Intel ME (Management Engine) runs below your OS with network access even when powered off. AMD PSP (Platform Security Processor) provides similar backdoor functionality.

The FBI runs more Tor exit nodes than any activist group ever will.

NEVER forget HONEY. Stop using VPNs recommended by retarded Youtubers.

Double bird hands means she's about to try and peck us to death with her explanation, which is actually backpedaling framed as 'let me explain because you're stupid, but actually I'm stupid and just don't know it'.

Why do cell towers triangulate your location even in airplane mode? The baseband processor runs independently from your main OS and can be remotely activated.

Every dependency you strip away is a chain broken. Every system you host yourself is territory reclaimed.

GrapheneOS removes Google's tracking while keeping Android app compatibility. Stock Android phones can report your location frequently when location services are enabled.

Border agents copy entire phone contents in seconds using Cellebrite devices. Full disk encryption only protects powered-off devices.

Brave Browser handles 94 million users monthly with zero dependency on Google or Microsoft servers, and Big Tech should be terrified of what this proves. sambent.com/monero-ring-size…

Why do free VPNs exist when servers cost money? Because they sell your browsing data to the same advertisers you're trying to avoid.

Mullvad VPN accepts cash payments and doesn't require email addresses. Most VPN companies want your payment details to build customer profiles.

Your printer adds invisible yellow dots to every page that encode serial numbers and timestamps. These 'Machine Identification Codes' track documents.

Feds always love talking about who it was that actually got taken down, or who's stuff they stole. It's interesting that there is ZERO mention of the 'who' in this.

Whonix runs two virtual machines one for Tor gateway, one for applications. Even malware can't discover your real IP address.

Your smart TV is emitting ultrasonic beacons that your phone detects, linking viewing habits to your mobile identity WITHOUT YOUR KNOWLEDGE. Cross-device tracking through sound you can't even hear. Welcome to surveillance capitalism. Expose: piped.video/kDMfDN7iuQY

Here we discuss some basic methods of SSH hardening. SSH Hardening - The Basics A 🧵

Swapping SIM cards doesn’t hide your phone’s IMEI. Keep reusing the same device and you’re not a ghost, you’re a rerun.

Based @brave (it's for an article thumbnail coming out on Monday)

Proton sells “privacy” and kills accounts on a CERT tip. A complaint ≠ court order. Proton is Swiss, CERTs are advisories, not subpoenas. They suspend first, litigate never. They admit thousands of compliance actions. If they wanted to fight it they could, in turn forcing a court order. They didn’t. They folded, same as ALWAYS.

piped.video/watch?v=pZiG8r-d… 𝗠𝘂𝗹𝗹𝘃𝗮𝗱 𝗛𝗶𝗱𝗲𝘀 𝗩𝗣𝗡 𝗧𝗿𝗮𝗳𝗳𝗶𝗰 𝗜𝗻𝘀𝗶𝗱𝗲 𝗛𝗧𝗧𝗣𝗦 𝗪𝗶𝘁𝗵 𝗤𝗨𝗜𝗖 𝗢𝗯𝗳𝘂𝘀𝗰𝗮𝘁𝗶𝗼𝗻

Get it?

Why LibreWolf Destroys Chrome and Firefox for Operational Security sambent.com/why-librewolf-de…

Cloud password managers aren't protecting your data, they're collecting it for profit while making you the product in a surveillance economy that profits from your digital enslavement. sambent.com/vaultwarden-depl…

PERFECT Zcash post. "Look guys, I got a burrito, totally anonymously" Takes picture of self, with receipt, and puts it on social media. THIS is zcash level intelligence.

DMA attacks through Thunderbolt ports can read RAM contents directly. IOMMU protection must be enabled in BIOS to prevent PCIe device memory access.

Acoustic cryptanalysis extracts RSA keys from CPU fan noise during computation. Sound isolation doesn't help when the attack uses electromagnetic emanations.

Unless it's Roof Top Koreans, then it's a win. BRING THEM BACK.

