security for anonymity for a beginner

[slack]

Hi all i have just downloaded whonix on my home computer and I would like to know if you could possibly help me with the following concerns which I have. I have done both the work station and the gateway, done the sudo -i and the apt upgrade and the apt update also. I want to make sure I am secure so I would like to ask if you could help me with the following :

Reading the whonix help pages My concerns lay in understanding what additional security measures i can take and if i am currently secure at all and how i can test whether i am secure. I feel a difference in IP isn’t enough to be secure.i have heard of horror stories on Youtube of killer’s and rapist’s hacking computers and coming to the users home.

so I’ve read about:

optional configurations> what are these and how can they be of any benefit to security? also where can i find them on the whonix system

beware of man in the middle attacks > from my understanding ssl certificates arn’t enough so how can i make sure i’m secure??

set directory guards > where can i find these and how do i change them?

change password > how do i do this? i’m assuming this is the default “changme” password. how would i change this?

got this statement from the whonix security help pages

“By default, protect you if Tor is somehow broken. You can improve that to some extent (with caveats) by chaining Tor with SSH, proxies or VPNs.”

the above sounds technical is there a video guide step by step which i can follow?? or can someone explain in simple terms.

How do i hide that i am using Tor??

Thanx in advance for your help

[Ego]

Good day,

i have heard of horror stories on Youtube of killer’s and rapist’s hacking computers and coming to the users home.

I know those to well, are however not based in reality, but rather creepy pastas and humorous fiction. Unless you see such information in a real newspaper/product of a serious journalist, it is most definitely false.

optional configurations> what are these and how can they be of any benefit to security? also where can i find them on the whonix system

That part of the documentation essentially means that Whonix is compatible with all sorts of software, which may be installed over apt-get.

beware of man in the middle attacks > from my understanding ssl certificates arn’t enough so how can i make sure i’m secure??

As long as you access a hidden service, this won’t concern you, as eavesdropping isn’t possible then. When accessing a “normal” website over Tor, SSL actually is enough, as it renders this kind of attack impossible, by encrypting anything going over the connection.

set directory guards > where can i find these and how do i change them?

Do you mean entry guard? Because doesn’t shouldn’t be manually set, that would make you by far more vulnerable, regard this: https://www.torproject.org/docs/faq.html.en#ChooseEntryExit

change password > how do i do this? i’m assuming this is the default “changme” password. how would i change this?

Is explained in the terminal every time you open it.

the above sounds technical is there a video guide step by step which i can follow?? or can someone explain in simple terms.

Sadly, due to differences between VPN providers, setup, etc. this can not be explained universally. Furthermore, keep in mind that, if you use a VPN/proxy/whatever instead of the normal exit node, the provider of that VPN, etc. can eavesdrop on you actually far more easily than a provider of an exit node.

How do i hide that i am using Tor??

Use obfs3, for more, regard this: https://www.whonix.org/wiki/Hide_Tor_and_Whonix_from_your_ISP

Have a nice day,

Ego

[entr0py]

My concerns lay in understanding what additional security measures i can take and if i am currently secure at all and how i can test whether i am secure.

It’s good that you read the documentation. I’d like to emphasize one section in particular: Non-technical steps for staying anonymous. More than anything else, following these tips while using Whonix will help keep you safe. If you read the news about people who have been de-anonymized in the past, it’s almost always due to these mis-steps.

“Secure” can be applied to many different aspects of your system. Too broad a topic to address unless you are willing to provide more detail on your specific concerns.

Whonix by default is configured with relatively safe settings. As a beginner, you’re likely to do more harm than good by tinkering. (Not trying to discourage you from testing, but make sure you do it on a separate clone VM used only for learning purposes).

change password > how do i do this?

https://www.whonix.org/wiki/Post_Install_Advice#Change_Passwords

---

Shouldn’t “Post Install Advice” be linked to from VirtualBox Download landing page, maybe in the “First time user?” section?

Also, I think https://www.whonix.org/wiki/Security_Guide#Updates deserves a section or at least a link on the Install page. Many new users will skip the Security Guide.