discussion Online privacy, or how to keep yourself safe in forums and communities

[VSCDB]

Since I did not see any thread like that, and I thought this might be quite valuable and useful for certain members of this community, I thought, why not make a little tutorial on how to actually minimize risk of getting doxed or tracked from different actors.

A little about myself, skip this if you don't care.

Spoiler

I was active in multiple hacking/doxing/cyber crime and cyber security forums over the years, and also wrote command and control servers and corresponding RATs, bypasses and ransomware, as well as multiple smaller pentesting tools, packers and OSINT tools, I was also staff for multiple scripting/cheating communities at the same time by employing some of the techniques I will go into here, and was involved with writing external and internal scripting platforms. Most of these platforms did not know I was active in other communities, and I never faced any real life problems after doing this for years, before unofficially retiring and seizing almost any action in these communities.

First, I would like to go a bit into the threat model, so you understand which techniques and tools are actually useful to you, what is overkill and what might be useful even tho without too much merit. If you already know what your threat model looks like, skip this.

Spoiler

A threat model, very roughly, is a framework for understanding what actors (governments, regular people, a community, etc.) pose an overall security risk to your privacy, security or data.
Usually these actors can roughly be categorized into:
- Government actors - Usually local or national level law enforcement, can reach up to international law enforcement (5-14eyes, interpol)
- Corporate entities - Usually corporations like Google, Meta and similar, for data selling, advertisement or tracking of individuals.
- Cybercriminals - Usually small time "hacker" groups which try to get login information via phishing attacks, can reach up to big hacktivist groups as well as real cyber crime groups as well tho.
- Insiders (Staff, Employees)
- Users
- Friends/Family

This list could be longer, could be shorter, depending on actual application and person.
The next important thing in defining your threat model is, what you actually want to secure. Is it your personal identity, your data, your more private information, and depending on that which person can get which data.
In my use case, as an example, in the scripting communities, for me it looked somewhat like this:
- No revealing of personal identity, closer personal data like real age and similar
- Mostly targeted against insiders and users in the community, people who could know me from real life, cyber criminals (actually a huge part in that scene), and also contacts from previous groups, minimally government actors, since what I did, was not really illegal in the jurisdiction I was in, but I did get profits from it in crypto anonymously

I hope this clarified a bit, what a threat model could look like.

Onto the basics, I would say, probably anyone using this kind of forum should employ.
- Keep your data of residence, name, and pictures private, at best, do not reuse the username for other social media, except where you employ the same techniques. You can sometimes reveal your City/State/Country or some name, but only when you are 100% sure, that you have not revealed too much information in another publicly traceable conversation. If you live in tiny cities, never reveal your city, or do not reveal any more information like names or similar.
- Keep the username in a different format, or use a very common format, from what you usually do, best not to add any identifiable information in it. Avoid things like having your birthdate, real name or clues to your real or other identies as part of your username.
- If you do use a private picture, make sure to either remove metadata from the image, or make sure your camera already does that, many camera apps nowadays have the ability. Usually this is called Exif metadata, but Exif does not encompass all metadata, most tools I used in the past also removed most other sensitive metadata as well tho, tools for removing this metadata exist for all operating systems, I will not endorse any here, since I have not checked any tools in recent times. Even if most social media nowadays do remove this data, you can never be 100% sure that they will do that in the future as well.
- Use a VPN or other encrypted tunnel. Here I will actually endorse Mullvad VPN, Proton VPN is not too bad either, not a huge fan of the proton corp tho, Windscribe is also not bad, and pretty cheap, weird CEO tho, till now none of these ever worked together with law enforcement, simply out of the reason that they can't, since they have no actual data about the connection stored. This way, even if your ISP tracks all the domains you connect to, and after that law enforcement or whatever starts to actually investigate (because of whatever reason whatsoever), they will not be able to actually see that you visited lewdcorner.com, but the IP/domain of the VPN server or tunnel.
- Onto VPNs, to note is, this mostly prevents ISP and possible local devices sniffing out where you connect to, not as much actually for the anonymity, for this you should employ multiple of these techniques. If you do not care about your Internet provider to see that you visit the community, you can ignore the VPN.
- Do not just trust people in the community, do not fall for easy lures. Usually the biggest threat to your privacy is yourself, and your mouth or, well, fingers. Just because someone offers you something in DMs, even if it is very alluring, as long as you cant verify that the person is trustworthy, or if you can trust the person, cant be sure that they haven't been hijacked and have suspicions, reject. As long as you keep that in mind, and actually take a bit of time to think before sending any information, clicking a link, downloading and executing a file, you will for the most part be safe. But remember, even if you trust the person, people can change, so its better to never reveal any personal information, if the other person has not done so as well, and were able to verify that information.
- If it is a publicly accessible, or shared computer/device, clear your browsing history and website cookies (honestly more good pratice than necessary, but still). Yes it might be a bit annoying to log in again, but it is more annoying when your parents, children, siblings, grandchildren and grandparents or friends, can freely access whatever you have written, posted, or viewed.

