Device security before Tor: your browser is not the weakest link
Tor cannot protect a compromised device. Why OS updates, disk encryption and malware hygiene matter more than any browser setting before you connect to the network.
Security
43 postsshort, practical notes about not getting phished. no fear mongering, just the checklist.
latest notes
newest firstTails, Whonix or just a VM: honest answers about isolation on Tor
Tails forgets everything, Whonix refuses to leak, and a plain VM only contains. What each Tor setup really protects, where each fails, and who should run which.
Zombie credentials: why old password dumps still fuel account takeovers
A password stolen in a 2013 breach can still empty your inbox today. Inside the combolist economy, credential stuffing at scale, and the true cost of reusing one password.
Scam Warning Lists: Who Maintains Them and When to Trust Them
Scam warning lists look authoritative from outside. Who maintains them, how reports get verified, and where they fail explains why readers should treat them as evidence, not verdicts.
Link directories and dark.fail: what verified onion lists actually prove
What link directories like dark.fail actually verify, how PGP-signed mirror lists work, where they fall short, and how to build a verification habit that survives.
Verifying software downloads over Tor: checksums and signatures done right
Checking a hash against the same server that served your download proves nothing. Here is how to verify software over Tor properly: signatures, key fingerprints and a little patience.
Threat model thinking: deciding which protections you actually need
Security advice tells you to do everything. A threat model tells you what matters for you: your assets, your adversaries, their capabilities, and where effort is wasted.