Protecting yourself

When you register a key it stores a secret tied to the website's real domain. At login the site sends a challenge and the key signs it, but only after checking that the domain asking matches the one it registered with.

On a lookalike domain the key simply refuses. Not because it noticed something suspicious, but because the maths does not produce a valid signature for the wrong domain. There is nothing for the attacker to steal and replay.

This protection is structural. It does not depend on you spotting a misspelled address while tired. That is exactly why it is first on this page.

Register both keys on every account and keep the second somewhere else — a drawer at home, a trusted person, a safe. An account secured with one key and no backup is an account you can permanently lose.

Save each service's recovery codes into your password manager as you go, and turn off SMS as a fallback afterwards — otherwise you have left the weak door open beside the strong one.

Where a site does not support keys, use Aegis (Android, open source, encrypted backups) rather than SMS.

A common pattern after a successful phish: the attacker changes nothing you would notice. They add a filter that silently forwards a copy of every message, or only those matching "password", "invoice", "verify", to an address of theirs, and leave.

You change your password. You turn on 2FA. The rule is still there, still running. After any suspected compromise, check the rules before anything else.

Proton Mail and Tuta encrypt your mailbox so the provider cannot read it, and both have free tiers. Neither is magic — mail to and from ordinary addresses is still readable at the other end, but it removes your provider as a single place where everything can be demanded or breached.

SimpleLogin gives a different alias to every service, so a leak cannot be correlated with the others, and you can see which company leaked it.

What you get:

• No Google services unless you add them, and when you do, they run sandboxed as ordinary apps with no special privileges.
• Permissions Android doesn't offer: deny an app network access entirely, block sensors.
• A hardened memory allocator and other defences aimed squarely at the exploit tools sold to governments.
• Auto-reboot after a set idle period, returning a seized phone to the state where its encryption keys aren't in memory.
• A duress PIN that wipes the device.

What it costs: it only installs on Google Pixel phones, an irony worth naming, and it is because Pixels ship the hardware security features and permit a verified custom OS. Older Pixels stop getting hardware updates, so buy one still in support. Some banking and government apps refuse to run.

Installing is done from a computer over USB and takes about half an hour. The web installer is beginner-friendly.

The journalist Richard Medhurst was arrested at Heathrow on 15 August 2024 under section 12 of the UK Terrorism Act 2000, and his devices were taken. He reported that repeated requests for his passcode were refused, and that his GrapheneOS phone protected its contents because of the auto-reboot feature: a device left without the correct passcode for a set period restarts itself, returning to the state before first unlock, where the encryption keys are not in memory.

Reporting on the case in Computer Weekly, Professor Steven Murdoch of University College London noted that even leading commercial forensic tools have at times failed to extract data from GrapheneOS devices without the password, especially where the phone had recently rebooted.

That is what "battle tested" means here. Not a marketing claim, a documented case of a journalist's phone in the hands of a state that wanted what was on it, and did not get it.

Computer Weekly, the full account  ·  archived copy

The people who argue about this project online are mostly arguing about personalities. The question in front of you is narrower: does this software make a phone harder to get into than the one you are carrying now.

On the published evidence, and on at least one case where it was tried for real, it does.

Most people assume Linux means more secure. On phones that is not true, and it is worth knowing before you spend money.

GrapheneOS is better at resisting attack. Verified boot, strong per-app sandboxing, a hardened memory allocator, and defences aimed squarely at the exploit tools sold to governments. A typical Linux phone has none of that: no verified boot, desktop-style software with a much larger attack surface, and app isolation that is weak by comparison.

A Linux phone is better at control. No Google anywhere, a system you can actually inspect and modify, and on some models physical switches — which is the only way to be certain a microphone is off, and stronger than any software promise.

Different threat models. If you are worried about targeted spyware, take GrapheneOS. If you are worried about what the device does routinely, and want to be able to prove the camera is disconnected, a Linux phone answers that better.

