Hi! 2 and 4 months ago @Hellfire103 and @Charger8232 made a post about their privacy setup. So I though I would also share mine.

Remember these rules:

• Be respectful! Some people are early on in their privacy journey, or have a lax threat model. Just because it doesn’t align with yours, or uses some anti-privacy software, doesn’t mean you can downvote them! Help them improve by giving suggestions on alternatives.

• Don’t promote proprietary software! Proprietary software, no matter how good it may seem, is against the community rules, and generally frowned upon. If you aren’t sure, you can always ask! This is a place to learn. Don’t downvote people just because they don’t know!

-** Don’t focus solely on me!** I want to mention that this thread is not designed to pick apart only my setup. The point is to contribute your own and help others. That doesn’t mean you can’t still give suggestions for mine, but don’t prioritize mine over another.

• Be polite! This falls under “Be respectful”, but be kind to everyone! Say please, thank you, and sorry. Lemmy is really good about this, but there will always be someone.

Here is my setup:

Web browsing

• I use Librewolf for almost everything.
• For 3D stuff (games, 3d modelling) I use Brave.
• On mobile I use Vanadium.
• My preferred search engine is Kagi.
• Most if the time I have MullvadVPN enabled.

Desktop and laptop

• I have self-build Ryzen + Radeon PC and Ideapad with Ryzen CPU.
• I use Arch Linux BTW!
• I have disk encryption and Nitrokey as a decryption key (or a long password of course).
• I have secure boot with locked BIOS.
• I'm running self-compiled linux-hardened kernel.
• I'm using Gnome (Wayland).
• I have only open-source apps installed.

Mobile

• I have Google Pixel 7a with GrapheneOS.
• I have different 5 profiles: main, google, school, finance, anonymous.
• I have PIN on every profile and also fingerprint for main and school profiles.
• I always use VPN, either Mullvad or self-hosted Wireguard.
• I don’t use a privacy screen protector (for now).

Messenger

• Signal for my family.
• Viber for my schoolmates.
• MS Teams for school.
• Matrix for help with some open-source projects.
• Discord for voice chat and local scouts group. I have Aliucord on mobile and Armcord on desktop.

Online accounts

• Passwords are safe in self-hosted Bitwarden (Vaultwarden).
• I use 2FA if I can. Either hardware 2FA - Nitrokey, or TOTP with Aegis.
• I use SimpleLogin for email aliases and randomly generated usernames and passwords.

Video streaming

• I watch only Youtube. Newpipe on mobile and Invidious on desktop.

AI

• I do not use AI a lot, but if I do I use locally running LLama3 8B or Duckduckgo's LLama3 70B

Social Media

• I had Instagram, Snapchat and Viber accounts, but I've deleted them.
• I use only Lemmy on clearweb and Dread on darkweb.
• I have Mastodon account, but I don't use it.

Email

• I use ProtonMail.
• One of the best privacy things you can do is use SimpleLogin (or other email alias service).

Shopping/Finance

• IRL I use cash most of the time.
• Online I use Monero if I can, otherwise just my credit card.
• Cashew app for helping managing my purchases.

Music streaming

• I use only RiMusic on my phone, that's it.

TV shows

• I use a VPN, that's all I'm gonna say...

Gaming

• Minecraft, Veloren, SuperTuxKart, and some Steam games.

Programming

• I forgot how to code in Python, because Rust is so much better.
• VS Codium.

Productivity

• LibreOffice for simple stuff.
• Typst for proper documents.

Paid services

• ProtonMail - 4$ per month
• SimpleLogin - 30$ per year
• MullvadVPN - 5$ per month
• Kagi - 10$ per month. For 5$ you get 300 searches, I use ~350 searches so I will try to lower my searches.
• Domain - 13$ per year

Self-hosted

• Everything runs on Raspberry Pi 4 with encrypted micro SD card.
• Pi-Hole for blocking ads on network level.
• Bitwarden (Vaultwarden) for storing all my passwords.
• Wireguard server (with pihole as DNS) for connecting back home from anywhere.
• Ntfy for self-hosted push notifications.
• MollySocket for Signal push notifications.
• FindMyDevice if I lost my phone.
• Cloudflare DDNS, because I don't have static IP.
• Nginx Proxy Manager.
• Watchtower automatically updates docker containers.
• My website.