Your VPN promises no logs but hands data to feds, routes DNS through logged servers, and can't distinguish app traffic. TorVPN provides per-app circuits, virtual DNS endpoints, automatic bridge discovery, and decentralized trust. piped.video/WPwUIMrpQ_0

Tor exit nodes can see unencrypted traffic but not its source. HTTPS protects content while Tor protects identity, use both together.

Qubes OS isolates every application in separate virtual machines. One compromised browser can't access your password manager or files.

Tom didn't use a self-custody wallet. Don't be like Tom.

New submission. @phrack Congrats @ProtonPrivacy I know @TutaPrivacy will r/t lol. ==Phrack Inc.== Volume 0x11, Issue 0x49, Phile #0x09 of 0x12 |=------------------------------------------------=| |=--=[ PHRACK PROPHILE ON ProtonMail ]=--=| |=------------------------------------------------=| |=---------------=[ Phrack Staff ]=---------------=| |=------------------------------------------------=| |=---=[ Specs Name: Proton AG (formerly ProtonMail) Handle: ProtonMail, Proton Handle origin: "Proton" from CERN proximity marketing AKA: "Swiss Privacy Company" (contested) Country: Switzerland (incorporation) / Global (operations) Website: proton.me GitHub: ProtonMail (selectively open source) Founded: 2013 |=---=[ Background Proton Mail launched in 2013 riding the Snowden wave, marketing themselves as the "secure email" solution based in privacy-friendly Switzerland. Founded by CERN scientists, they leveraged that academic credibility hard. Initial crowdfunding raised $550k from privacy advocates who believed the pitch. The reality check started September 2021 when they logged French climate activist IP addresses for Swiss authorities, contradicting their "no logs" marketing. They retroactively edited their privacy policy after getting caught. Their defense? "We never said we don't log IPs under legal orders" - except they literally did in their marketing materials. |=---=[ Technical Architecture Client-side encryption using OpenPGP.js - except: - Webmail serves JavaScript that could be backdoored per-user - Mobile apps are closed source blobs - Bridge software for desktop clients: partially open - No reproducible builds for verification - Zero-access encryption claim relies on trusting their servers The "Swiss privacy" angle? Switzerland has mutual legal assistance treaties (MLATs) with 70+ countries. They're also not EU, meaning no GDPR protection. Their Zug incorporation is more about taxes than privacy. |=---=[ Compliance Track Record 2021: Logged French activist IPs, led to arrests 2022: Suspended accounts flagged by Europol without user notification 2023: Confirmed providing recovery emails to authorities 2024: Implemented automated scanning for "illegal content" 2025: Mass suspension of Korean journalists/whistleblowers (June) 2025: Account terminations without explanation (August-September) Pattern: Claim technical inability to comply, then comply anyway when pressured. Their transparency reports show thousands of data requests honored annually. |=---=[ The Whistleblower Problem August 15, 2025: Proton disables account used by anonymous source providing documentation about Korean government surveillance programs. August 16, 2025: Multiple journalists report suspended accounts after receiving leaked documents about Ministry of Unification operations. Proton's response: "Terms of Service violation" with zero specifics. Appeals process: Kafka-esque bureaucracy requiring government ID to restore "anonymous" accounts. The KISA (Korea Internet & Security Agency) connection appears in their compliance logs but Proton refuses to confirm or deny specific government requests. Classic transparency theater. |=---=[ Business Model Reality "Free" tier: You're the product being sold as "privacy-conscious users" Paid tiers: $120-360/year for basic functionality VPN bundle: Separate subscription because synergy is expensive Drive/Calendar: Half-baked addons to justify price increases Venture funding: $17M from Charles River Ventures and FONGIT Translation: Your "privacy company" answers to VCs who need ROI. Marketing budget dwarfs security audits 10:1. They spend more on YouTube sponsorships, than on reproducible build infrastructure. |=---=[ Security Theater Examples "End-to-end encrypted": Only between Proton users. External email? Plaintext. "Zero-access encryption": They generate and store your private keys. "Anonymous signup": Requires SMS or payment verification. "Onion site": Serves the same backdoorable JavaScript. "Open source": Core components only, apps remain closed. PGP implementation quirks that break compatibility with standard clients because "enhanced security" sounds better than vendor lock-in. |=---=[ Alternative Reality Check Proton positions itself as the privacy alternative while: - Operating centralized infrastructure (single point of failure/surveillance) - Requiring trust in their good intentions - Actively complying with government requests - Preventing users from verifying security claims - Marketing to dissidents while cooperating with their prosecutors Real alternatives require: - Self-hosted infrastructure - Federated protocols - Client-side encryption with user-controlled keys - No single entity controlling the service |=---=[ The 2025 Incident Analysis The pattern is clear: Proton receives government request, suspends accounts, claims ToS violation, provides no evidence, demands government ID for appeals. The infrastructure knows who you are (payment info, IP logs under "legal compulsion", device fingerprints) while marketing anonymity. When confronted, they pivot to legalese about Swiss law requirements while continuing to market themselves as the privacy solution. The cognitive dissonance is profitable. |=---=[ Bottom Line Proton Mail is security theater for people who want to feel protected without doing the work. They're a centralized email provider with good marketing and selective compliance with government requests. Using Proton for sensitive communications is like using a "privacy VPN" that logs everything - technically encrypted, practically surveilled, definitely not what was advertised. Want actual security? Run your own infrastructure. Can't? Then understand you're trusting someone else's promise, and Proton has repeatedly shown their promises are marketing copy, not operational reality. The Swiss privacy paradise is a myth. Proton is just Gmail with better marketing and higher prices. At least Google is honest about reading your email. |=---=[ References - Swiss Federal Act on International Mutual Assistance in Criminal Matters - Proton Transparency Reports (note the careful wording) - Case No. 2021/7689 (Paris Court of Appeal) - MLAT agreements database - Their own blog posts contradicting their marketing - Warrant canary: Conspicuously absent Kill the mythology. Email is fundamentally broken for privacy. Proton is just monetizing the cope. |=-------------------------------------------------=|

