I have read the rules. Still unsure if this is an edge case question.

I'm in a local group that's gearing up for non-violent resistance. Again. And while I don't expect any of us will run afoul of local authorities, we do live in what can very easily be called Orange Felon Country. I expect the police county wide to be fully in the cult.

So secure messaging is something I'm looking into. Never had a need to use Signal but that's what I'm considering. I've also had a recommendation for Matrix. Will be considering all available tools.

Just the same, getting people off of FB Messenger is a potential concern to me. While it does use end to end encryption *today*, I expect that most users would never notice if meta turned that off.

I also wonder how long it would take before those deep into opsec would notice that they had done so.

In part I'm looking for feedback that I can use to get our less technical people off of messenger and onto more trustworthy tools, other than just "because I said it's better." In part I'm interested in the answer as someone who's danced around the edges of opsec for years.

Thanks in advance.

I have read the rules.

Hi guys. My country (non US), once a democracy, is slowly turning towards authoritarian rule.

As far as I know the country doesn’t use any of the big tech security providers (P-r and such) yet, but I’m sure it’ll soon be the case, as it is pervasive around the world.

Me and my wife have done some political activism (nothing major) in the streets and social networks and such and I’m wary that, once democracy is gone, we’ll suffer consequences for our political views.

The issue is especially bad for her, since she’s a medium ranking public servant, though not party affiliated. In the far past the government was known to make dossiers on public servants with political views (mostly osint for what I’ve read).

Ideally we’d like to continue to be able to sponsor our views anonymously if safe, if not, at least be able to group/chat anonymously or at the very least we’d like to make sure anything we have posted openly in the past is buried or we know to which extent we’re exposed.

I know you can’t do anything truly anonymous or securely nowadays, but we’re not high profile targets (probb medium) and just want to stay below the radar and make sure our lives and kids are safe.

I read erasing posts and comments might be traceable (especially in Reddit) and I wonder if we should find tools to rewrite every post/comment before we delete the accounts. What about past deleted accounts?

What happens if identity laws such as the UKs end being passed? What if the govt hires big tech security? What happens if our social networks are made mainly of like minded people? Can graph and network analysis of social networks end up exposing us? If so, what can we do?

We’re willing to study and learn if there are books and sources. Is there a political activism opsec playbook?

Thanks for any help you guys can give

As a high value target you are constantly undergoing direct attacks on all digital fronts and will be the target of exploits that invalidate the device's security protections. Is there a publicly known and established protocol to mitigate this? What do world leaders and billionaires with top secret information do to prevent what to me seems like the inevitable, which is security compromise. I can tell you firsthand that normal stock are very vulnerable to direct attack.

Do they just avoid important conversations on smartphones altogether? Do they only use them for leisure? Is there a known and consistently successful alternative? Do I have to use Qubes or Tails to have any semblance of privacy?

I have read the rules

Hello, I would like to learn more about cases involving full-disk encryption and law enforcement access. My understanding is that when a device is protected with a strong, high-entropy password and the encryption recovery keys are not stored to a Microsoft account or any other third party, recovering the data through brute-force or direct decryption is generally considered computationally infeasible. However, I am aware that, in theory, there may be vulnerabilities that could potentially circumvent or weaken the security of an encrypted device. I would like to understand the real-world cases in which law enforcement has successfully or unsuccessfully accessed encrypted devices, the techniques reportedly used, and the practical limitations of those approaches.

i have read the rules

Hi everyone,

I am a human rights activist from Bangladesh.

Bangladesh is an Orwellian surveillance state.

• Call records are recorded by default, and the voice calls of targeted individuals are recorded.
• There is the Integrated Location Identification System (ILIS), through which any mobile user's location can be tracked at any time.
• SIM cards must be registered with your National Identity Card and the device's IMEI; otherwise, the SIM stops working. There is no way to obtain anonymous SIM cards.
• Satellite phone possession or usage gets you years in jail and they enforce it. Same goes for two way radios.
• Spyware such as Pegasus, FinFisher, and many others has been purchased, and there are credible reports that they are routinely used against journalists, dissidents, political opponents, LGBT people, and other marginalized groups. Security forces have wide surveillance powers, total immunity, and no oversight.

A mobile phone is needed for:

• Basic communication: "Where are you?", "Have you reached the location?", "How long will it take?", finding people, knowing where they are, or calling home to check whether everyone is safe.

