diff --git a/opsec/0_anon/index.html b/opsec/0_anon/index.html index 87d2289..facb809 100644 --- a/opsec/0_anon/index.html +++ b/opsec/0_anon/index.html @@ -62,7 +62,7 @@
Previous Page

nihilist - 00 / 00 / 00

SRVNAME Setup

- +

diff --git a/opsec/anonprotest/index.html b/opsec/anonprotest/index.html index dcb2c89..81bf793 100644 --- a/opsec/anonprotest/index.html +++ b/opsec/anonprotest/index.html @@ -218,7 +218,7 @@

As we have discussed the various methods that Law Enforcement agencies can track you down precisely, and there isn't much you can do to stop it, leaving your personal mobile phone, smart watch, or any other smart device at home is the best way to stay anonymous in a protest, leaving - no proof that you took part in it and denying that + no proof that you took part in it and denying that you ever left your home.

@@ -709,4 +709,4 @@ - \ No newline at end of file + diff --git a/opsec/encryption/1.png b/opsec/deniability/1.png similarity index 100% rename from opsec/encryption/1.png rename to opsec/deniability/1.png diff --git a/opsec/encryption/2.png b/opsec/deniability/2.png similarity index 100% rename from opsec/encryption/2.png rename to opsec/deniability/2.png diff --git a/opsec/encryption/3.png b/opsec/deniability/3.png similarity index 100% rename from opsec/encryption/3.png rename to opsec/deniability/3.png diff --git a/opsec/encryption/4.png b/opsec/deniability/4.png similarity index 100% rename from opsec/encryption/4.png rename to opsec/deniability/4.png diff --git a/opsec/encryption/5.png b/opsec/deniability/5.png similarity index 100% rename from opsec/encryption/5.png rename to opsec/deniability/5.png diff --git a/opsec/encryption/6.png b/opsec/deniability/6.png similarity index 100% rename from opsec/encryption/6.png rename to opsec/deniability/6.png diff --git a/opsec/deniability/7.png b/opsec/deniability/7.png new file mode 100644 index 0000000..e784816 Binary files /dev/null and b/opsec/deniability/7.png differ diff --git a/opsec/encryption/index.html b/opsec/deniability/index.html similarity index 82% rename from opsec/encryption/index.html rename to opsec/deniability/index.html index cb1fbce..c097aa2 100644 --- a/opsec/encryption/index.html +++ b/opsec/deniability/index.html @@ -121,7 +121,7 @@ The door is closed, the conversation remains between Alice and Bob, their conver
-

Why is Plausible Deniability is Vital?



+

Why is Deniable Encryption Vital?



From a legal standpoint, the only way to be protected against that scenario where you're forced to decrypt your harddrive is to be able to deny the existence of said encrypted volume (Plausible Deniability) . If the encrypted volume does not exist, there is no password to be given for it.

So here we need a technology that can provide us Plausible Deniability. That is what Veracrypt can do for us.

@@ -134,6 +134,24 @@ The door is closed, the conversation remains between Alice and Bob, their conver
+ +
+
+
+
+

Live mode - Protecting your Deniability



+

Now when there is an adversary busting down your door, running towards your computer to collect as much incriminating evidence as possible on you, you need to make sure that they are not finding anything incriminating on you. Thing is, if he were to seize your computer, there are many places he can check inside your computer for anything incriminating (system logs, kernel logs, non-standard log-files, the contents of the RAM, etc)

+

In the context of you using deniable encryption, the adversary must not able to prove the existance of said encrypted volume that you are trying to keep hidden. This is where using an operating system in live mode comes in the picture:

+ +

To make it short, if you start your operating system in live mode, you are not writing anything on the system disk, but rather you are loading the entire operating system in the RAM. Everthing that you write on the system drive while in live mode gets erased upon rebooting.

+

The idea behind using live mode is that every forensic trace regarding the hidden encrypted volume that would normally be written into the system logs, kernel logs, and various other system files (that we would normally need to manually clean up after closing the hidden volume) will all be written into RAM instead of being written onto Disk, and then will all be completely erased upon rebooting the computer.