Cloudflare sees more encrypted traffic than most governments.

Twitter for the Darknet. No bullshit ID rules apply. pitchprash4aqilfr7sbmuwve3pn… or pitchzzzoot5i4cpsblu2d5poifs…

This is one of the most Reddit things I've seen Reddit do.

It's about time considering the fact that hundreds of them have been prosecuted for crimes while simultaneously never stopping a terrorist or criminal themselves.

Fuck that Use Monero.

These dudes sound like women. I was waiting for one of them to scream.

Your phone's accelerometer data reveals what you're typing through vibration patterns. Apps can read keystrokes without accessing your keyboard.

Your smart TV records conversations and sends them to manufacturers. Roku, Samsung, and LG privacy policies admit to 'improving voice recognition.'

There were no weapons jackass. NOBODY says there were. Not Israel, and not US Intelligence. Ton's of people hate the US, it's not a justification for anything.

Researchers extracted 2048-bit RSA keys using ONLY fan noise recordings. Not theoretical: PROVEN. A few minutes of acoustic data = your encryption keys compromised. The crypto wars just got acoustic. Mind-blowing proof: piped.video/kDMfDN7iuQY

Have fun with that.

I figured @ProtonPrivacy CEO/Founder would be able to at least point out how I was misinformed. Nope. Calls it ridiculous (not wrong lol), and hides behind ToS. CERTs have zero legal authority. GovCERT.ch's own site says 'coordination and support'.... they cannot compel action. You voluntarily complied. You don't even know if it was 'spam or malware' , that 'or' exposes you took CERT's word without verification. (or made this post with no clue) Your transparency reports omit CERT-triggered terminations. You're hiding government-prompted takedowns from the exact report meant to track them. @phrack says they tried appealing repeatedly and were met with silence. Where's their appeal record? 'We investigated' without proof while the CEO can't specify the actual violation lol.

Proving that political parties are fucking retarded. It's not red vs blue it's the state vs you.

