Secure-OS - Secure & Private Desktop Operating Systems

Two chain link gates held shut by a heavy chain and two padlocks, one brass and one dark grey, photographed close up with dry brown vegetation behind the mesh

SSH Permission denied (publickey): the Server Is Not Refusing Your Key, It Never Saw One

Sep 6, 2026 in ssh, authentication, linux - The message says publickey, so people regenerate keys. That is almost never the problem. In descending order of frequency: the wrong key was offered, the file permissions are too open, the username is wrong, or the server does not allow that method. How to find out in one command.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

Security Headers Checklist: Six Lines, and What 301 Public Bodies Actually Send

Sep 6, 2026 in headers, web security, csp - Six response headers are the ones every hardening guide lists. We measured them on 336 public organisations: 78 of the 301 that answered send none of the six, and Permissions-Policy is missing on eight sites out of ten. The list, in the order worth deploying it.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

Your BitLocker Recovery Key Is in Your Microsoft Account, and Nobody Asked You

Sep 5, 2026 in encryption, windows, threat-model - On most consumer Windows PCs the BitLocker recovery key is uploaded to the Microsoft account used at setup. That is why people find it, and it is also the part of the threat model most users never agreed to. Where it lives, how to check, and what changes if you remove it.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

How to Disable Windows 11 Telemetry, and What Each Setting Actually Stops

Sep 5, 2026 in windows, privacy, telemetry - The settings that reduce Windows 11 telemetry are real, and the tools that promise to remove it entirely are mostly not. What Required diagnostic data covers, which switches change something measurable, and where the honest limit sits.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

How to Check if a Linux Server Is Compromised: the Order Matters More Than the Commands

Sep 5, 2026 in linux, forensics, incident-response - Every checklist gives you the same commands. Almost none of them tell you that running those commands on the suspect machine is exactly what an attacker prepared for. Here is what to look at, in the order that still tells you something.

📅 5 min read🛡️ Threat-model-first

secure-os wrote

How to Tell if a Wi-Fi Network Is Fake, and Why the Padlock Will Not Tell You

Sep 5, 2026 in wifi, privacy, network - A rogue hotspot looks exactly like the real one, because it is allowed to. The name, the signal and the captive portal can all be copied in minutes. Here are the signals that actually distinguish them, and the one habit that makes the question stop mattering.

📅 5 min read🛡️ Threat-model-first

secure-os wrote

Linux Audit Log Commands: the Six That Answer Real Questions

Sep 5, 2026 in linux, logging, auditd - journalctl, ausearch, aureport, last, lastb and auditctl cover almost everything you will ever need to ask a Linux system about its own past. What each one sees, what none of them see, and why a log on the machine is evidence of a different quality than a log shipped off it.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

gpg: decryption failed: No secret key. What It Means, and the Four Causes

Sep 5, 2026 in gpg, encryption, troubleshooting - The message is precise and almost everyone misreads it. GPG is not saying your key is wrong, it is saying the key that can open this file is not in the keyring it is looking at. Here is how to find out which key the file wants, and the four reasons yours is missing.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

How to Check if a USB Drive Is Bootable, Without Rebooting to Find Out

Sep 5, 2026 in usb, boot, linux - You can tell whether a stick will boot by reading its partition table, its boot flag and its EFI directory. Three commands on Linux, two on Windows, one on macOS. What each check proves, and the one it cannot.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

SSH Key vs Password Authentication: the Difference Is What Crosses the Network

Sep 5, 2026 in ssh, authentication, linux - A password is a secret you send. A key is a secret you never send. That one distinction settles most of the argument, decides what a compromised server can steal from you, and explains why key authentication is not simply a stronger password.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

What Is a Canary Token? A Tripwire That Costs Nothing and Only Fires When You Are Already Wrong

Sep 5, 2026 in detection, intrusion, monitoring - A canary token is a file, a URL or a credential that has no legitimate use. Nothing should ever touch it, so the day something does, you learn about an intrusion your other tools missed. What they detect, where to place them, and the two ways people ruin them.

📅 4 min read🛡️ Threat-model-first

secure-os wrote

Is a Double VPN Worth It? What the Second Hop Actually Buys

Sep 4, 2026 in vpn, anonymity, threat-model - A double VPN sends your traffic through two servers instead of one. What that genuinely protects against, what it costs in speed and latency, and the common cases where it changes nothing at all because the weak link is somewhere else entirely.

📅 5 min read🛡️ Threat-model-first

Operating systems

Qubes, Tails & Whonix

Which secure OS fits which threat model - compartmentalisation vs amnesic vs Tor-routed.

Read the guides →

Encryption

Full disk encryption

LUKS, BitLocker, FileVault and VeraCrypt - what each protects, and what it does not.

Read the guide →

Hardening

Threat-model-first Linux

Practical hardening built around the adversary you actually face.

Read the guide →