Search
91 guides
secure-os wrote
Sep 6, 2026 in ssh, authentication, linux - The message says publickey, so people regenerate keys. That is almost never the problem. In descending order of frequency: the wrong key was offered, the file permissions are too open, the username is wrong, or the server does not allow that method. How to find out in one command.
Read more…secure-os wrote
Sep 6, 2026 in headers, web security, csp - Six response headers are the ones every hardening guide lists. We measured them on 336 public organisations: 78 of the 301 that answered send none of the six, and Permissions-Policy is missing on eight sites out of ten. The list, in the order worth deploying it.
Read more…secure-os wrote
Sep 6, 2026 in windows 11, copilot, privacy - Hiding the button, disabling the feature by policy, and uninstalling the package are three different things with three different outcomes. Which one survives an update, which one needs Pro, and the honest answer about what still runs afterwards.
Read more…secure-os wrote
Sep 6, 2026 in phone, scams, privacy - Blocking numbers one by one cannot keep up with software that changes number every call. What actually reduces the volume is carrier filtering, a setting already on your phone, and one habit that costs nothing. Also: why answering at all makes it worse.
Read more…secure-os wrote
Sep 6, 2026 in phone, theft, accounts - Locating it is not the first thing to do, and it is rarely the useful one. What matters in the first hour is the accounts the phone was signed into and the SIM that receives your codes. The order that limits the damage, and the two steps to take before it ever happens.
Read more…secure-os wrote
Sep 6, 2026 in privacy, photos, metadata - Every photo your phone takes carries a hidden block of data, and on a photo taken at home that block can include the coordinates of your front door. Here is how to see what is in yours, strip it on each platform, and which sharing apps remove it for you already.
Read more…secure-os wrote
Sep 6, 2026 in tracking, phone, privacy - An AirTag that is not with its owner will try to alert you, but only once several conditions line up. Here is what the alert actually says, why Android detection works differently, how to make a tracker reveal itself on purpose, and what to do once you have found one.
Read more…secure-os wrote
Sep 6, 2026 in search, data, zero-click - We pulled every query our site ranked for on Bing and found 130 queries with impressions and not one click. Position was not the cause. The full table, the control group that proves the data is sound, and the one rule it changed about which queries are worth writing for.
Read more…secure-os wrote
Sep 5, 2026 in encryption, windows, threat-model - On most consumer Windows PCs the BitLocker recovery key is uploaded to the Microsoft account used at setup. That is why people find it, and it is also the part of the threat model most users never agreed to. Where it lives, how to check, and what changes if you remove it.
Read more…secure-os wrote
Sep 5, 2026 in windows, privacy, telemetry - The settings that reduce Windows 11 telemetry are real, and the tools that promise to remove it entirely are mostly not. What Required diagnostic data covers, which switches change something measurable, and where the honest limit sits.
Read more…secure-os wrote
Sep 5, 2026 in linux, forensics, incident-response - Every checklist gives you the same commands. Almost none of them tell you that running those commands on the suspect machine is exactly what an attacker prepared for. Here is what to look at, in the order that still tells you something.
Read more…secure-os wrote
Sep 5, 2026 in wifi, privacy, network - A rogue hotspot looks exactly like the real one, because it is allowed to. The name, the signal and the captive portal can all be copied in minutes. Here are the signals that actually distinguish them, and the one habit that makes the question stop mattering.
Read more…secure-os wrote
Sep 5, 2026 in linux, logging, auditd - journalctl, ausearch, aureport, last, lastb and auditctl cover almost everything you will ever need to ask a Linux system about its own past. What each one sees, what none of them see, and why a log on the machine is evidence of a different quality than a log shipped off it.
Read more…secure-os wrote
Sep 5, 2026 in gpg, encryption, troubleshooting - The message is precise and almost everyone misreads it. GPG is not saying your key is wrong, it is saying the key that can open this file is not in the keyring it is looking at. Here is how to find out which key the file wants, and the four reasons yours is missing.
Read more…secure-os wrote
Sep 5, 2026 in usb, boot, linux - You can tell whether a stick will boot by reading its partition table, its boot flag and its EFI directory. Three commands on Linux, two on Windows, one on macOS. What each check proves, and the one it cannot.