Email headers contain your IP address, mail client, and routing information. Even encrypted emails leak metadata about sender and recipient.

I've said it before and I'll say it again:

Why do privacy coins get delisted while surveillance coins get ETFs

Your phone's Bluetooth and WiFi can detect nearby devices and be used to track social interactions. Apps can map your relationships through various sensors.

I2P is vastly underused. It enables anonymous hosting. It strengthens darknet routes. It avoids clearnet leaks. #I2P #Darknet #Anonymity

A black market will be created, and it will become 100x more profitable. That's how it works when you make things illegal that many people want. In unrelated news: congrats to drugs in winning the war on itself the Regan introduced.

Your car's GPS system stores every location you've visited. Newer vehicles upload this data to manufacturers who sell it to insurance companies.

Hardware wallets still leak transaction data through node connections.

Hardware wallets keep crypto keys offline but still leak transaction data to blockchain explorers. Use coin mixers before and after storage.

Blocking @SimpleXChat here's why: I spent days breaking down federal surveillance laws with them in the comments, many of you know this already. Hours explaining how they work in court. Real statutes, with how things play out IRL. They said: "There are no laws that criminalize privacy." I documented them. They called me: "An enemy of privacy." because I disagreed with them. A privacy company denied these laws exist, then attacked me for proving they do, after they told others to 'get educated' to the fact they don't exist. They said: "None of your examples are laws." U.S. Code sections, federal statutes they're literally laws, once they get logically stomped out they move on to the next thing they can comment on only to have the same thing happen. They claimed I said "executive orders are laws" and "guidelines are laws." I asked for screenshots. Never provided them because I never said it. They invented arguments to attack, this has been there MO from the get go. They said: "There are no laws that criminalize privacy." Then: "Of course there are myriad of laws trying to restrict it." Days of good faith effort. Citations, explanations for things you don't see like how they weaponize conspiracy charges (I had them), and they would simply say that I was wrong and run away. When a privacy company attacks you for exposing privacy threats they claim don't exist, the conversation is over. I'm not wasting any more time explaining things to someone who doesn't want to understand them.

SimpleX Chat uses temporary anonymous identities for each conversation. No phone numbers, usernames, or permanent identifiers required.

Zcash VS Monero in a picture. What are YOU choosing?

KYC exchanges are honeypots with withdrawal fees.

Why You Never Rob Cancer Patients in Front of the Internet, AND Why Steam Sucks, And the People Who Hunted the Thief down piped.video/watch?v=dOrjOPBR… Wall of hero's/hunters at: sambent.com/why-you-never-ro… or (all of the following had a hand in being awesome, and the best part of humanity in general: @vxunderground @downsin @C4L38 @John5725424446 @andreee_eeeeee @escrow_ @zachxbt @SolJakey @notsoeasymoney

Your WiFi name broadcasts your router model to everyone in range. Default names like 'NETGEAR-5G' tell attackers exactly which exploits to try. Change it.

It's about control not fake child abuse. That same talking point is so worn out now even the normies don't buy it.

I2P vs Tor: Why Garlic Routing Offers Better Anonymity for Darknet Markets sambent.com/i2p-vs-tor-why-g…

TEMPEST attacks read electromagnetic emissions from your keyboard cables. Shielded USB cables reduce this attack vector but fiber optic connections eliminate it entirely.

DID THE FARMER WHO GREW THE FOOD GET A TIP? DID THE SLAUGHTERHOUSE PACKAGER? DID THE TRUCK DRIVER? No. But the bitch who walks with it for 15 feet thinks she's 'entitled' to someone else's money. "Serving" is your job - if you don't like the pay, find another job.