Other requirements:

• Navigation: This can be replaced with paper maps or a GPS device without any internet or Wi-Fi connection (air-gapped except for GPS).
• Photos and videos: This can be replaced with a point-and-shoot camera without any radios (air-gapped).

Constraints:

• Even a used Pixel is unaffordable for me. Also, people here generally sell electronics only after using them for a decade, by which time they are often barely functional. So buying a used Pixel is not a realistic option.

Given that I cannot buy a Pixel to install GrapheneOS, would buying a dumbphone (button phone) make sense? My thinking is that its camera, microphone, and location cannot be hijacked although call logs, voice calls, and approximate location would still be known whenever it is powered on.

Any suggestions?

P.S. I have read the rules.

Threat: Highest. State intelligence agencies.

Hi everyone,

I'm a human rights activist, and I'm working on a model for a tamper-evident desktop setup.

One issue I've run into involves the monitor. I can apply glitter nail polish or other tamper-evident markings to the case screws, but if I later discover that a seal has been disturbed, I'm left with another problem: I'm not a hardware expert.

If I open the monitor myself to inspect the internals, I risk damaging it or not being able to reassemble it properly. On the other hand, if I don't inspect it, I have no way of knowing whether anything inside has actually been modified.

So how do people handle this in practice? Is there a good way to make a monitor tamper-evident while also retaining the ability to verify the internals if the external tamper seals indicate possible interference?

I feel that, when securing a mini PC or desktop setup, the monitor is the weakest link. You can make the computer and its other peripherals tamper-evident, but the monitor remains difficult to verify without opening it.

I'm interested in practical approaches that are realistic for non-experts rather than solutions requiring advanced electronics or forensic skills. Also, please don't suggest uncommon monitors (such as those with transparent cases) that aren't readily available in most places, including Bangladesh.

P.S. I have read the rules.

Threat model: State intelligence agencies.

idk if someone already asked i cant sreach good bc my english is bad i have read the rules

threat moodel: surveillance captialism/policing doxxers, home and public network, isp,

i hate fingerprinting the most

i love not having my ids connect to each other

the police arent after me but laws change

i want to

• download videos/music/books/games (mostly pirated) (AND PLAY THEM)
• moreno
• chat/scroll normal websites (the ones aervage people use)
• use javascript (every site wants it)
• email encrypted

tor browser is too slow is mullvad and vpn ok?

(my account is too new for r/privacy)

plz dont downvote bc of my bad spelling

Hiya I'm a total noobie, frankly I've just started digging deeper into OPSEC a few days ago and I want to protect my privacy and prevent selling my personal data by corporations.

I would like everyhthing to be as convenient as possible. I have read the rules and hope that my post is fine also I'm not a native speaker I really hope I wrote most of the things right.

I'M REALLY REALLY OVERWHELMED BELIVE ME :(

I didn't really know much about selling data and privacy when I was really young creating accounts on untrustworthy providers but it's better late than never I guess, for now I feel a bit overwhelmed so I would appreciate if You would be lenient with me if I wrote some spoof. + I don't have resources to pay for any chargeable services.

1. I unfortunately have to use Windows for personal reasons but I really want to switch to Linux and Zorin. How would that work? From what I saw easiest option was VirtualBox but it's made(?) by Oracle so I don't trust it. I also game so it would be nice if You could inform me about pros and cons that come with that. (I don't think any of the games I play now have kernel level anticheat).
2. My second question is when I use Windows, Meta or any big-corp apps what are my best ways to protect my privacy? I would love to just delete them but sadly again for personal reasons I can't.
3. VPN?????
4. I've switched my mail to Proton and I have a filter from the Duck but it was only recently. What do I do with my old G-Mail accounts that I used for a WHILE WHILE? I have them linked to an abundence of accounts (and I really mean a lot lot of accounts). For example I use YouTube is there any alternative to that or do I have to stick with it and just do my best for Google to get off me.
5. Now passwords. What's the best password saver and is the one from Duck Duck Go reliable? Or is it better to literally just write them down on paper.
6. I use an iOS based system on my phone. What could I do to ensure my safety. I've heard that Apple doesn't sell user data but it's a big corporation so my trust again is limited.
7. Next I have no clue about compartmentalization, scrubbing my metadata and noise generation like literally null, no idea it just makes me feel dumb. If You could explain it to me and how to do it in the simplest way I would be thankfull.
8. Finally more alternatives to "regular" common used apps (e.g. YouTube, Messenger, G-mail, Google etc.).

