Share your minimum-viable opsec stack
Not the "I am a journalist in a hostile state" full stack. Just the version normal-paranoid people actually use. Browser, DNS, password manager, messaging. What's overkill, what's missing.
Not the "I am a journalist in a hostile state" full stack. Just the version normal-paranoid people actually use. Browser, DNS, password manager, messaging. What's overkill, what's missing.
1 reply
Browser: Firefox with uBlock Origin. That combo handles 95% of it.
DNS: Quad9 (9.9.9.9) with DoH enabled. Malware-blocking, doesn't sell query logs, five minutes to set up. This is the most-skipped step and probably the most useful one after the browser.
Password manager: Bitwarden. Open-source, audited, free tier does everything. Self-hostable if that matters to you.
Messaging: Signal where I can get it. iMessage for family who won't switch.
What I dropped after trying it: a VPN. At home you're just moving trust from ISP to VPN provider, and most VPN providers are sketchier than Comcast. Worth it on public wifi, not worth the subscription otherwise.
What I'd add for people who want one more layer: a hardened DNS resolver at the router level (Pi-hole + Unbound) kills ads and trackers network-wide without per-device config. Overkill for most, but if you're already running a home server it's 30 minutes.