Use X without an account. xcancel.com/ #osint #x #twitter

Your "zero-access design" claim is a lie, you absolutely can see account content when emails arrive from non-Proton users, which is the majority of email traffic, But I'll get back to that in a minute... @phrack has been around longer than Google, and are OG's in the hacking scene that predate even social media wtf did you think would happen? You're CEO responded earlier, so there 100% was a 'chance to respond' so that's another lie, also it's not like all this came about 10 minutes ago. The CERT excuse is hollow, CERTs issue advisories, they don’t order account suspensions as they are not law enforcement. By you're own admission you killed the accounts because CERT complained, and that's even worse, IF you couldn't see the context of the messages. Proton chose to act on an unverified tip and then tried to frame it as an unavoidable mandate. You scan, filter, and process plaintext messages before encryption, giving you complete visibility into correspondence from Gmail, Outlook, and every other external provider. Your spam filtering system literally requires reading message content to function, proving you have routine access to user communications. Stop hiding behind "zero-access" marketing when you demonstrably possess the technical capability to read most emails passing through your servers, the same capability you just used to identify and disable accounts based on their activity patterns.

fuck off.

"nothing at all" Correction: nothing for you.

Tor is broken at the infrastructure level. Princeton researchers have proven that BGP routing attacks can unmask millions of users, and Tor still hasn't addressed the issue 9 years later. Watch how your anonymity dies: piped.video/XDsLDhKG8Cs #Tor #Privacy #BGP #Anonymity #InfoSec

Remember when the CIA recommended using Signal (quote on blog)? That was fun. Signal just launched paid backups designed by Facebook's former surveillance architect. The same company that stored desktop keys in plaintext for 6 years now wants $1.99/month to store your messages on their servers. piped.video/lxNOpIwjTxo

sambent.com/tor-browser-15-s… Tor Browser 15 Strips AI, Patches Critical Exploits

Monero's ring signatures mix your transaction with 10 others by default. (can't wait for FCMP++)

Tor Browser 14.5.8 shipped with critical security fixes backported from Firefox 144, plus updates to core anonymity infrastructure. The Tor Project released the update on its download page and distribution directory. sambent.com/tor-browser-14-5…

You can ban anything, and people will comply. They banned going out of your own house during COVID and the the sheep did as they were told.

it saves everything in plain text. also anything anyone sends, you automatically download.

Garlic routing in I2P uses multiple layers of encryption per packet, unlike Tor's onion routing. Each 'garlic clove' contains multiple messages to obscure traffic patterns.

While Google Docs reads everything you type, CryptPad's XSalsa20-Poly1305 encryption and Nakamoto-style consensus protocol ensure the server never decrypts your documents. sambent.com/cryptpad-zero-kn…

Hey, here is how clueless you are. This is the first marketing EVER done by Monero. People in Monero, that have been using for years don't care about 'investors' or 'feelings' or pumps or ANY of that surface level nonsense. They care about privacy. It's that simple.

Left vs right is tribalism that panders to the class of people one step above gangs. It's why you see billionaires, and the actual Politian's switch sides, be everyone else is supposed to be loyal. It's a fake choice.

Bisq enables peer-to-peer Bitcoin trading without KYC requirements. Centralized exchanges report every transaction to tax authorities worldwide.

Haveno enables peer-to-peer Monero trading without centralized exchanges. No KYC requirements or transaction monitoring systems.

Watch it be more malware lmfao

OnionMasq creates VPN-like behavior by trapping applications in kernel-isolated sandboxes where only Tor-routed network interfaces exist, eliminating the bypass vulnerabilities that plague proxy-based solutions. Based. sambent.com/onionmasq-tors-e…

Dude just tried to extort you and your shaking his fucking hand and calling him 'bro'. Delusional.

IPFS creates decentralized file storage that can't be censored or taken down. Your files distribute across thousands of nodes worldwide.

Criminalizing privacy is criminal.

VPN kill switches fail during timing windows while DNS leaks occur through multiple system-level bypass mechanisms. sambent.com/the-technical-re…

Syncthing connects your devices directly to each other, eliminating corporate surveillance while navigating complex network security challenges that most users never consider. sambent.com/syncthing-mesh-s…

It's not paranoia, if you have seen it used as an exploit. (it has been) The difference is between knowing and not knowing.

Monero's stealth addresses generate unique payment addresses for each transaction. Bitcoin address reuse links all your payments together forever.