Read more…secure-os wrote
Sep 5, 2026 in ssh, authentication, linux - A password is a secret you send. A key is a secret you never send. That one distinction settles most of the argument, decides what a compromised server can steal from you, and explains why key authentication is not simply a stronger password.
Read more…secure-os wrote
Sep 5, 2026 in detection, intrusion, monitoring - A canary token is a file, a URL or a credential that has no legitimate use. Nothing should ever touch it, so the day something does, you learn about an intrusion your other tools missed. What they detect, where to place them, and the two ways people ruin them.
Read more…secure-os wrote
Sep 4, 2026 in vpn, anonymity, threat-model - A double VPN sends your traffic through two servers instead of one. What that genuinely protects against, what it costs in speed and latency, and the common cases where it changes nothing at all because the weak link is somewhere else entirely.
Read more…secure-os wrote
Sep 4, 2026 in surveillance, privacy, travel - A hidden camera is found by systematic inspection, not by a gadget. Which objects actually host them, why the lens reflection trick works and when it does not, what a network scan can and cannot tell you, and what to do if you find one.
Read more…secure-os wrote
Sep 4, 2026 in vpn, privacy, isp - Your provider stops seeing which sites you visit the moment a VPN is on. It still sees that you are using one, how much you send and when. And browsing history is a separate thing entirely, because it lives on your device, not at the provider.
Read more…secure-os wrote
Sep 4, 2026 in messaging, anonymity, metadata - Session drops phone numbers and central servers, Signal keeps both and encrypts everything else. What each one hides from whom, what Session gives up to get anonymity, and the single question that decides which of the two you actually need.
Read more…secure-os wrote
Sep 4, 2026 in mobile, 2fa, account-security - A SIM swap moves your number to someone else's card, and every code sent by text follows it. What actually stops the attack at the carrier, why SMS two-factor is the wrong lock, and the ten minutes that decide whether you keep your accounts.
Read more…secure-os wrote
Sep 4, 2026 in vpn, privacy, network - A kill switch cuts your internet the moment the VPN tunnel drops, so nothing leaves in the clear. What it protects, the gap between blocking one application and blocking the whole device, and how to test yours in two minutes instead of trusting the label.
Read more…secure-os wrote
Sep 4, 2026 in vpn, privacy, network - Split tunneling sends some applications through the VPN and lets the rest use your ordinary connection. What it fixes, the three ways it quietly leaks, and the one question that tells you whether to turn it on.
Read more…secure-os wrote
Sep 4, 2026 in vpn, privacy, network - A VPN sends your traffic through an encrypted tunnel to a server that then talks to the internet for you. What that hides, who sees it instead, and the four common expectations it does not meet.
Read more…secure-os wrote
Sep 4, 2026 in tor, anonymity, network - Tor sends your traffic through three volunteer relays, each of which knows only its neighbours. How the layers work, why it is slow on purpose, and the difference between what Tor hides and what a VPN hides.
Read more…secure-os wrote
Sep 4, 2026 in vpn, protocols, privacy - WireGuard is faster, smaller and reconnects instantly. OpenVPN is older, slower and hides better on hostile networks. What each protocol gives up to get what it is good at, and the one privacy detail your provider has to solve for you.
Read more…secure-os wrote
Sep 4, 2026 in privacy, browser, tracking - Fingerprinting identifies you by how your browser is configured, not by a cookie you can delete. How to check your own in two minutes, why installing more privacy extensions often backfires, and the only two approaches that genuinely work.
Read more…secure-os wrote
Sep 4, 2026 in encryption, windows, cloud - Password-protecting a folder, encrypting it into a container, and turning on full disk encryption solve three different problems. Which one matches your actual threat, what each leaves visible, and the mistake that makes cloud folders leak anyway.
Read more…secure-os wrote
Sep 3, 2026 in phishing, 2fa, mfa - Adversary in the middle phishing proxies the real login page in real time, so the code from your authenticator app lands in the attacker's hands and the stolen session cookie keeps working after you close the tab. How AiTM works, why one factor type survives it, and what to check.