Now onto a bit more privacy concerning, maybe wanting to hide the activity from a government with which Google/Alphabet, Meta or other corporations are cooperating, or simply wanting not to be tracked by Google meta and so on.

Spoiler

- Use a different browser from your regular activity, or do it in a separate profile. This will make it harder for single websites to track you.
- With the different browser/profile use with either a low number of extensions installed, usually uBlock Origin/uBlock Origin Lite, the VPN, and maybe a password manager should be enough or make sure that you do not have roughly the same extensions installed. More extensions make it easier to create a unique or almost unique fingerprint of you. If you employ this correctly, your fingerprint for your sessions for this kind of thing, and your regular activity will be completely different.
- Do not to log into your main google, apple, or meta account on this profile/browser as well. Otherwise these entities will still be able to track you somewhat, this is already defeated when using Google Chrome or Edge and similar browsers. I would recommend Ungoogled Chromium and Librewolf. Best would be to use the browser/profile really only for browsing these communities. If you have multiple accounts which are in anyway linked to these, better not to log in to these as well.
- Again, here it is actually a good idea to fully double tunnel, best with two different VPNs, my old setup as example was, Mullvad VPN on my OS as VPN connection for everything, then I had one LibreWolf instance for most of the activity with Windscribe as outgoing from the browser, and on my normal browser also a windscribe vpn tunnel but connected to my home country, so you have two-three VPN tunnels, best in different locations, which prevents law enforcement seizing single servers, dumping the full RAM and having access to some connection data, and being able to possibly trace that back. For additional, and honestly needed security, use techniques like decoy traffic/fake traffic to prevent or weaken many timing attacks as well, either at the client level, when the VPN does not support it natively, or on the VPN level (I believe all three support it, Mullvad, Windscribe and Proton, but not sure anymore tbh).

If you actually want to have fully separate identities for different scenes or communities in a scene or overlapping scenes, in cases of fully hiding your real identity and clues from any kind of actor.

Spoiler

- If you are active in multiple communities, and do not want crossover, then make sure to split your identities for the different websites/communities/groups. This goes strongly with the username rule mentioned above, as well as with changing a bit of how fast you respond, and changing your writing style a tiny bit, as example, previously I had some phrases and such which I used in different communities, some writing styles (short sentences versus longer ones, a bit of error in writing vs no big errors, sometimes bringing in some slang or dialect from different communities).
- If possible actually prepare some background story, a second name which you can use for revealing information, an fictional age, which is not actually real information. This further helps grounding your identity, but you either need to make sure to remember all of that, or write it down somewhere, otherwise your additional identity could either be exposed or get questioned.
- Separate your emails as well, if possible and necessary for some services try to get a temporary or burner phone with credit (sadly really hard nowadays). If possible, also use different providers, you can opt for less private but free variants like Gmail, Yahoo, Webmail, but at this point, you should probably use Proton Email (which is free but a tiny bit limited) or opt into an email for payment service with strong privacy policies like Tutanota.

I hope this helps anyone, I am very open for discussion on this, as well as additions. And very much hope I haven't overread some rule preventing this kind of post, or interpreted it wrongly. This is only meant educationally for members of this forum.

If I somehow posted this in the wrong section or have done anything else wrong please tell me
Please also tell me if you need clarification on certain topics, or if I should make any part more understandable.

 

[Narch]

Since I did not see any thread like that, and I thought this might be quite valuable and useful for certain members of this community, I thought, why not make a little tutorial on how to actually minimize risk of getting doxed or tracked from different actors.

A little about myself, skip this if you don't care.