Misc

• I have Samsung Galaxy Watch 4 classic. I'm trying to do something about it...
• I'm using Syncthing to sync documents and pictures between my devices.
• I don't have a car (because I can't - I'm 17) and I won't have one for quite some time. I have a bicycle and my parents have 2 (smart/spy) cars.
• I'm into crypto (mostly XMR) and I'm trading a little (making a trading bot) on MEXC. I also have Ledger Nano S Plus.
• I have a 3d printer and it's fun and usefull :)

TODO

• self-host Git repos for my projects.
• Buy a privacy screen protector when I break my current one.
• Buy a faraday bag, just in case.
• Do something about my spywatch (maybe sell).
• Make backups... Yep, I don't have any yet.
• Monitor and harden all my devices.
• Memorize cryptowallet's private key in case it gets lost.

Thanks for reading!

I have Galaxy Watch 4 and Pixel with GrapheneOS. Currently I have second profile with galaxy wearable and google play services for connecting to the watch. Before I've installed graphene I was using my watch as any other person, for notifications, sports, etc. Now I use it only for checking what time is it and developing apps. I can see my sports activity only for a week back, because samsung health only works on main profile.

Is there a way for me to use my watch on main profile without google and samsung apps? Maybe with some alternative app? Or should I sold my watch and buy a new one? I've heard good things about garmin and polaris? I would love option to develop my own apps on them.

This is probably not the right community but I haven't found a better one.

So I watched a video from Seytonic where he mentiond that some malware creates a windows link with the name of the usb on a usb. So I checked my usb because I remembered that I had to click 2 times on my usb to opened it. I found a link that contained cmd.exe and a name of a file next to it. Upload to the virustotal showed Raspberry Roblin worm.

I use Linux but my familly uses windows so I will have to go through all familly computers and remove the worm. Where can I find info how to remove this specific worm - Raspberry Roblin? On google I found a description about how the worm works but not specific files it creates and how to remove it.

The first page that shows up is microsoft.com and it says that windows defender detects the worm, but clearly it doesnt.

Edit: The worm was on one computer and it did not have windows defender installed. Seems like malware removed it and also disabled automatic updates. I installed MalwareBytes and sucessfully removed the worm :)

I found a few old phones from my family. II cleaned them, installed LineageOS and rooted most of them. On one I installed postmarketOS, one is still stock Android and one is lets say bricked (after installing lineagesos it stay on boot logo for ever, before that I installed lineageos and nethunter on it). One one disk encryption doesnt work for some reason.

Phones (all samsung galaxy):

• S4
• A5
• A5 (bricked)
• A5 (postmarketOS)
• J3
• J4+ (no encryption)
• A31 (stock)

What can I do with them? Something like Monero node or Tor relay, but I'm already running that on old pc. For something that needs speed I have rpis (like a website). Camera security system? Tracking device?

Is it possible to run (and autorun) cli apps and/or services that can access interent, bluetooth, gps, sensors, camera, files, etc. just like on linux? I'm a programmer and I don't like making normal android apps for a simple project.

Hi, I'm working on a PQC key establishment and authentication protocol. Currently it works like this:

1. Client and server each generate ECDSA and Dilithium identity keys and share them between each other, with usb for example.
2. Client sends to the server single-use ECDH public key, single-use Kyber public key, timestamp, ECDSA and Dilithium signature of everything before it.
3. Server verifies the message using clients identity keys, generates 2 secrets, one from ECDH and one from Kyber and then it uses blake3 kdf to derive a key from both secrets. Then it sends response with single-use ECDH public key, Kyber ciphertext, timestamp, ECDSA and Dilithium signature of everything before it.
4. Client verifies the message using servers identity keys, and generates 2 secrets, one from ECDH and one from Kyber ciphertext and then it uses blake3 kdf to derive a key from both secrets.

Kyber: kyber1024 ECDH: secp256k1 ECDSA: secp256k1

I will use the key for XChaCha20-blake3 aead. I don't know yet how will I generate and keep track of used/unused nonces.