Read more…secure-os wrote
Sep 3, 2026 in surveillance, privacy, alpr - Automatic license plate readers photograph every car that passes, not only wanted ones, and keep the plate, the time, the place and often the image. What ALPR collects, how long networks retain it, why a retention period is the real privacy setting, and what you can and cannot do about it.
Read more…secure-os wrote
Sep 2, 2026 in encryption, cryptography, standards - A working list of the encryption algorithms in real use today - AES, ChaCha20, RSA, Ed25519, SHA-2, Argon2id - what each one is for, which are officially retired, and what the post-quantum standards change.
Read more…secure-os wrote
Sep 2, 2026 in linux, distros, hardening - Kicksecure is a security-hardened Debian derivative from the Whonix developers. What it hardens, how it differs from Whonix and Tails, who it is for, and its honest limits.
Read more…secure-os wrote
Aug 1, 2026 in ssh, fail2ban, hardening - Fail2ban bans IP addresses after repeated failed logins, which lowers the noise in your logs. The project itself states it cannot eliminate the risk of weak authentication, and names what to use instead.
Read more…secure-os wrote
Jul 31, 2026 in linux, hardening, systemd - systemd-analyze security scores services from 0 to 10, but the manual is explicit that a high score does not mean a service is vulnerable. What the tool measures, what it cannot see, and why settings must be combined.
Read more…secure-os wrote
Jul 18, 2026 in email, encryption, pgp - How to encrypt your email in 2026, step by step: the easy way with an end-to-end provider like Proton Mail, PGP/GPG for full control, and S/MIME. Honest limits on metadata, subject lines and what encryption really covers.
Read more…secure-os wrote
Jul 16, 2026 in security, uefi, boot - A trusted signature is only as good as the code behind it, which is the whole reason the dbx revocation list exists. What Secure Boot protects in the boot chain, what it was never meant to stop, and the signed-but-vulnerable bootloader class that proved the difference.
Read more…secure-os wrote
Jul 14, 2026 in linux, distros, hardening - Immutable Linux distros keep the system read-only and update it as atomic image swaps you can roll back. What that means, the real security benefits, the honest trade-offs, and which distros to look at in 2026.
Read more…secure-os wrote
Jul 9, 2026 in linux, wayland, x11 - X11 lets any running app read your keystrokes and capture other windows. Wayland was designed to close that gap. What each does, the honest caveats (XWayland, portals), and why a security desktop should prefer Wayland.
Read more…secure-os wrote
Jul 9, 2026 in privacy, browser, duckduckgo - DuckDuckGo's browser now blocks most YouTube video ads by default, using open-source uBlock Origin filter lists. What it does, the honest limits, and how content blocking fits a private-browser setup.
Read more…secure-os wrote
Jul 3, 2026 in messaging, encryption, hardware key - Darkup is a new French encrypted messenger that ties your identity to a physical security key and uses Signal's Double Ratchet. Here is what it claims, how it is priced, and why it is not yet proven.
Read more…secure-os wrote
Jul 2, 2026 in whatsapp, username, privacy - WhatsApp is rolling out optional usernames so you can share an @handle instead of your phone number. Here is what the privacy feature actually protects, its rollout timeline, and the limit it does not solve.
Read more…secure-os wrote
Jun 30, 2026 in privacy, location-data, fourth-amendment - On June 29, 2026, the US Supreme Court ruled 6-3 in Chatrie v. United States that a geofence warrant is a 'search' under the Fourth Amendment. What the Court held, what it changes, what it doesn't - and the location-privacy habits that still matter.
Read more…secure-os wrote
Jun 29, 2026 in tails, encryption, persistence - Tails is amnesic by default. The Persistent Storage is an optional LUKS-encrypted volume on the same USB stick. How to create it, what to keep, and why it won't unlock.
Read more…secure-os wrote
Jun 28, 2026 in grapheneos, calyxos, android - GrapheneOS vs CalyxOS compared honestly: security hardening vs microG compatibility, supported Pixel devices, the Google-services model, ease of use, and which de-Googled Android fits your threat model.