Spoiler

I was active in multiple hacking/doxing/cyber crime and cyber security forums over the years, and also wrote command and control servers and corresponding RATs, bypasses and ransomware, as well as multiple smaller pentesting tools, packers and OSINT tools, I was also staff for multiple scripting/cheating communities at the same time by employing some of the techniques I will go into here, and was involved with writing external and internal scripting platforms. Most of these platforms did not know I was active in other communities, and I never faced any real life problems after doing this for years, before unofficially retiring and seizing almost any action in these communities.

First, I would like to go a bit into the threat model, so you understand which techniques and tools are actually useful to you, what is overkill and what might be useful even tho without too much merit. If you already know what your threat model looks like, skip this.

Spoiler

A threat model, very roughly, is a framework for understanding what actors (governments, regular people, a community, etc.) pose an overall security risk to your privacy, security or data.
Usually these actors can roughly be categorized into:
- Government actors - Usually local or national level law enforcement, can reach up to international law enforcement (5-14eyes, interpol)
- Corporate entities - Usually corporations like Google, Meta and similar, for data selling, advertisement or tracking of individuals.
- Cybercriminals - Usually small time "hacker" groups which try to get login information via phishing attacks, can reach up to big hacktivist groups as well as real cyber crime groups as well tho.
- Insiders (Staff, Employees)
- Users
- Friends/Family

This list could be longer, could be shorter, depending on actual application and person.
The next important thing in defining your threat model is, what you actually want to secure. Is it your personal identity, your data, your more private information, and depending on that which person can get which data.
In my use case, as an example, in the scripting communities, for me it looked somewhat like this:
- No revealing of personal identity, closer personal data like real age and similar
- Mostly targeted against insiders and users in the community, people who could know me from real life, cyber criminals (actually a huge part in that scene), and also contacts from previous groups, minimally government actors, since what I did, was not really illegal in the jurisdiction I was in, but I did get profits from it in crypto anonymously

I hope this clarified a bit, what a threat model could look like.

Onto the basics, I would say, probably anyone using this kind of forum should employ.
- Keep your data of residence, name, and pictures private, at best, do not reuse the username for other social media, except where you employ the same techniques. You can sometimes reveal your City/State/Country or some name, but only when you are 100% sure, that you have not revealed too much information in another publicly traceable conversation. If you live in tiny cities, never reveal your city, or do not reveal any more information like names or similar.
- Keep the username in a different format, or use a very common format, from what you usually do, best not to add any identifiable information in it. Avoid things like having your birthdate, real name or clues to your real or other identies as part of your username.
- If you do use a private picture, make sure to either remove metadata from the image, or make sure your camera already does that, many camera apps nowadays have the ability. Usually this is called Exif metadata, but Exif does not encompass all metadata, most tools I used in the past also removed most other sensitive metadata as well tho, tools for removing this metadata exist for all operating systems, I will not endorse any here, since I have not checked any tools in recent times. Even if most social media nowadays do remove this data, you can never be 100% sure that they will do that in the future as well.
- Use a VPN or other encrypted tunnel. Here I will actually endorse Mullvad VPN, Proton VPN is not too bad either, not a huge fan of the proton corp tho, Windscribe is also not bad, and pretty cheap, weird CEO tho, till now none of these ever worked together with law enforcement, simply out of the reason that they can't, since they have no actual data about the connection stored. This way, even if your ISP tracks all the domains you connect to, and after that law enforcement or whatever starts to actually investigate (because of whatever reason whatsoever), they will not be able to actually see that you visited lewdcorner.com, but the IP/domain of the VPN server or tunnel.
- Onto VPNs, to note is, this mostly prevents ISP and possible local devices sniffing out where you connect to, not as much actually for the anonymity, for this you should employ multiple of these techniques. If you do not care about your Internet provider to see that you visit the community, you can ignore the VPN.
- Do not just trust people in the community, do not fall for easy lures. Usually the biggest threat to your privacy is yourself, and your mouth or, well, fingers. Just because someone offers you something in DMs, even if it is very alluring, as long as you cant verify that the person is trustworthy, or if you can trust the person, cant be sure that they haven't been hijacked and have suspicions, reject. As long as you keep that in mind, and actually take a bit of time to think before sending any information, clicking a link, downloading and executing a file, you will for the most part be safe. But remember, even if you trust the person, people can change, so its better to never reveal any personal information, if the other person has not done so as well, and were able to verify that information.
- If it is a publicly accessible, or shared computer/device, clear your browsing history and website cookies (honestly more good pratice than necessary, but still). Yes it might be a bit annoying to log in again, but it is more annoying when your parents, children, siblings, grandchildren and grandparents or friends, can freely access whatever you have written, posted, or viewed.