The apps. Banking, ride-hailing and most everyday apps can work normally on GrapheneOS. Install sandboxed Google Play where an app needs it, then allow only the permissions and settings it genuinely requires, such as location or notifications. A minority of banking, government or DRM-dependent apps still refuse device-integrity checks, so test the specific app before relying on it.

The camera is markedly worse than any modern phone, which matters a great deal if you film.

Battery and polish. Software improves monthly and basic functions can still be unreliable. Pine64's own wording about their hardware is that functionality "can be spotty".

And the modem is still proprietary. A Linux phone does not remove the baseband you cannot inspect, it is a separate processor on every phone ever made. The kill-switch models deal with it by cutting its power, which is the honest solution.

If what you actually want is Android without Google, rather than Linux specifically, CalyxOS and /e/OS sit between the two: de-Googled, far easier to live with than a Linux phone, and weaker than GrapheneOS on the hardening that matters most.

For most people objecting to GrapheneOS on principle rather than on threat model, that is the pragmatic answer.

Use the built-in generator (the dice icon) for every site, and never invent one yourself. Humans produce predictable passwords even when trying not to.

• For websites: 20+ characters, letters, numbers and symbols. You will never type it, so length costs you nothing. If a site rejects it, shorten to what it allows, still random.
• For your master passphrase: switch the generator to passphrase mode and take six or more words. Something like correct-battery-staple-ocean-tiger-mint is both easy to remember and enormously harder to crack than a short password with symbol substitutions.
• Never reuse the master passphrase anywhere else. It protects everything.

If you would rather generate the master passphrase with physical dice instead of trusting any software, the EFF publishes a word list for exactly that: EFF dice-generated passphrases.

• Two-factor codes. It can store TOTP secrets and generate the codes, replacing an authenticator app. Convenient, but understand the trade-off: password and second factor then live in the same file. For your most critical accounts, keep the second factor on a separate device or a hardware key.
• Attachments. Store recovery codes, backup key files and licence keys inside the encrypted database rather than loose on your disk.
• Password health. It flags weak, reused and expired entries, and can check them against known breaches.
• Auto-type. Fills credentials into desktop applications, not just browsers.
• Custom fields. Security questions, account numbers, anything that should not sit in a notes app.

The database is one file, so anything that moves files can sync it. The file is already encrypted, so even a cloud provider holding it cannot read the contents, but you can avoid handing it over at all:

• Syncthing — syncs directly between your own devices, with no server in the middle.
• Cryptomator, if you do use a cloud folder, encrypt it again first.

Do not sync it to two devices and edit both offline, you will create a conflicted copy and it is tedious to merge. Let one device be where you add entries.

If all of this sounds like more than you want to manage, Bitwarden handles syncing for you and is a perfectly good choice. A manager you use beats a better one you abandon.

Automated moderation cannot distinguish a war crime from the celebration of one. The footage that matters most, a strike, a body, an injury, a weapon — is exactly the footage most likely to be classified as graphic violence and removed.

This has been measured elsewhere. An independent human rights assessment commissioned and published by Meta found its own handling of Palestinian content had an adverse impact on users' rights to free expression. The same dynamic applies to storage and video platforms; it is simply less visible there, because a deleted file does not trend.

End-to-end encrypted storage means the provider holds bytes it cannot read. It cannot scan them, so it cannot flag them, so the deletion problem above largely disappears. That is the whole reason to move.

It does not put you beyond legal process. Proton is a Swiss company and answers to Swiss courts: in 2021 it complied with an order to log a user's IP address in a French case. It could not hand over message contents, because it does not have them, but the distinction matters and you should know it rather than find it out later.

And if you forget the password on an end-to-end encrypted account, the data is gone. Nobody can reset it for you. Put it in your password manager.

1. Get the irreplaceable material out first. Footage, documents, anything that cannot be recreated. Onto encrypted storage and onto a disk you own, before anything else changes.

