notes i keep while learning operational security. basically: how do you make your systems and your identity harder to profile or go after. general stuff here, not a writeup of any one setup.
getting out to the internet
- push your traffic through a vpn or tunnel so your real address isn't the one everyone sees
- encrypted dns (doh/dot) so your lookups aren't just sitting there in plaintext
- pick resolvers that don't log or sell what you look up
the machine itself
- firewall that drops everything inbound by default, then only opens what a service needs
- kill services you don't use. every open port is another way in
- lock down the touchy kernel bits, keep stuff patched
you, the actual person
- different emails/identities for different things so accounts don't all point back to one you
- shrink your footprint: broker opt-outs, don't overshare, watch what a photo or pdf quietly gives away
- "deleted" online basically never means gone. real move is not posting it in the first place
secrets
- never commit creds. env vars or a secret store
- something leaked? rotate it. scan your repos before you push
i run some of this on my own boxes and keep adding to it. specifics of a live setup stay off the internet, which is kinda the whole point.