Now onto a bit more privacy concerning, maybe wanting to hide the activity from a government with which Google/Alphabet, Meta or other corporations are cooperating, or simply wanting not to be tracked by Google meta and so on.

Spoiler

- Use a different browser from your regular activity, or do it in a separate profile. This will make it harder for single websites to track you.
- With the different browser/profile use with either a low number of extensions installed, usually uBlock Origin/uBlock Origin Lite, the VPN, and maybe a password manager should be enough or make sure that you do not have roughly the same extensions installed. More extensions make it easier to create a unique or almost unique fingerprint of you. If you employ this correctly, your fingerprint for your sessions for this kind of thing, and your regular activity will be completely different.
- Do not to log into your main google, apple, or meta account on this profile/browser as well. Otherwise these entities will still be able to track you somewhat, this is already defeated when using Google Chrome or Edge and similar browsers. I would recommend Ungoogled Chromium and Librewolf. Best would be to use the browser/profile really only for browsing these communities. If you have multiple accounts which are in anyway linked to these, better not to log in to these as well.
- Again, here it is actually a good idea to fully double tunnel, best with two different VPNs, my old setup as example was, Mullvad VPN on my OS as VPN connection for everything, then I had one LibreWolf instance for most of the activity with Windscribe as outgoing from the browser, and on my normal browser also a windscribe vpn tunnel but connected to my home country, so you have two-three VPN tunnels, best in different locations, which prevents law enforcement seizing single servers, dumping the full RAM and having access to some connection data, and being able to possibly trace that back. For additional, and honestly needed security, use techniques like decoy traffic/fake traffic to prevent or weaken many timing attacks as well, either at the client level, when the VPN does not support it natively, or on the VPN level (I believe all three support it, Mullvad, Windscribe and Proton, but not sure anymore tbh).

If you actually want to have fully separate identities for different scenes or communities in a scene or overlapping scenes, in cases of fully hiding your real identity and clues from any kind of actor.

Spoiler

- If you are active in multiple communities, and do not want crossover, then make sure to split your identities for the different websites/communities/groups. This goes strongly with the username rule mentioned above, as well as with changing a bit of how fast you respond, and changing your writing style a tiny bit, as example, previously I had some phrases and such which I used in different communities, some writing styles (short sentences versus longer ones, a bit of error in writing vs no big errors, sometimes bringing in some slang or dialect from different communities).
- If possible actually prepare some background story, a second name which you can use for revealing information, an fictional age, which is not actually real information. This further helps grounding your identity, but you either need to make sure to remember all of that, or write it down somewhere, otherwise your additional identity could either be exposed or get questioned.
- Separate your emails as well, if possible and necessary for some services try to get a temporary or burner phone with credit (sadly really hard nowadays). If possible, also use different providers, you can opt for less private but free variants like Gmail, Yahoo, Webmail, but at this point, you should probably use Proton Email (which is free but a tiny bit limited) or opt into an email for payment service with strong privacy policies like Tutanota.

I hope this helps anyone, I am very open for discussion on this, as well as additions. And very much hope I haven't overread some rule preventing this kind of post, or interpreted it wrongly. This is only meant educationally for members of this forum.

If I somehow posted this in the wrong section or have done anything else wrong please tell me
Please also tell me if you need clarification on certain topics, or if I should make any part more understandable.

What do you think of Softether VPN? the general feedback i have on it is that it's generally safe, is good only to bypass regionlocks?

 

[VSCDB]

What do you think of Softether VPN? the general feedback i have on it is that it's generally safe, is good only to bypass regionlocks?

With SoftEther it depends. Since its an open source client, you can verify the source code, which is a big point in my book. But the big difference here is that its basically a client and server, and not a full VPN infrastructure. The ones I mentioned also already have preconfigured servers. SoftEther is one of the best solutions if you either have access to additional hardware or already have a VPS/rent one specially for that. With SoftEther you basically also host the VPN server (or connect to one you paid for or otherwise got access to). But for self hosting a very good option in my book.

