BlackOps Safety Part 1: From Tails & Tor Browser Hardening to KeePassXC Vaults, PGP Key Setup & 2FA

01. Foundation Layer: Replacing Daily-Use Desktops with Tails OS, Whonix & Hardened Tor Browser

OS Compartmentalization: Amnesic Tails OS Live USB vs. Whonix Dual-VM Architecture

They call the browser “anonymous” while it runs beside personal email and cloud sync on the same host. Windows and macOS can keep application history and cached data after the tab closes. Where does your password go if the host is already compromised? OS compartmentalization reduces the traces left by a session. It cannot repair compromised firmware or remove an attacker who controls the host.

Tails OS boots from a USB drive and routes supported connections through Tor. Its amnesic design avoids deliberately writing ordinary session data to the host disk. Make the USB yourself from a verified official image; a preloaded stick asks you to trust whoever prepared it. Tails is designed to boot on hardware, not as a guest VM. Check compatibility first and use a USB drive of at least 16 GB if you need persistent storage. Shut the machine down fully before removing it. An unattended, unlocked session remains exposed.

In Tails, enable encrypted Persistent Storage for anything you need after a reboot. Select the features you need, such as Personal Data and GnuPG. Menu names change between releases, so check current Tails documentation if yours differ. Encryption protects the volume while locked; once unlocked, its files are available to that session. Back it up to a second encrypted drive, then restore a copy to make sure the backup works. Keep the backup encrypted too. Otherwise the drive meant to save your keys becomes an easier place to read them.

Whonix splits the connection between a Gateway VM for Tor and a Workstation VM without a direct external network route. The host still matters: use an updated Linux host with full-disk encryption or a properly configured Qubes host. Whonix VM files persist between sessions, including any snapshots you keep. Shut down the Workstation, then Gateway, then host.

Locking Down Tor Browser: Safest Level, JavaScript Controls & Tor Circuit Routing

Set Tor Browser's security level to Safest before opening an unfamiliar Tor hidden service. In Tails, check the setting after every boot. For an explicit JavaScript block, set javascript.enabled to false in about:config. Investigate any site that asks you to undo it. Some guides recommend privacy.resistFingerprinting.spoofOsInUserAgentHeader; first check whether your release supports it. Unusual custom settings can make a browser easier to distinguish.

A Tor circuit runs through Tor relays. Switching circuits does nothing to files already saved on your machine. Tor Browser routes supported browser traffic through Tor; other applications and DNS behavior depend on the OS and its settings. If your network blocks Tor, Tails offers bridges. A clearnet proxy such as tor2web terminates the onion connection on the proxy's infrastructure. You would have to trust its operator with the connection.

02. Local Vault Layer: Storing Passwords, Mnemonic Phrases & Recovery Seeds in KeePassXC

Creating an Encrypted .kdbx Database in KeePassXC on Your Persistent Volume

Open KeePassXC from the applications menu (on some Tails releases: Applications → Accessories → KeePassXC). This local password manager saves an encrypted .kdbx file wherever you choose; it will not sync unless you arrange that yourself. Put the new database in unlocked Persistent Storage rather than the temporary home directory. After a reboot, unlock the volume and reopen the database. If the file vanished, you saved it in the wrong place.

Use the built-in generator for a unique master passphrase. Five or more random words from a sufficiently large wordlist are a reasonable starting point. Keep it separate from the drive-unlock passphrase. Create a distinct entry, generated password and unrelated pseudonym for each service. Reusing a nickname from a personal account links identities without anyone needing to break encryption.

Keep an offline backup and test that you can open it. Lock the vault when you leave the machine: malware can read unlocked entries and clipboard contents. An unencrypted CSV export exposes the records outside the vault. Check where you save attachments and exported files; they do not inherit the database's protection merely because they came from it.

Protecting Your Mnemonic Seed, Recovery Phrase & Clipboard Hygiene

A mnemonic seed or recovery phrase can restore the account or asset it belongs to. Keep necessary credentials, PGP passphrases and recovery material in clearly named vault entries. Formats and word counts vary between recovery systems; never copy one from a site's example. Set the vault to clear copied text after about ten seconds, and check the destination field before pasting. A clipboard timer will not stop an active keylogger.

After saving a recovery phrase, close the database and read the entry back. Check that the encrypted backup contains it too. A saving error you discover only when you need recovery is no longer a recoverable mistake. Never paste recovery material into support chats or verification forms. The finance guide covers payment-specific recovery.

03. Cryptographic Identity Layer: PGP Encryption, the Public Key and the Private Key

Public Key vs. Private Key Mechanics: RSA-4096, Ed25519 Public Key Specs & Local Key Generation

Symmetric encryption requires both people to share a secret in advance. With PGP encryption, you generate a pgp key pair and publish the public key. Others use it to encrypt a message to you or verify a signature you made. The private key stays on your machine and decrypts messages addressed to you. If the sender wants to read their own encrypted copy later, they must include their key as another recipient. A site that generates or retains your private key takes that control away from you.

In Kleopatra, open File → New Key Pair → Create a personal OpenPGP key pair and check the advanced settings. A 4096-bit RSA key is widely supported. Modern OpenPGP setups may use Ed25519 to sign and a compatible encryption subkey, often Curve25519. An Ed25519 public key alone does not encrypt messages. Check what your GnuPG version and intended recipients support, and confirm the key can both sign and encrypt before publishing it. Protect the locally generated private key with a separate passphrase in your vault.

• Use a dedicated pseudonym in the key's name field and leave email blank if the client permits. A real email becomes signed metadata that travels with the key.
• Generate a different key pair for each identity. Reusing a public fingerprint makes the profiles linkable.
• Set an expiry you can maintain, such as one or two years. Generate an offline revocation certificate while you still have the secret key.
• Inspect an armored public export for optional identifying headers such as Version:. Remove those headers without altering the key material.
• Back up the private key on encrypted media and test access. If you delete the only key that decrypts old messages, those messages become unreadable.
• Encrypt sensitive text locally before pasting the ciphertext into a web form. Server-side “auto encryption” can receive the plaintext first.

04. Account Defense Layer: PGP 2FA, TOTP & Two Independent Checks

How PGP Challenge-Response 2FA Protection Works Without a Mobile Device

The platform's feature notes say users need a PGP key and two-factor authentication to send messages or use account features. Check that policy in the current interface. In a typical PGP 2FA flow, the server encrypts a one-time challenge to the public key on your profile. You decrypt it locally in Kleopatra or GnuPG and enter the code. The server can then check that you hold the private key as well as the password.

TOTP works well for general-purpose 2FA. A phone app adds another device and backup path; PGP challenges avoid that requirement. Neither method protects a code entered on a live relay. Keep the private-key passphrase in your vault, and check which public key the account has registered.

Why 2FA Protection Cannot Stop a Real-Time Proxy: Proceed to Stage 2

A cloned page can pass along a genuine 2FA challenge and relay your response in real time. It never has to break the encryption. Before entering your credentials, compare the signed address and the signer’s full fingerprint with a trusted record from another source. If the key and address both came from the page you’re checking, they can match perfectly and still belong to an attacker.