Read more…secure-os wrote
Jun 28, 2026 in encryption, data-sanitization, opsec - Why shred and dd do not work on solid-state drives, and the methods that do: ATA Secure Erase, NVMe Format and Sanitize, and crypto-erase by destroying the key.
Read more…secure-os wrote
Jun 26, 2026 in linux, antivirus, malware - Does Linux need antivirus? The honest answer, when it actually matters (servers, mail gateways, mixed Windows networks), the real tools - ClamAV, rkhunter, chkrootkit - and the layered defenses that protect a desktop better than a virus scanner.
Read more…secure-os wrote
Jun 25, 2026 in linux, sandboxing, firejail - A practical guide to Firejail, the SUID sandbox that confines Linux applications using namespaces and seccomp. Covers installation, profiles, common commands, real limitations, and how it compares to Flatpak and Bubblewrap.
Read more…secure-os wrote
Jun 24, 2026 in linux, hardening, apparmor - AppArmor vs SELinux compared by design, real-world maintenance and threat model. A practical guide to choosing the right Mandatory Access Control system for your Linux machine.
Read more…secure-os wrote
Jun 23, 2026 in keylogger, malware, passwords - A keylogger records every key you press to steal passwords and private data. What a keylogger is, the software and hardware types, how to detect one, and how to protect yourself.
Read more…secure-os wrote
Jun 23, 2026 in botnet, malware, ddos - A botnet is a network of devices secretly controlled by an attacker. What a botnet is, how it works, what it is used for (DDoS, spam, fraud), and how to keep your devices out of one.
Read more…secure-os wrote
Jun 23, 2026 in social-engineering, phishing, security - Social engineering tricks people into giving up access or information instead of breaking the tech. What it is, the main tactics (phishing, pretexting, baiting), real examples, and how to defend against it.
Read more…secure-os wrote
Jun 22, 2026 in threat-model, opsec, privacy - A threat model is a simple plan that answers four questions: what you protect, who you protect it from, how likely the risk is, and what it costs to defend. Build one in minutes, without paranoia, so your security effort matches your real risks.
Read more…secure-os wrote
Jun 22, 2026 in linux, sandboxing, security - Linux sandboxing confines an application so that, if it is compromised, the damage stays contained. What sandboxing is, how Flatpak, Firejail, bubblewrap and containers do it, and how it fits a real defense-in-depth setup.
Read more…secure-os wrote
Jun 22, 2026 in malware, rootkit, security - A rootkit is malware that hides deep in your system to keep control while staying invisible. What a rootkit is, the types, the warning signs, how to detect one, and why a clean reinstall is often the only sure fix.
Read more…secure-os wrote
Jun 21, 2026 in phishing, ai, security - AI-generated phishing surged roughly 14× in 2026, and the FBI logged more phishing complaints than any other crime category in 2025. Here's how to spot a modern phishing attempt and the practical steps that actually prevent it.
Read more…secure-os wrote
Jun 20, 2026 in phishing, security, email - Two of the ten messages in our test are legitimate, and one of those two carries every trait of a scam, so answering fraudulent to everything caps you at 8 out of 10 by design. The seven signs first, then the test that shows whether you can run them under pressure.
Read more…secure-os wrote
Jun 20, 2026 in linux, arch, aur - In June 2026 hundreds of Arch User Repository packages were hijacked to deploy an infostealer and an eBPF rootkit. What actually happened, why the AUR is structurally riskier than Arch's official repos, and a practical routine to vet AUR packages before you install them.
Read more…secure-os wrote
Jun 19, 2026 in firewall, security, network - A firewall decides which network traffic is allowed in or out of your device or network. What a firewall is, how it works, the main types (hardware, software, stateful), what it can and can't protect against, and how it fits into real security.
Read more…secure-os wrote
Jun 19, 2026 in phishing, security, email - Phishing tricks you into handing over passwords or money by impersonating someone you trust. What phishing is, the main types (email, spear, smishing, vishing), the red flags, and the defenses that actually work - 2FA and a password manager.
Read more…secure-os wrote
Jun 19, 2026 in 2fa, authentication, security - SMS falls to a SIM swap, push prompts fall to your own reflex to approve, and recovery codes bypass 2FA by design because that is what they are for. The five methods ranked weakest to strongest, the attack that beats each one, and the backup that stops you locking yourself out.