+

As you'll see in this tutorial

+ +
+
+
+
+ diff --git a/opsec/haveno-client-f2f/index.html b/opsec/haveno-client-f2f/index.html index f55ee50..68661ec 100644 --- a/opsec/haveno-client-f2f/index.html +++ b/opsec/haveno-client-f2f/index.html @@ -190,8 +190,74 @@ May-29 20:55:27.427 [JavaFX Application Thread] INFO h.d.c.c.c.PopOver: hide:20

Then make sure you have the persistant storage enabled, with the dotfiles enabled:

-

Then, to install it at the current latest version (as of the 6th of october 2024, version 0.) you need to run the following command:

+

Then, to install it at the current latest version (as of the 6th of october 2024, version 1.0.12) you need to run the following commands:


+amnesia@amnesia:~$ curl -x socks5h://127.0.0.1:9050 -fsSLO https://github.com/haveno-dex/haveno/raw/master/scripts/install_tails/haveno-install.sh  && bash haveno-install.sh https://github.com/retoaccess1/haveno-reto/releases/download/v1.0.12/haveno-linux-deb.zip DAA24D878B8D36C90120A897CA02DAC12DAE2D0F
+
+amnesia@amnesia:~$ ./Persistent/haveno/App/utils/exec.sh 
+
+
+ + + + + + + + + + + + + + + + + + + + + +
+
+
+ + The Nihilism Blog +
+
+ +
+ +
+
+ + + +
+
+
+
+ Previous Page

nihilist@mainpc - 2024-11-03

+

Using the Host-OS in live-mode to prepare for long-term Sensitive Use

+ +

+ +
+
+
+
+ + +
+
+
+
+

Initial Setup

+

+ +

+	
+
+ +

+ +

+	
+
+ +

+ +

+	
+
+
+
+
+
+ +
+
+
+
+

Setup



+

+ +

+	
+
+ +

+ +

+	
+
+ +

+ +

+	
+
+ +
+
+
+
+ + + +
+
+
+
+

Setup



+

+

+	
+
+ +

+

+	
+
+ +

+

+	
+
+ +
+
+
+
+ + + +
+
+
+
+

Nihilism

+

+ Until there is Nothing left.



Creative Commons Zero: No Rights Reserved
+ +

+
+ +
+

My Links

+

+ + RSS Feed
SimpleX Chat
+ +

+
+ +
+

About nihilist

+

Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


Contact: nihilist@contact.nowhere.moe (PGP)

+
+ +
+ +
+
+ + + + + + + diff --git a/opsec/serversideencryption/index.html b/opsec/serversideencryption/index.html index 6bd4380..765a476 100644 --- a/opsec/serversideencryption/index.html +++ b/opsec/serversideencryption/index.html @@ -74,7 +74,7 @@

Clientside Encryption: Who can be trusted ?

-

As we discussed previously, Encryption is about providing privacy, Bob and Alice use encryption, for their conversation to remain private from the adversary Jack.

+

As we discussed previously, Encryption is about providing privacy, Bob and Alice use encryption, for their conversation to remain private from the adversary Jack.

One way to close the door on Jack, is to use PGP encryption:

diff --git a/opsec/tailsqemuvm/20.png b/opsec/tailsqemuvm/20.png new file mode 100644 index 0000000..c6bc5be Binary files /dev/null and b/opsec/tailsqemuvm/20.png differ diff --git a/opsec/tailsqemuvm/index.html b/opsec/tailsqemuvm/index.html index 9faea61..ac18416 100644 --- a/opsec/tailsqemuvm/index.html +++ b/opsec/tailsqemuvm/index.html @@ -8,7 +8,7 @@ - Tails OS QEMU VM for Temporary Anonymity + Tails OS QEMU VM for Temporary Sensitive Use @@ -60,11 +60,13 @@
- Previous Page

nihilist@mainpc - 2024-06-14

-

Tails OS QEMU VM for Temporary Anonymity

+ Previous Page

nihilist@mainpc - 2024-10-03

+

Tails OS QEMU VM for Temporary Sensitive Use

In this tutorial we're going to look at how you can run Tails OS (The Amnesic Incognito Linux System) in a QEMU VM, following the official documentation here.