2. Then move your email, because it is the recovery route for every other account and the thing you least want to lose access to.

3. Then the small things — search, browser, maps, which cost nothing and can happen whenever.

4. Do not delete the Google account. Leave it, empty, as a forwarding address and a recovery option. Deleting it in one motion is how people lose the account that other services still point at.

No shared folders. The convenient feature letting the VM see your real documents is exactly the bridge malware uses. Move files in deliberately, one at a time.

Network off by default. Most of what you're protecting against wants to call home or fetch a second stage.

Take a snapshot of the clean VM once set up, and roll back to it rather than trusting that you cleaned up. A VM is a strong boundary, not a perfect one — escapes exist, and are rare and expensive. For ordinary risks it is more than enough.

When you load a page, your browser answers many small questions without being asked: screen size and colour depth, timezone, language, operating system, CPU core count, installed fonts, graphics card.

Two techniques go further. Canvas fingerprinting asks your browser to draw an invisible image; tiny differences in your graphics hardware and drivers make the result measurably yours. Audio fingerprinting does the same with a sound never played.

None is identifying alone. Together they are: "Firefox 141 on Linux, 2560×1440, Europe/Athens, these 94 fonts, this GPU" may describe one person in several million. No cookie is needed, so clearing them changes nothing.

The counterintuitive part: making your browser unusual makes this worse. A rare extension, a custom font, a resized window all make you more distinguishable. The defence is not to hide, it is to look identical to a large crowd.

Mullvad Browser, the best default for most people. Built by the Tor Project with Mullvad: Tor Browser with the Tor network removed, so every user presents the same fingerprint. Free, and no Mullvad subscription needed.

Tor Browser, when you need anonymity, not just privacy. Slower; some sites block it.

Firefox with arkenfox, a good everyday browser, hardened. More work.

Brave — randomises the signals instead of standardising them. A reasonable, different bet.

Add uBlock Origin to Firefox or Brave. Do not add extensions to Mullvad or Tor Browser — you'd be stepping out of the crowd that protects you.

Chrome is the thing to move away from: made by the largest advertising company in the world, and the browser these techniques are most at home in.

Why Mullvad: your account is a random 16-digit number. No email, no name, no password. You can pay in cash. There is nothing in their records connecting an account to a person, a stronger guarantee than a promise not to keep logs.

What it does not do: a VPN is not anonymity. It does not stop a site fingerprinting your browser, does not stop tracking while you're logged into your own accounts, and does not hide you from a service you sign into. Almost every VPN advertised online sells exactly that false impression.

If you need anonymity rather than privacy from your ISP, you want Tor, not a VPN.

• Both companies were named as PRISM participants in the 2013 Snowden documents — Microsoft first, in 2007; Apple in 2012. Guardian, June 2013
• Microsoft worked with the NSA on access to its services, including helping circumvent its own encryption on Outlook.com. Guardian, July 2013
• Secret access arrangements have existed elsewhere in the security industry. The CIA and the German BND secretly owned Crypto AG, whose encryption machines were sold to governments while the owners could read the traffic. That history explains caution; it does not prove anything about a modern desktop operating system. National Security Archive

The Snowden documents establish government access to company services and data. They do not establish a hidden access mechanism in Windows or macOS. Closed source also does not prove one exists; it means outsiders have fewer ways to check the claim either way.

That uncertainty is one reason we prefer software whose source can be examined. It is a risk-management choice, not a finding that every reader needs to make.

Open source is not automatically safe; plenty of it is unaudited, and serious flaws have gone unnoticed for years. But it can be examined, by you or by anyone, and reproducible builds let you verify that the program you received was built from the source you read. That possibility does not exist for Windows or macOS at all, and that, more than any single revelation, is why we moved.

Some things genuinely do not work: Adobe's suite, certain games, some corporate conferencing tools, and hardware with Windows-only drivers. Check what you actually depend on before committing.