Read more…secure-os wrote
Jun 18, 2026 in encryption, gpg, pgp - GPG vs PGP confuses everyone - because they're not really competitors. PGP is the original encryption program, OpenPGP is the open standard, and GPG (GnuPG) is the free implementation most people actually use. What each one is, and which to choose.
Read more…secure-os wrote
Jun 18, 2026 in tor, vpn, anonymity - Is Tor safe? Mostly yes - Tor is a respected free anonymity network, but it has real limits: slow speeds, exit-node risks, and it doesn't make you invincible. What Tor protects, what it doesn't, and how it compares to a VPN.
Read more…secure-os wrote
Jun 18, 2026 in privacy, data-protection, ccpa - The US still has no single federal data privacy law - instead a growing patchwork of state laws like California's CCPA/CPRA, with more states joining in 2026. What rights you actually get, what it changes, and how to protect yourself without waiting for the law.
Read more…secure-os wrote
Jun 18, 2026 in opsec, privacy, operational-security - OPSEC (operational security) is the practice of protecting the small pieces of information that, combined, expose you. What OPSEC means, where it came from, the 5-step process, and how to apply it to your everyday digital life - without paranoia.
Read more…secure-os wrote
Jun 17, 2026 in linux, windows, security - Is Linux more secure than Windows in 2026? Linux has real structural advantages - permissions, smaller desktop attack surface, open-source auditability - but Windows has closed much of the gap. What actually makes the difference, honestly.
Read more…secure-os wrote
Jun 16, 2026 in messaging, encryption, signal - Looking for the best encrypted messaging app in 2026? Signal leads for most people, but Threema, Session and SimpleX win on specific needs. End-to-end encryption, metadata, and which to actually pick.
Read more…secure-os wrote
Jun 16, 2026 in dns, privacy, encryption - Plain DNS leaks every site you visit to your ISP and network. Secure DNS fixes that. A practical guide to DoH, DoT, DNSSEC, how to turn encrypted DNS on, and the resolvers worth using.
Read more…secure-os wrote
Jun 15, 2026 in email, encryption, privacy - The best secure email providers in 2026, honestly compared: Proton Mail, Tuta, Mailbox.org, Posteo and StartMail. What end-to-end encryption really covers, where each shines, and the honest limits of private email.
Read more…secure-os wrote
Jun 15, 2026 in encryption, usb, veracrypt - How to encrypt a USB drive in 2026, step by step, on Windows, macOS and Linux - with free, cross-platform VeraCrypt, plus built-in BitLocker To Go, macOS encrypted volumes and LUKS. What encryption protects, and the honest pitfalls.
Read more…secure-os wrote
Jun 15, 2026 in signal, telegram, messaging - Signal vs Telegram, honestly compared in 2026. Signal is end-to-end encrypted by default; Telegram's default chats are not. What that really means, where Telegram still shines, and the honest limits of each.
Read more…secure-os wrote
Jun 14, 2026 in privacy-phone, grapheneos, degoogle - The best privacy phones in 2026, honestly compared: a Pixel running GrapheneOS, pre-built de-Googled Murena /e/OS, CalyxOS, Linux phones, and locked-down iPhone. What 'privacy phone' really means and which fits you.
Read more…secure-os wrote
Jun 14, 2026 in browser, privacy, fingerprinting - There is no single 'most private' browser - the right one depends on your threat model. A clear-eyed comparison of Tor Browser, Mullvad Browser, Brave, Firefox hardened and LibreWolf, and which to use for what.
Read more…secure-os wrote
Jun 14, 2026 in android, degoogle, mobile-privacy - A practical 2026 guide to de-Googling Android: the realistic spectrum from swapping apps and using Aurora/F-Droid, to microG, to a full GrapheneOS or CalyxOS install. Honest effort, limits and privacy gains at each level.
Read more…secure-os wrote
Jun 14, 2026 in grapheneos, android, mobile-privacy - GrapheneOS is a security- and privacy-focused Android OS for Pixel phones. How its hardening works, sandboxed Google Play, supported devices, honest limits, and how it compares to CalyxOS and /e/OS.