Post automatically merged: Mar 5, 2026

But yes generally secure, and if the server is configured correctly (ram disk for everything metadata or connection related, good firewall practices, etc.) its safe to use. Might get a problem in cases where you can't anonymously get the VPS and your use case is against higher level threat actors, but against your ISP it would generally work well, even if not being able to rent/host anonymously.

 

[Ttian]

Interesting, thanks for the heads up!

 

[Republican Bear]

Thirty years of being on such forums and never had a problem, but nowadays you never know.

Just remember the government doesn't care about single members, and usually go after larger fish.

For reference look at piracy all they want is those making money and originally sharing the files.

 

[LewisCarroll]

Obscurity is the best security. SANDBOX ALL YOUR GAMES! And if you use a password keeper, log out after you get the password. Hackers can take your cookie and use it to log into your password keeper (Some password protection uses your personal iCloud account and those tend to be a little better).

Keep your identity away from forums. Don't share personal info like your work, address, phone, insta, facebook, etc... I use an old computer to surf all forums and different identities for each (alias for each forum). Never share your real address as it will eventually go into a list somewhere and hackers will try to use it. That's wre obscurity comes in.

Thirty years of being on such forums and never had a problem, but nowadays you never know.

Just remember the government doesn't care about single members, and usually go after larger fish.

Just look at piracy all they want is those making money and originally sharing the files.

It's a whole different world these days. Viruses no longer try to trash your computer. They stay silent and watch. Picking up your passwords or using your PC to mine for them. Heck, some maleware actually cleans up your computer so it will run better to keep you using your PC longer. Crazy stuff. I use Malwarebytes and two other methods of keeping clean and half the sites these games reside on trigger warnings. A lot of malware comes from those places.

 

[SilentHunter]

I tried to state my thoughts point by point.
1. The hope of maintaining anonymity on the Internet in our time is an illusion, and a dangerous one at that. There is no anonymity, and the security services can easily reach any of us.
2. We are unlikely to face imminent arrest or just a conversation with representatives of law enforcement agencies, since the vast majority of us are "elusive Joes" who are elusive because no one really needs them.
3. Basic digital hygiene measures can and should be observed, at least this is a small barrier to various kinds of network fraudsters, although this is more likely a matter of psychology and social engineering.
4. Don't be a jerk yourself and filter the content you post online. If your hands itch, remember the existence of paper notebooks and fountain pens.
5. Turning off your smartphone does not guarantee that you are not being listened to - remember this. The same applies to various "smart" speakers, etc. devices.
6. Reread the OP again - there are a lot of reasonable things stated there.
7. Try to talk less about yourself, especially since you can hardly compete with Aurelius Augustinus and his "Confession" in terms of talent. Most of us can't reach Marcus Aurelius with his "Ad Se Ipsvm" either. Few people are interested in reading our outpourings, but if necessary, they can be used against you.

 

[DockOnTheBay]

I normally just shitpost on here, but this feels like it should be mandatory reading for new users. Good work.

 

[aiqedometqi]

Good work man! The more you know the more scared you get sometimes. That's the truth of the world. Overall, I do a pretty poor job of keeping my personal details off the internet, but even I have some things I don't want to be associated with me in real life.

 

[VSCDB]

Obscurity is the best security. SANDBOX ALL YOUR GAMES! And if you use a password keeper, log out after you get the password. Hackers can take your cookie and use it to log into your password keeper (Some password protection uses your personal iCloud account and those tend to be a little better).

Keep your identity away from forums. Don't share personal info like your work, address, phone, insta, facebook, etc... I use an old computer to surf all forums and different identities for each (alias for each forum). Never share your real address as it will eventually go into a list somewhere and hackers will try to use it. That's wre obscurity comes in.


It's a whole different world these days. Viruses no longer try to trash your computer. They stay silent and watch. Picking up your passwords or using your PC to mine for them. Heck, some maleware actually cleans up your computer so it will run better to keep you using your PC longer. Crazy stuff. I use Malwarebytes and two other methods of keeping clean and half the sites these games reside on trigger warnings. A lot of malware comes from those places.