Linux is not automatically more secure. A badly configured Linux machine is worse than a well-configured Windows one. What it gives you is the ability to verify and control, which the next section is about using.

A reasonable middle path: keep your existing machine, put Linux on a spare laptop, and move the sensitive work there first.

Never paste a command you cannot explain back in your own words, and never run a script that does twenty things at once. An assistant will confidently produce something that deletes what you meant to move, and sudo gives away everything.

Ask what the command does first. It will tell you, happily, and that habit is worth more than any single fix it hands you.

Steam runs a large share of the Windows catalogue on Linux through its compatibility layer, and most single-player games simply install and play. The real exception is competitive multiplayer with kernel-level anti-cheat, which mostly refuses to run and is unlikely to change.

So dual boot. Keep Windows on the machine purely for those games, and do everything else, your accounts, your email, your files, your work, on the Linux side. The installer offers this during setup and it costs no extra effort.

It is not the purist answer, since Windows is still on the disk. It is the one that gets people to actually switch, and someone doing their real work on Linux is worth far more than someone who read this and changed nothing.

With the default configuration, the TPM releases the key only when the measured boot state matches what BitLocker expects. This blocks reading the disk in another machine and normally blocks a modified boot chain. It does load the key before Windows sign-in, which gives an equipped attacker with prolonged physical access more avenues than a configuration that also requires a PIN.

Adding a pre-boot PIN closes that. On Pro editions it is a Group Policy setting — Require additional authentication at startup, after which manage-bde can add the PIN to the drive. It is the single most valuable change in this section for a Windows user.

Full BitLocker is a Pro and Enterprise feature. Windows Home instead offers Device Encryption on hardware that supports it, which is the same underlying technology with fewer controls, and it escrows the recovery key to your Microsoft account automatically, with no local-only option.

If that is unacceptable for what you do, the honest answers are to upgrade the edition, or to move the work to Linux, where the key is only ever yours.

A standard install encrypts everything except a small boot partition and the EFI partition, which have to stay readable for the machine to start. No documents live there, but the kernel and initial boot files do, which is what makes the tampering attack below possible.

For most people this is a fine trade. If it is not, some distributions can encrypt /boot as well, and Secure Boot plus a firmware password raises the bar considerably without that complexity.

LUKS can be configured to unlock with a hardware key instead of, or in addition to, a typed passphrase, the same device from Level 1.

Always keep a passphrase in a second key slot when you do this. A lost or dead key with no fallback means the disk is unrecoverable, and that failure is permanent.

On Apple Silicon the security is built into the chip and there is no separate firmware password to set, the boot process is locked down by design, and startup security is managed through Recovery.

On older Intel Macs a firmware password is a separate, worthwhile step: it blocks booting from external media and prevents an attacker from starting into Recovery to work around you.

The attack this defends against is simple: someone with brief physical access — a hotel room, an office overnight, a bag out of sight at a border — boots your machine from their own media and modifies the unencrypted boot files so that the next time you type your passphrase, it is captured.

Your disk was encrypted the whole time. It did not help, because you unlocked it yourself afterwards.

Be clear about the limits, though: a firmware password is a speed bump, not a lock. On many machines it can be cleared by opening the case, and some vendors have master overrides. It defeats opportunistic tampering and buys time; it does not defeat a determined, equipped adversary with your laptop in a back room.

Most routers offer a WPA2/WPA3 transitional mode, letting new devices use WPA3 while older ones fall back. It is weaker than WPA3-only, an attacker can try to force the fallback, but far better than WPA2 alone.

Check what needs it first. Usually it is one old printer or a smart plug, and those belong on the guest network anyway.

ISP-supplied routers are often the worst of the lot: remote management enabled for the provider, undocumented accounts, and firmware updated at the provider's convenience rather than when a flaw is found.

You can usually buy your own and put theirs into modem-only or bridge mode. If you want to go further, OpenWrt is open-source router firmware with a long support life, and it runs on a lot of ordinary hardware.