Read more…secure-os wrote
Jun 14, 2026 in signal, whatsapp, messaging - Signal vs WhatsApp, honestly compared in 2026. Both encrypt message content end-to-end - the real difference is metadata and ownership. Why Signal wins on privacy, where WhatsApp is fine, and the honest limits of each.
Read more…secure-os wrote
Jun 14, 2026 in encryption, privacy, security - Encryption scrambles data so only someone with the key can read it. What encryption is, symmetric vs asymmetric, at-rest vs in-transit, end-to-end encryption, and the honest limits - explained by threat model.
Read more…secure-os wrote
Jun 14, 2026 in malware, security, privacy - Malware is any software built to harm or exploit a device - viruses, worms, trojans, ransomware, spyware, keyloggers. What malware is, the main types, how it gets in, and the layered defences that actually work.
Read more…secure-os wrote
Jun 14, 2026 in ransomware, malware, security - Ransomware is malware that encrypts your files and demands payment for the key. What ransomware is, how an attack unfolds, why paying is a bad bet, and the one defence that actually works: backups it can't reach.
Read more…secure-os wrote
Jun 14, 2026 in spyware, malware, privacy - Spyware is malware that secretly monitors and collects your data - keystrokes, browsing, location, even your screen. What spyware is, the types, how it gets in, the warning signs, and how to remove and prevent it.
Read more…secure-os wrote
Jun 13, 2026 in tor, anonymity, privacy - A threat-model-first guide to Tor Browser - how onion routing actually protects you, how to install and verify it, the usage mistakes that deanonymize people, and where it stops and Tails or Whonix begin.
Read more…secure-os wrote
Jun 12, 2026 in encryption, luks, opsec - A practical guide to full disk encryption across Linux, Windows, macOS and cross-platform tools - what it protects, what it does not, and how to get it right.
Read more…secure-os wrote
Jun 12, 2026 in linux, hardening, sysctl - A practical Linux hardening guide built around threat models, not checklists. Covers sysctl, AppArmor, SELinux, kernel parameters, and verified boot - with clear explanations of what each measure actually protects against.
Read more…secure-os wrote
Jun 12, 2026 in luks, encryption, linux - A complete guide to LUKS2 full-disk encryption on Linux - cryptsetup commands, header backup, TPM auto-unlock, performance benchmarks, and what to do when your header is lost.
Read more…secure-os wrote
Jun 12, 2026 in linux, distros, hardening - Choosing the most secure Linux distro depends on your threat model. This guide ranks 7 secure Linux distros by what they actually protect against.
Read more…secure-os wrote
Jun 12, 2026 in qubes, compartmentalization, linux - A technical deep-dive into Qubes OS - the compartmentalization-based desktop OS recommended by Snowden and used by security professionals worldwide.
Read more…secure-os wrote
Jun 12, 2026 in qubes, tails, whonix - A decision framework for choosing between Qubes OS, Tails, and Whonix in 2026 - using a threat model matrix that covers targeted malware, physical seizure, mass surveillance, and identity linkage.
Read more…secure-os wrote
Jun 12, 2026 in tails, tor, live-os - Tails OS is a live USB operating system that routes all traffic through Tor and leaves no trace. Learn how it works, who needs it, and its real limits.
Read more…secure-os wrote
Jun 12, 2026 in tails, usb, install - A complete how-to guide for installing Tails 7.8.1 on a USB drive - including OpenPGP signature verification, writing the image, and first-boot setup of Persistent Storage.
Read more…secure-os wrote
Jun 12, 2026 in veracrypt, encryption, disk-encryption - A thorough, honest review of VeraCrypt 1.26 - how to create encrypted containers, hidden volumes, and whole-disk encryption on Linux, Windows and macOS. Includes real limits vs LUKS and BitLocker.
Read more…secure-os wrote
Jun 12, 2026 in whonix, tor, virtualization - Whonix uses two isolated virtual machines to route all traffic through Tor by design. No configuration errors, no IP leaks. Here's how the architecture works.
Read more…