Sandboxing is not bad in general. But I think a lot of what you are writing comes from misunderstood information or fearmongering. Yes there is a lot of risk, but its not quite as big as many people think. Password managers, depending on what kind you are using and how its implemented, can actually be attacked by what you are describing, but it largely depends on what password manager we are talking about. I might make another informational thread about actual security and such if I get the time. But basically you can have 3 usual password manager setups I would say. The first is the typical cloud password manger like the default LastPass, Bitwarden subscription model etc, these can be hit by a cookie/session hijacking attack that you talked about, but here it heavily depends on how the service implements the session auth. If its tied to a stable connection or IP then just hijacking the cookie would steal need you entering a password, sadly of most password managers you cant really control if that is the case without basically doing the attack against yourself. The other big option is self hosting, where you have a local server which is usually exposed to the internet via a specific port and routed via a service like no-ip to be fully accessible publicly, depending on configuration and ISP these can be easier to exploit or worse, but since self hostable managers are usually open source, they are more trusted and more audited by contributors and other developers. You can also keep this fully local to your home network as well, then it depends basically on your firewall and on yourself how much attention you pay to keeping yourself safe. The other options is a fully local file, Keepass is one of the most often mentioned options here. These can not be attacked by such an attack since they are just an encrypted file on your disk, and will be decrypted on the fly into your versatile system memory usually. These depend, as by the Kerckhoffs's principle, on the secrecy of the key, so you are responsible for keeping the one password for the manager safe.

I would plead never to share your real address anywhere when not strictly necessary, these databases are mostly for advertisement, some of these aggregators sell to more shady third parties as well tho. It's less "hackers" trying to use it but more either used for identity theft, or for pressuring someone, which is almost always done by kids which got ahold of your information in a low cost or free info dump on forums. These people usually have no idea what any kind of cyber security actually means, this info is more so a problem if you are a person in some high up place like a politician, celebrity or so on. In general keeping your information private is always a good idea.

The world in this regard never really changed. At least not on the side of pentesters and hacking groups. There were always different kinds of malware, info stealers are pretty much as old as malware can get, you had some destructive ones, but these are usually either ransomware, which became a bit more unattractive for the media since when companies do not pay up, the public usually can relatively easy be made to believe they had no other choice, and if they pay they will never tell a soul if they dont have to. But all kinds of malware is in the wild and always has been in the wild. Antivirus is also not a golden bullet, since they flag function pattern, syscall usage, some low level techniques like injections and certain kinds of obfuscation they do tend to have a lot of false positives, and if a new one comes out and has bypassed most anti virus, your shield is basically useless. Imho anti virus is actually mostly useless, if you do not open the files you download but first check for specific things (might make a thread in the future where I go a bit into reversing, finding suspicious behaviour and parts even if something like virus total might not, or if it does, how you can heuristically basically say if something will likely do nefarious things, not sure when or if I will get the time tho) and send it through virus total and maybe even fire up a VM and take a look at what it does live (might make a thread for this as well will see).

Post automatically merged: Apr 18, 2026

I tried to state my thoughts point by point.
1. The hope of maintaining anonymity on the Internet in our time is an illusion, and a dangerous one at that. There is no anonymity, and the security services can easily reach any of us.
2. We are unlikely to face imminent arrest or just a conversation with representatives of law enforcement agencies, since the vast majority of us are "elusive Joes" who are elusive because no one really needs them.
3. Basic digital hygiene measures can and should be observed, at least this is a small barrier to various kinds of network fraudsters, although this is more likely a matter of psychology and social engineering.
4. Don't be a jerk yourself and filter the content you post online. If your hands itch, remember the existence of paper notebooks and fountain pens.
5. Turning off your smartphone does not guarantee that you are not being listened to - remember this. The same applies to various "smart" speakers, etc. devices.
6. Reread the OP again - there are a lot of reasonable things stated there.
7. Try to talk less about yourself, especially since you can hardly compete with Aurelius Augustinus and his "Confession" in terms of talent. Most of us can't reach Marcus Aurelius with his "Ad Se Ipsvm" either. Few people are interested in reading our outpourings, but if necessary, they can be used against you.

I would disagree partly with part one, since with the right measures you can be almost fully untraceable, but full untraceability does not exist, at least not as long as we do not all use tor and host or own nodes. For the typical aggregator services I would say keeping good opsec practices is enough to not link your real identity as long as you are careful and isolate. As soon as you come into the targetted hacking target group you should live like the amish or at least limit your exposure via linkable connections to a minimum. I disagree that you can never be private today tho, you can, it just tends to be a lot more work than people are ready to do for usually less convienience. Otherwise these are mostly good rules for this forum to go by.

