralized finance
- • UseMonerofor anonymous transactions
- • Join P2P networks for exchange
- • Avoid KYC exchanges
Decentralized storage
- • UseNextcloud(self-hosted)
- • Syncthingfor P2P synchronization
- • Full control over your data
Decentralized networks
- • Get involved inThor a I2P
- • Run your own nodes or bridges
- • Support network resiliency
Open-source projects
- • Contribute to privacy projects
- • Help improve tools
- • Share knowledge with the community
Risks of decentralization
Security
Security includes protection against threats, attacks and unauthorized access to your systems and data.
Regular updates
- • Keep software and systems up to date
- • Patch known vulnerabilities as soon as possible
- • Use a package manager to manage updates
Firewall and network monitoring
- • UseOpenSnitchto monitor network traffic
- • Block unauthorized outgoing connections
- • Identify suspicious activities
Software Verification
- • Verify software integrity before installation
- • UsePGP signaturesto verify authenticity
- • Check hashes of downloaded files
Physical security
- • Protect physical devices from unauthorized access
- • Use locks for USB ports
- • Encrypt entire drives in case of theft
- • Consider a tamper-evident sticker on the device
Security risks
Unknown vulnerabilities exploited before patching
Backdoors and spyware
Phishing and human error attacks
Poorly configured systems are vulnerable
Rychlý OPSEC checklist
Basics
- Strong, unique passwords
- 2FA on all accounts
- Disk encryption
- Regular backups
Network
- VPN or Tor
- Encrypted DNS
- Firewall active
- WebRTC disabled
Browser
- Privacy browser
- uBlock Origin
- Anti-fingerprinting
- HTTPS-Only
Communications
- E2EE messenger
- Encrypted email
- Anonymous accounts
- Separate identities
Finance
- Privacy coins (XMR)
- Hardware wallet
- No KYC exchanges
- P2P exchange
Advanced
- Tails/Whonix/Qubes
- Duress mechanisms
- Hidden volumes
- Burner device