+

Tails OS is suitable for Short Term Sensitive Use due to it's default live-mode feature, where upon shutting down the OS, every forensic trace of what you were doing is completely erased from memory, where the entire OS is loaded into. There are no disk-writes at all by default. (Unless if you use the persistent storage, which is not suitable for sensitive use, due to not being deniable encryption like Veracrypt ).

+

OPSEC Recommendations:

  1. Hardware : (Personal Computer / Laptop)

    2. @@ -72,7 +74,7 @@

  2. Hypervisor: libvirtd QEMU/KVM

  3. Application: Host-based VPN (if your ISP doesn't allow Tor traffic)

-

I recommend using this setup into one of the above mentionned VMs, for Anonymous use, as per the 4 basic OPSEC levels.

+

I recommend using this setup for Anonymous use if you store anything into the persistent storage, or for short-term Sensitive use if you are not storing anything sensitive in the persistent storage, as per the 4 basic OPSEC levels.

Sidenote: If your ISP does not allow Tor traffic, make sure that you route the QEMU VMs traffic through a VPN, to hide the tor traffic from your ISP (You -> VPN -> Tor) Setup

@@ -177,6 +179,21 @@ Nsyh+-..+y+- yMMMMd :mMM+ DE: GNOME 43.9

And that's it! We managed to run tails OS from a QEMU VM and install some software into the persistent storage.

+
+
+
+
+ +
+
+
+
+

Deniability Context



+

Now suppose you are living in a country where using Tails OS and Tor is not going to be a reason to immediately throw you in jail, the adversary is busting down your door, while you are browsing a sensitive website with it, and you want to make sure that there is no incriminating evidence to be found against you when the adversary seizes your computer.

+

Reminder, this is only for temporary sensitive use, do not save anything sensitive in the persistent storage because otherwise the adversary can force you to unlock it to reveal the contents.

+ +

All you need is to shutdown the VM, and everything forensic trace of what you were doing in it gets immediately erased from memory, as if there was nothing there to begin with. Effectively leaving the adversary empty-handed with no incriminating evidence to use against you in court.

+

And that's it! You now have a dedicated VM for your temporary sensitive uses.

diff --git a/opsec/veracrypt/index.html b/opsec/veracrypt/index.html index 7aa7b8e..ca208c3 100644 --- a/opsec/veracrypt/index.html +++ b/opsec/veracrypt/index.html @@ -8,7 +8,7 @@ - Plausible Deniability Setup + The main source of Plausible Deniability: Deniable Encryption @@ -61,7 +61,7 @@
Previous Page

nihilist@mainpc - 2024-01-31

-

Plausible Deniability Setup

+

The main source of Plausible Deniability: Deniable Encryption

VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. It is based on Truecrypt, This tool will be used for Plausible Deniability.

But why is Plausible Deniability important first of all ? From a legal perspective, depending on jurisdictions, you may be forced to type your password into an encrypted drive if requested. All it takes is for an adversary to be able to prove the existence of an encrypted drive to be able to force you to reveal the password to unlock it. Hence for example the regular LUKS encryption is not enough, because you need to be able to deny the existence of the encrypted volume. If that is the case, we have to use Veracrypt, which is an encryption tool used to provide protection (which is Plausible Deniability) against that scenario where you're forced to provide a password.

diff --git a/opsec/vpn/index.html b/opsec/vpn/index.html index f7b8501..2a96528 100644 --- a/opsec/vpn/index.html +++ b/opsec/vpn/index.html @@ -181,6 +181,7 @@ mullvad-vpn/unknown,now 2024.4 amd64 [installed]

So now currently, Bob has managed to setup a Debian VM (with only open source software) with a VPN in order to use it and gain privacy from his ISP.

Currently, Bob's setup is suitable for Public use (thanks to his windows VM), AND suitable for Private use too (thanks to his debian VM with the VPN setup).

+

However you can also setup the VPN from the Host OS directly, so that every VM in it goes through the VPN.

Next, Bob can setup KeepassXC to implement proper Password Management.