Well I think that's it. I would be thankfull for more info and suggestions.
Thank you!

How can one prevent themselves from being tracked without looking like an absolute idiot.
Threat model is snooping supermarkets lol.
I have read the rules.
(fucking spelling mistake, this was a vx-underground reference, i promise)

Hi everyone,

I am a human rights activist from Bangladesh. My work has been cited in UN thematic reports and by international human rights organizations. I can provide proof via private message if needed.

I have experienced several digital security incidents. For example, photos I took on my phone were later sent back to me by unknown Facebook accounts. Because of incidents like this, I suspect that my laptop and Android smartphone may be compromised with spyware.

For now, I'd like to focus on the smartphone.

I need it for my day job, where clients contact me via WhatsApp, so I need to stay connected to the internet throughout the day. I cannot afford a Pixel phone, and second-hand Pixels are both rare and expensive in Bangladesh. So switching to a Pixel or GrapheneOS is unfortunately not an option.

I already use a camera slider to cover the rear camera.

My questions are:

1. What is the best way to protect the selfie camera without damaging it? I still need to use it occasionally for selfies and video calls.
2. What can I do about the microphone? Is there any practical way to block or disable it when I'm not using it?
3. What are the most practical ways to improve location privacy, given that I need mobile data and internet access all the time for work?

Please suggest practical, realistic solutions. For example, recommendations such as "only use headphones," "permanently disable the camera and microphone," or "stop using a smartphone and quit your job" are not practical for my situation. I'm looking for measures that can realistically be implemented while continuing to use my phone for everyday work.

Thank you!

PS: I have read the rules.

I operate in a environment that requires no wireless connections in any form such as Bluetooth, WIFI, radio or satellite signals. This is to prevent tracking to protect location data. The risk of having the location(s) leaked is high.

What speakers are completely air gapped (no wireless capabilities) speakers that are portable and battery operated, that can prevent me from being tracked or information being passed to or from the device?

I have read the rules

I'm trying to upgrade my opsec. I would like to recreate a completly new identity on internet, an identity that couldn't be linked to me.

The use of this identity would be to write and share political opinions/statement, consult and share documents over political documents. The threat would come from government agents trying to retrace me for my opinions on the actual ruling political party of my country, danger would be prison, death, worse if possible I guess.

I already have a VM with Tails installed, I do not use "Persistent Storage". So I wanna start by creating a new email but I don't want any trace left, so I would only connect to this email via VPN. I would use Torrent P2P to download and share file, I would use and share magnet link for these files.

So are VPN like NordVPN or ProtonVPN really safe ? Do they log from where it has been accessed ? Can the ISP still see the content of what is shared ?

"I have read the rules"

Hi there,

I live in Bangladesh which is a highly surveillance state with sophisticated surveillance apparatus (Pegasus level spyware, deep packet inspection, real time location monitoring of all mobiles etc) and broad legal powers to security forces and no oversight.

I am a human rights activist doing advocacy at the UN. My work has been shared by international organizations. My threat level is very high and may include intelligence agencies. In fact, I think I could be under surveillance (which would obviously be unlawful as per international human rights law on surveillance) because there have been several digital security incidents. In one case, a sketch I was doing for a legal court case on Tails, on my current laptop, with Tails connected to the internet and no persistence enabled, was sent back to me by fake facebook accounts.

I live by the letter and spirit of the law and always have. I have always lived by my human rights ethics. But it is impossible to do human rights legal casework without security. If the adversary knows that you know something, they can retaliate or cover up evidence. There is a reason attorney-client privilege and confidential legal work product exists, whether for a lawyer or for someone representing themselves.

My requirements:

I think my laptop could have been compromised at the hardware-firmware level. It is from 2016, and I have been wanting to buy a new computer anyway. I need a device primarily for human rights legal casework:

• Doing OSINT online.
• Working with and storing evidence in the form of audio, photos, videos, documents, and other file types.
• Extracting clips from CCTV systems and editing final videos for court.
• Doing legal research online.
• Consulting lawyers in Geneva over video calls, sending emails, evidence files, etc.