You can fully turn off your smartphone actually, at least with an android and with some manufacturers you need custom firmware, removing the battery also always works. You can also measure if it records anything, being skeptical in general is good tho. For most people you also dont have to be "wire tapped" or listened to, its enough to analyze usage patterns, contacts and personal relations via proximity of devices and patterns of these "meetings" and then cross referencing different information to build a profile. They in 99% of cases will not need your speech or anything you talk about, this is more a concern if you are targetted by a state actor. The point in general stands tho, keeping away more from your phone in general is a good advice people should take I think. For this specific point I would maybe say smart devices are more so a risk since these actually need to listen when on, the question just is how much of that data is saved, and then used.

 

[LewisCarroll]

Sandboxing is not bad in general. But I think a lot of what you are writing comes from misunderstood information or fearmongering. Yes there is a lot of risk, but its not quite as big as many people think. Password managers, depending on what kind you are using and how its implemented, can actually be attacked by what you are describing, but it largely depends on what password manager we are talking about.

I worked in IT for finance and city networks for 10+ years before I went back to grad school for psych. I was trying to keep it simple and as effective as possible. TL;DR is a real thing.

would plead never to share your real address anywhere when not strictly necessary, these databases are mostly for advertisement, some of these aggregators sell to more shady third parties as well tho.

Don't know why people always assume I'm talking about advertisers. I'm talking about people you meet on sites like this or other places where loli stuff can be found. The last thing you'll want is your DM's released and you're your personal info gets leaked. I think most people already know about info harvesting sites.

Obscurity remains the first, and best, defense against these things.

 

[VSCDB]

Good work man! The more you know the more scared you get sometimes. That's the truth of the world. Overall, I do a pretty poor job of keeping my personal details off the internet, but even I have some things I don't want to be associated with me in real life.

This honestly is fine, as I described it always comes down to your threat model, so keeping the relevant information of these sides and not easily make yourself searchable or reveal the other sources of information this is completely fine. Just don't make it easy to link these sources of information or best almost impossible for a single actor.

Post automatically merged: Apr 19, 2026

Don't know why people always assume I'm talking about advertisers. I'm talking about people you meet on sites like this or other places where loli stuff can be found. The last thing you'll want is your DM's released and you're your personal info gets leaked. I think most people already know about info harvesting sites.

Obscurity remains the first, and best, defense against these things.

Basically why I said the biggest threat is usually yourself. But making it harder to link this information to info dumps which largely come from hacked information harvesting groups and companies is a good practice nonetheless. Obscurity here is a very good defense since most actors will not go out of their way to invest that much time. The best is just shutting up about personal stuff and keeping a low profile.

 

[stilllife]

Thanks for the primer VSCDB. Luckily I already do all of the things in your OP for many years. Also remember people, that many areas of this forum (including the one we are posting in here) are completely wide-open. Any person in the world can read this.

 

[XiBjorg]

additional thoughts to consider:

Sandbox (f you use a sandbox and all of your apps are used inside it, this first item may not be an issue:

Avoid crossing any apps from public life to your private life. Browsers (esp if you use its "sync" service), online pw managers, and many other (online) apps send their login (and possibly diagnostic) info and perhaps home IP without you realizing it.​

​

VPN's

as good as they are, are not iron-clad! There have been VPN leaks found already in 2026. Even some OS's (yes, even Apple) literally allow some traffic to bypass VPN's intentionally. Unless you really know firewalls (and implement the controls), beware and avoid false confidence.​

​

Are you using VPN INSIDE the sandbox, or is all your sandbox (personal life) data going out with your public life data too?​

​

Tor (the browser and/or the network)

I haven't seen Tor mentioned yet. Check out tor.org for info. It's another (like VPN's, very strong but not perfect) layer that can complement the ones already listed.​

Open to any feedback or Q's

 

[bigusdickus233]

This is a great resource, somebody should clean up the discussion in comments into the main post, consolidate and turn it into a stickied post!

 

[m72o5xvz81]

Thread about online security

CTRL-F linux

No hits

OKAY THEN!

 

[xpop49]

The FBI can get any person when they set their mind to it...

So in reality there is no real privacy