Building this was interesting and fun, but I want more. How can I improve this key exchange, make it more secure, faster, and smaller? Both messages are huge (6268 bytes), because of Kyber and Dilithium.

Any ideas for what application could be this used?

Hi, I'm in a process of making fast, (extrenely) secure, and modern laptop. Currently I have Arch Linux with encrypted root partition (unlocked with Nitrokey or long password), secure boot, linux-hardened, firewalld, etc.

I'm running linux-hardened with custom config. I enabled AMD SME, kernel lockdown, added some xanmod patch for more specific cpus, and disabled some unnedded drivers (only those that I'm 100% sure I don't need - Intel, NVidia, Microsoft, Google, Amazon, Virtio). Currently it takes ~50 minutes to recompile the kernel. Are there any tutorials what drivers to disable to speed up this process? After doing that I will try to compile it with -O3 and LTO. Do you know any patches for performance?

I'm planning to enable encrypted swap, install ClaimAV and install flatpak versions for every non open-source app I have.

I also want to have SELinux. Does anyone know where can I learn it? I had it on Fedora and it was not fun using it.

What are other ways I can make my laptop more secure?

I have Arch Linux on Ryzen 7 3700X, 32gb of ram, and some Gigabyte motherboard with updated bios.

Few weeks ago my computer would startet crashing (screen would freeze) soon after login or even at boot about 50% of the time. I was lazy so when it crashed I just forced rebooted it (the power button). Then crashes became more common untill my system wouldn't even boot.

So I reinstalled and I had some trouble generating dracut bundles, because some zstd copression was corrupted. After booting freshly installed os it would crash again right before the login should show up. Switching kernel (from hardened to zen) fixed the problem. Then I installed basic apps (browsers, office, crypto stuff, steam, etc.) I rebooted and when I typed the password for my encrypted root it was wrong (Im sure I typed it correctly).

I have no idea wtf went wrong with my system. I have almost the same everthing on my laptop (hardened, btrfs, luks encrytped drives, systemd boot, etc.) and it works great. And I never experienced any crashes on live usb on my pc.

I ran some random test (its passmark memtest86 v9.3 pro) on my medicat usb. Right now its 92% finished with 1070 errors. This just can't be good :(

Now I will play with some bios settings (like disable xmp), reflash other version, maybe switch a ssd... I will also try other distro, but I can't daily drive them. Arch gives me a ton of flexibility and I don't want to lose it. Maybe NixOS or Gentoo, but gentoo doesnt have systemd (I want to use Mullvad as my vpn and their app reqires it).

Do you maybe know what could be wrong and how to fix it. Thank you for reading this post and thank you very much for answering.

I don't know if this is arch bug or its something wrong with my system. If this is not right community to ask this, plese direct me to the right one (just please not reddit).

Edit: I ran memtest again without one ramstick and it gave me no errors! Thank you for all help and suggestions :)

Edit: I also tried only the faulty ram stick and the PC wouldn't even boot.

Edit: Booting PC with only the faulty ram stick corrupted my bios... I guess I will have to reflash bios anyway.

Hi, I made trading bot using binance api. Is there any platform that has api, but doesnt require kyc?

I want to make my own website, like a blog where I talk about tech and tutorials and such. Something like https://kerkour.com and https://lukesmith.xyz. Any ideas for simple but modern design?

Hi, I'm building a personal website and I don't want it to be used to train AI. In my robots.txt file I blocked:

• ChatGPT-User
• GPTBot
• Google-Extended
• FacebookBot

What bots should I also add? Are there any other ways to block AI bots?

IMPORTANT: I don't want to block search engine crawlers, only bots that are used to train AI.

Hi, I'm thinking of building a personal website about tech, privacy, open source, etc. Any recommendations about where can I buy domain? .com is taken, but everything else is not. Shuld I take .tech (few dolars more expensive) or something more basic?

I use Pi-Hole and works great. I've heard about AdGuard and seems the same thing as PiHole, but you have to install an app/extension. Everyone in this community recommend NextDNS. Whats the difference between them?