In other words: basic computing.

Optionally: gaming as well! But that is just optional.

Now, the standard advice given is this: buy a cheap second-hand laptop for around USD 200 from a random store, use glitter nail polish on the screws and photograph them, store the laptop in a transparent container filled with a mosaic of lentils and take photos when leaving home, and have a CCTV system that sends remote motion alerts if someone enters your house (so they cannot simply delete the logs afterward). Also, use Heads with a USB key for firmware attestation.

Now, I do not trust laptops. As someone who is not skilled with hardware, I cannot open a laptop without risking breaking it. Also, if an implant or hardware tampering is found, the whole laptop has to be thrown away, which is expensive. On a desktop, you can visually inspect components for hardware tampering and swap out individual parts without replacing the entire system, which is much less expensive.

Also, given that I am out of the house for my day job, and my workplace does not allow laptops, I cannot carry one with me at all times. So please do not suggest laptops. Instead, tell me how I can make a desktop tamper-evident and secure.

My situation:

I am out of the house for about 16 hours a day. I live in a shared home. My family, their guests, and our maid all come through my room and rummage through belongings. If anyone has been to South Asia, they will understand the culture of having very little privacy at home.

I also like to use my computer while lying in bed or on the couch. I do not know how I can do that with a desktop. I have a neck problem and need to relax my neck after work. Sitting at a desk for long periods only makes it worse.

Ideally, it would be best if I had a separate room with a computer protected by access control and CCTV, but that is not realistic. We have to work with what we have. I have to keep the computer in my bedroom. I can keep it inside a cabinet or on a separate desk, but I obviously cannot install a camera in my bedroom because it would also record my family, and I do not want to risk their privacy.

Now, given all this, tell me, in order of importance:

• How to make a desktop (including CPU casing, monitor and other peripherals) tamper-evident so that I know if it has been tampered with.
• If it has been tampered with, how to determine which part was tampered with.
• If possible, how to determine who came in to tamper with it.
• How to use a desktop comfortably while lying down.

Some other information:

Importing from Amazon costs around 300% in taxes on electronics where I live. I have tried, trust me. So please suggest only things that are commonly available worldwide, not uncommon electronics.

Given the economics, USD 200 is what an MBA graduate supporting a family of four earns a month, after a year. So please keep that in mind and do not suggest expensive items.

Please do not have a defeatist mentality. Even under extreme surveillance, journalists (such as those working on the Snowden files), human rights researchers, lawyers, and others have been able to work and publish. So it is doable. Please think positively and think in terms of practical solutions. If we do not do the work, there will never be justice. I am not someone who will abandon human rights work because of fear of a powerful adversary. If I (or other human rights activists or lawyers) had that mentality, I (or we) would have stopped doing human rights casework long ago.

PS: I have read the rules.
Edit: If anyone would like to discuss this with me one-on-one to help me create a secure desktop setup, please send me a DM.

If this is the wrong place for this question please tell me and I'll ask somewhere else, I have asd and schizophrenia so I'm sorry if I sound paranoid. I have read the rules but Idk what a lot of it means so please bare with me. I trust that this subreddit is secure but if it isnt are there better places to ask?

I did a lot of drugs in the past (unfortunatly), because of this I did a lot of sketchy stuff on the internet aswell. I am medicated now and I'm in treatment for addiction, but I'm worried that my oppsec is severly comprimised because of that.

I've tried to use the darkweb before because I've heard that TOR is more safe then google but its way too slow. I understand how the dark web works and I've explored around before, there are so many bad people on there that I really dont want to use it unless I have to. I stopped using ai because of how dangerous it is, and how much information it spreads. Are there faster programs that work like tor does that also work on the clearweb?

Should I use different OS? I tried to use kali linux before but it was wayy too advanced for me, and I think its for hacking and although that is cool, I would prefer an option that doesnt require coding stuff on my own. I know python but I never got very advanced with it.

Like I said, I want some apps/programs that I can use to protect myself that dont require tons of understanding.
I used protonvpn for a bit but its really slow and and I'm worried that the company is stealing my data. I dont trust most companies even proton.

What is ThreatModeling? Can it help me protect myself? Does it require advanced coding? Also what should I be looking to protect? I try to hide important information, and not post it online, but would that be enough? I'm not dumb, i dont click on sketchy links. I try to use secure programs.

