~/setups/hardened
Hardened Setup
last updated 2026-06-12 · weeks, then a practice · ~€15/mo + hardware · what changed
Maximum practical security for people with real threats.
Who this is for: journalists protecting sources, activists,
abuse survivors with a determined ex, researchers in hostile jurisdictions,
anyone for whom a specific someone is part of the model. The friction
here is real and daily. If you're here out of curiosity, read on; if you're here
out of need, also seek advice specific to your situation: this page is a strong
baseline, not a complete answer.
read this first
At this tier,
habits beat tools. A perfect setup operated carelessly
loses to a decent setup operated with discipline. The most common failure isn't
cryptographic: it's reusing an identity across compartments, once.
Prerequisites:
beginner and
standard, fully internalized.
the setup
GrapheneOS on a Pixel
phone
The most hardened consumer OS, with Google optional and sandboxed.
Why it's here: the phone is the sensor package in your pocket,
and at this tier it has to be trustworthy, not just tidy.
- Buy a supported Pixel: in cash, in person, if purchase records are in your
model.
- Install via the official web installer (grapheneos.org) from a computer you
trust; verify the fingerprints it shows.
- Skip sandboxed Play if you can live on F-Droid + Aurora Store; install it in
a separate profile if you can't.
- Set a strong unlock passphrase (not just biometrics), enable the duress PIN,
and set auto-reboot (Settings → Security) so a seized phone returns to
before-first-unlock encryption.
- Per-app: deny network to anything that doesn't need it; use storage scopes
instead of full storage access.
Compartmentalized identities
method, not software
freeongoing disciplinethe actual hard part
Separate identities for separate contexts (activism, work, personal) with
no shared emails, phone numbers, payment methods, usernames, or writing
quirks across them. Why it's here: most deanonymization isn't broken
crypto, it's one careless link between two lives.
- Write down your compartments and what belongs in each. On paper. Two is
manageable; four is a part-time job, be honest.
- Each compartment gets its own email (separate provider accounts, not
aliases of one), its own passwords, its own browser profile or device.
- Sensitive compartments get their own payment rail: cash, Monero, or
prepaid cards bought with cash.
- Never cross the streams: no logging into compartment A from compartment B's
browser, no shared profile photos, no same turns of phrase. One crossover can
retroactively link years of history.
Qubes OS (or hardened Fedora)
desktop
Qubes runs every task in its own disposable VM: compartmentalization enforced
by architecture instead of willpower. Why it's here: it makes
the identity separation above mechanical. If your hardware or patience won't
carry Qubes, hardened Fedora is the honest fallback.
- Check the Qubes hardware compatibility list first: 16GB+ RAM, and it's
picky. Install with full-disk encryption (default).
- Create one qube per compartment, color-coded; route the sensitive ones
through the built-in Whonix/Tor qubes.
- Open every attachment and unknown link in a disposable VM:
this habit alone retires the most common attack on people like you.
- Fedora fallback: FDE at install, automatic updates, Firefox or
LibreWolf, separate user accounts per
compartment, USBGuard for unknown devices.
Tails on a USB stick
the sessions that can't exist
Boots on nearly any computer, routes everything through Tor, forgets everything
at shutdown. Why it's here: for research, contact, or
whistleblowing where the work must leave no trace on the machine, including
a machine that isn't yours.
- Flash Tails to a quality USB stick following tails.net's verified
instructions.
- Boot it once at home to learn the ropes before you need it under
pressure.
- Add encrypted persistent storage only if you must keep state; amnesia is
the feature.
- If sources contact you, learn SecureDrop/OnionShare on top, and test the
workflow end-to-end with a friend first.
Anonymous-grade communications
messaging
Signal with hardened settings for daily life; SimpleX where even a phone
number is too much identifier; Briar where servers or the internet itself
can't be trusted. Why it's here: at this tier metadata
(who, when, how often) is as sensitive as content.
- Signal: username sharing only, disappearing messages default (1 day),
registration lock PIN on, "sealed sender from anyone" enabled, relay calls
through Signal's servers.
- If the phone number itself is a risk, register Signal on a number that
isn't yours (a burner or VoIP number set up inside the right compartment),
or move that compartment to SimpleX,
which has no user identifiers at all.
- Install Briar as the fallback channel
with your closest contacts, agreed on before the day the internet
gets weird.
- Email for anything sensitive: don't. If unavoidable, PGP between consenting
adults who both know what they're doing, and still assume the metadata leaks.
Money & footprint hygiene
the unglamorous layer
variesongoingboring, decisive
Payments and public records betray more than packets do.
Why it's here: the adversaries this tier worries about
subpoena databases and search people-finder sites; they rarely break TLS.
- Mullvad paid with cash by post (or Monero) inside the sensitive compartment;
always-on, kill switch locked.
- Scrub people-search/data-broker sites, manually or via a removal service,
and re-check quarterly; they regrow like weeds.
- Mail forwarding or a PO box so your street address stops appearing on
shipping labels and registrations.
- Lock your credit file (or your country's equivalent): it's free and closes
the identity-theft branch of the tree.
- Physical safety where your model calls for it: hardware keys on your person,
devices never left unattended at borders, and a rehearsed answer for "unlock
this, please."
after setup
Drill the failure modes. What happens if the phone is seized
today? If the laptop is stolen? If a key is lost? Walk each scenario while
calm, and the answers should be "annoying," never "catastrophic." Where one is
catastrophic, that's the next thing to fix.
Schedule maintenance like it's rent. Monthly: updates everywhere,
broker-site re-check, backup verification (restore one file: a backup you've
never restored is a hope, not a backup). Quarterly: compartment audit (what
leaked across? What got lazy?)
Common pitfall: the convenience relapse. Hardened setups erode
one "just this once" at a time. When friction genuinely exceeds the threat,
don't cheat silently: re-model and downgrade deliberately. An honest
Standard beats a leaky Hardened.
You don't have to do this alone. Access Now's Digital Security
Helpline, the EFF's Surveillance Self-Defense guides, and Freedom of the Press
Foundation's training materials are free, current, and written by people who do
this professionally. For intimate-partner threats, the Coalition Against
Stalkerware lists vetted local resources.
checklist
- Beginner + Standard done and habitual
- GrapheneOS flashed and verified; duress PIN + auto-reboot configured
- Compartments defined on paper; separate email/payment/browser per compartment
- Qubes (or hardened Fedora) with FDE; attachments open in disposables only
- Tails stick made, tested, and stored where you can reach it
- Signal hardened (registration lock, disappearing default); Briar agreed with key contacts
- VPN paid anonymously, always-on in sensitive compartments
- Broker sites scrubbed; credit frozen; mail forwarding in place
- Failure-mode drill done: every answer is "annoying," none is "catastrophic"
- Maintenance recurring on a calendar you actually check