For a thorough, maintained checklist there is nothing better than routersecurity.org.

Tails had a reputation for being awkward: verifying the download, writing it to a USB stick correctly, getting a machine to boot from it, then working out persistent storage without losing anything. Plenty of people gave up somewhere in the middle.

For someone non-technical, that used to make Tails impractical. That barrier is much lower now. An AI assistant can walk you through the whole thing on your own machine — checking the signature so you know the image was not tampered with, writing the stick, finding the boot key for your specific laptop, and explaining what persistent storage will and will not keep. It turns a fiddly, well-documented process into a sequence you can work through without already knowing the terminology.

Use it when you want a session to leave nothing behind: a shared or borrowed computer, or when the risk is someone later examining the machine. Runs on almost any laptop and costs the price of a USB stick.

It does not protect you if you log into your own accounts inside it, that identifies you regardless of Tor. And amnesia cuts both ways: anything you want to keep must go into the optional encrypted Persistent Storage, deliberately.

Qubes is the strongest practical desktop security available, and it asks a lot: specific hardware, real memory, and a change in how you work, you decide which compartment every task belongs to. Opening a file in a disposable VM is one click, which makes Level 6 almost automatic here.

That used to put it beyond most non-technical people. An AI assistant can now help you check whether your hardware is suitable, follow the installer, create the first compartments and explain the choices as you make them. It does not remove Qubes’ hardware requirements or its learning curve, but it makes the setup far more approachable than it used to be.

It is aimed at people with a specific, serious reason. If you are reading this to reduce everyday tracking, Levels 1 and 2 will do far more for you.

It means your address is not in a breach that has become public and known. That is a narrower claim than it sounds. Plenty of breaches are never disclosed, are traded privately for years, or are disclosed without the data ever being published.

So treat a clean result as good news about a specific list, not as a statement about your accounts. The measures elsewhere on this page are what actually protect them.

Chrome and Safari both check saved passwords against known breaches, and it is worth running once: Google Password Checkup, or Passwords → Security Recommendations on Apple devices.

But note what you are being told. Browser password stores are the first thing an information stealer takes, so a breach report there is a reason to move them into a real password manager, not a reason to feel covered.

Your browser hashes the password locally and sends only the first five characters of that hash. The server returns every leaked hash starting with those five, often several hundred, and your own browser checks the list.

The password never leaves your device, and the server cannot tell which of the answers it sent was the one you were asking about. That property is called k-anonymity, and it is why this is a different proposition from a site that simply asks you to paste a password in.

Day-to-day conversation with people who are not going to install anything unusual. Voice and video calls. Anything where the alternative is the person defaulting back to SMS or WhatsApp, which is the real failure mode.

Weakest at: hiding that you use it, and hiding your phone number from the organisation itself.

First contact with someone you do not want to exchange phone numbers with. Sources. Anyone who cannot or will not register an identity. Situations where the fact that you have an account at all should not be linkable to you.

Weakest at: long-lived archives of sensitive conversation, until V2 ships. Turn on disappearing messages and the point largely goes away.

Message contents are encrypted; a good deal of metadata is not. Because rooms are replicated across every server whose users are in them, those server operators can see who is in a room and when they are active. On a public server that is a real exposure, and it is the argument for running your own.

Managing encryption keys across several devices is also fiddlier than the other two, and losing them means losing access to old messages.

A team, a newsroom, or a group that works together over time and wants its own infrastructure. Bridges to other networks. Anything where you would otherwise reach for Slack or Discord and should not.

Weakest at: one-to-one conversation with someone non-technical, where Signal wins on the only measure that counts, whether they will use it.

Frigate — records and does object detection locally, on your own machine, with no cloud account. Works with ordinary cameras that speak RTSP.

Home Assistant — runs your cameras and smart devices locally and can keep them off the internet entirely.

When buying, look for a camera that supports RTSP or ONVIF. That means it can feed a local recorder and does not depend on the manufacturer's cloud continuing to exist.