I remember how everything worked before Ai but now its really confusing. Again, I'd like some basic programs that dont require confusing setup.

I use apple stuff because I've heard they are pretty secure but I also dont know if thats a modern thing or if thats outdated information.

I am very sorry for how scattered this is, my meds make it very hard to think and talk.

Edit: after rereading everything, this sounds really paranoid, so please tell me if this is not appropriate here

We are a small nonprofit that deals with sensitive information that could cause quite a problem if leaked.

Our threat model involves both standard malicious actors that wish to target companies, but also companies themselves wishing to discredit us.

We do not have the funding to issue organizational laptops so we use a BYOD model. We have a Microsoft E5 tenant with Intune and we wish to prevent the leak of confidential information as much as possible while still not oppressing the personal devices too much.

No, we can't simply use browser apps as we rely on LaTeX typesetting which is outside of the scope of the Microsoft suite.

Is this even plausible?

(I have read the rules)

So with the spread of AI, scraping of photos by the government and private companies your face does not belong to you anymore. Let's face it (hehe), you can't hide anymore and your privacy is gone. The only way you can sorta hide is by blending in.
I was thinking, is there a way to create an "avatar" of your face that a human can look at and recognize it as you? Like maybe taking a photo of yourself and distorting it to a point where facial recognition is unable to identify you, but a human goes, "yeah I think this is the same girl".
Anybody can give me an advise on how to do that and test it against facial recognition to prove the theory? Thanks!

I have read the rules, thanks

Is there a viable alternative to GrapheneOS for those of us that don't have a Pixel? I looked at Lineage, but it seems more geared toward customization than privacy.

As for my threat model, I just feel that my business is my business, and I want anyone to know where I go, what pair of shoes I'm considering buying, etc., I'll tell them.

I have read the rules.

I'm trying to build a long-term private digital workspace, and right now this is the #1 priority in my threat model. I've been around privacy and OPSEC topics for a while, so I'm familiar with things like Qubes, Tails, Whonix, Tor, full-disk encryption, compartmentalization, firmware security, and offline systems, but I don't have a huge amount of hands-on experience actually building a complete setup.

The goal is to create one digital base for basically my entire private digital life: journals, notes, plans, research, PDFs, documents, programming projects, a cybersecurity learning environment, passwords and keys, important records, private communications, and a long-term knowledge base. I don't want to keep rebuilding everything every time my threat model gets stronger. I want to establish a good foundation now and gradually harden it over the next few years.

My threat model can potentially go pretty high. I'm especially concerned about confidentiality if someone gets physical possession of the device, including the possibility of examination by people with professional forensic expertise and specialized tools. That could mean a highly capable private attacker, a forensic specialist, or law enforcement. If a device is properly shut down and encrypted, I want it to reveal as little useful information as realistically possible. I'm interested in strong encryption, protecting credentials and keys, reducing unnecessary plaintext and metadata exposure, compartmentalization, offline storage, and making sure backups are protected just as well as the main system.

I'm not looking for evidence-destruction techniques or ways to interfere with an investigation. I'm trying to understand how far legitimate data confidentiality and resistance to sophisticated physical examination can realistically be pushed, and where the practical limits are.

I also want the setup to eventually cover network privacy and ISP visibility, Tor or Whonix where appropriate, browser fingerprinting, account and identity separation, private communications, secure backups and recovery, firmware and boot security, metadata minimization, and general OPSEC. Basically, I'm not looking for an answer like "install distro X." I'm trying to understand how the whole architecture should fit together and where the important trust boundaries should be.

I'm currently starting from scratch with about a $300 budget. My previous laptop is no longer usable, so I don't have an existing system that I need to preserve or work around. I know $300 won't buy some ultimate high-assurance machine, and I'm not expecting it to. What I want is the strongest sensible starting point that won't force me to completely redesign everything later when I can afford better hardware.

I've considered a used Qubes-compatible laptop, a conventional Linux machine with full-disk encryption, Tails with Persistent Storage, a dedicated offline computer, separate online and offline systems, Whonix, or some combination of these. Qubes interests me because I could separate an offline vault, personal archive, research, development, untrusted files, cybersecurity labs, and anonymous activity instead of putting everything inside one operating system. At the same time, I wonder whether a simpler encrypted offline system would give me most of the security benefit without as much complexity.

The part I keep getting stuck on is where to draw the trust boundary. You can keep going deeper from applications to the OS, hypervisor, boot chain, firmware, TPM, Intel ME or AMD PSP, hardware, manufacturer, and eventually the supply chain. At some point you have to trust something. I'm trying to figure out where people with real experience draw that line and which layers are actually worth prioritizing first.

So if you were starting with no usable computer, had around $300, considered this your highest privacy/security priority, and wanted the setup to eventually handle a fairly serious threat model, what would you build first? Would you go with Qubes, Linux with full-disk encryption, a dedicated offline machine, separate online and offline systems, Tails, or some kind of hybrid? What would your upgrade path look like over the next few years, and what would you deliberately not worry about yet?

I'm not expecting something "unhackable" or "untraceable." I want a practical system where I understand what I'm trusting, what the setup actually protects against, what it doesn't protect against, and how I can progressively move toward higher assurance without having to start over.

i have read the rules

I have read the rules , so my threat level is this , i want to join a university owned by the atomic commission of our country , it says on their web after admission they will investigate me , so what should i do to quickly cover my tracks(they arent good at all) , any chance i could delete / mask away enough data to pass the clearance

I work on coding projects on my main system with the chatgpt app. It has full access to my entire file system and executes functions on my computer. In the future I'll get a linux-native machine and configure it's security. I have several terabytes of data I need to transfer to that future Linux system/ homelab, and I am worried that I may transfer tainted files or payloads? I mean I don't even know what I've been running in my terminal as an administrator. What if it's a backdoor? should I be worried? What would you do?

I have read the rules

Please prove me wrong if this take is not correct.

Isnt having your own selfhosted VPN (even if on a bulletproof server) for anonimity from governments/police stupid?

1. Once police get the IP, if they find it anywhere else they know its the same person, since the IP is not from a public VPN company

2. Once police get the IP they can just ask major ISP providers who connected to this IP at this time and they will tell them which will make you instanly found

I have read the rules

Is there a tool to obfuscate my text to make it seem different from my usual typing style? Only thing I've thought of is just using chatgpt on a burner but that seems extremely risky

I have read the rules​

Hi all - I've had an iPhone since basically they first came out, and my current one is on it's last legs, and I want a privacy phone instead of a new iPhone. I'm considering buying a NitroPhone as I still want a good camera (also considered the fairphone as sustainability and right to repair are also important to me). I'm a bit of a beginner when it comes to opsec (I have more than basic knowledge but not as much as you all). Would you recommend this, or should I buy any other phone and just run graphene on it? Or any other recommendations?

Important for me is privacy and camera. I'm trying to fight against data aggregators and also government intrusion. I'm not a politician or journalist, but do my fair share of mico-activism and want to generally improve what the government is collecting from me. Won't be keeping any crypto on my phone, but slowly trying to move towards better encryption overall.

I have read the rules :)

I have read the rules.

Threat Model: Government and potentially law enforcement.

I’m part of a political party, but recent changes in my country have pushed me toward activism. However, my party—currently in power—likely wouldn’t approve. While my country isn’t a full surveillance state, I don’t want to take risks, especially with tools like Palantir looming. Worst-case scenario, law enforcement could seize and search my devices. To minimize exposure, I want to keep my activism separate from my political career.

I have a computer and a phone, and I’m considering buying a new one. Would a Pixel phone running GrapheneOS be a good choice for this setup? What else can I do?

Serious OPSEC question:

What are the most overlooked modern OPSEC mistakes / weak signals that technically literate people still leak in 2026 ?

I’m not looking for the usual beginner answers like:

• don’t post everything publicly
• lock down Instagram / Facebook
• basic “check your metadata” advice

I’m more interested in things like:

• Wi-Fi SSID / device names / wireless leakage as weak indicators
• image location inference, even when metadata is stripped
• job postings leaking stack, vendors, projects, or internal structure
• Bluetooth / nearby-device exposure
• event / conference exposure
• cases where several harmless details become something operationally useful

What I’m really trying to understand is:

What still gives people away, even when they think they’re being careful?

Especially interested in:

• realistic examples
• practical lessons
• things people could actually change tomorrow for better OPSEC

What examples or patterns would you point to?

*i have read the rules ** I don't have a threat model. I just want to discuss the subject :)