Text version · no JavaScript needed

Zen Privacy Collective, in plain text.

Pay-what-you-can privacy and security education for families, co-ops, organizers, and anyone being targeted. This page has the site's core content without the app: workshops, the calendar, headlines, and our guides. The full site has the quiz, search, and interactive guides.

Workshops: five Fridays, zero panic

Fridays, 6:30–8 PM ET, in person and online. 20 seats per room. Pay what you can; no one turned away. ASL interpretation and childcare on request.

Friday, October 2, 2026: Workshop 1, Digital Hygiene Foundations

Threat modeling for individuals and small organizations. We'll inventory your digital exposure, identify who wants what about you, and build a personal privacy baseline.

• What counts as personally identifiable information, and why it matters
• Threat modeling basics: adversaries, assets, and likelihood
• Data inventory: where your data lives and who holds it
• Creating a personal digital hygiene checklist

Before you come: Free 1-hour course: “Digital Privacy Fundamentals” (link sent when you book)

Friday, October 9, 2026: Workshop 2, Secure Communications & Tools

Move beyond app choices to protocol design. We'll build a communications stack for your team, evaluate tools critically, and practice habits that stick.

• End-to-end encryption: what it is and what it isn't
• Evaluating tools critically (Proton, Signal, Matrix/Element, etc.)
• Team communication agreements that work
• Operational security (OPSEC) for remote teams
• Incident response for compromised communications

Before you come: Workshop 1 or equivalent knowledge

Friday, October 16, 2026: Workshop 3, Local AI Infrastructure & Privacy

Run AI tools without cloud vendors. We'll set up local models, explore privacy-preserving compute patterns, and understand data sovereignty in practice.

• How cloud AI models train on user data (and what that means)
• Local-first AI infrastructure: Ollama, open models, and more
• Privacy-preserving techniques: differential privacy, federated learning
• Hands-on: set up Ollama with a current open-weight model
• Self-hosted assistants for organizations: what to run, where, and who sees the data

Before you come: Basic command-line comfort, or Workshops 1 + 2

Friday, October 23, 2026: Workshop 4, Computer Use Security & OPSEC

Secure your machine and your habits. Device hardening, browser isolation, and the human practices that matter more than tools.

• Device inventory and threat assessment
• Operating system hardening (macOS, Linux, Windows)
• Browser isolation and privacy configurations
• Password management and secret handling
• Detecting compromise: what to look for
• OPSEC habits for high-risk work

Before you come: Workshops 1–3 or equivalent

Friday, October 30, 2026: Workshop 5, Organizational Privacy Systems (Capstone)

Build privacy governance that sticks. Design policies, create accountability structures, and align privacy with your organization's values and decision-making.

• Privacy policies that teams actually follow
• Governance structures for privacy decisions (including consent-based and co-op models)
• Training and culture change
• Audit and accountability mechanisms
• Building a privacy-first culture over time

Before you come: Workshops 1–4 or equivalent knowledge

Calendar

Confirmed events can be booked now. Proposed dates aren't set yet: email us if you want one and we'll tell you when it's confirmed.

October 2026

November 2026

December 2026

January 2027

February 2027

March 2027

Chapters and members

We list each other by initials only. Sample directory: these chapters and members are placeholders while the collective sets up. To reach someone, email hello@zenxyprivacy.org with their initials and city in the subject.

Los Angeles, California (LA)

Hospitality and garment workers, Koreatown small businesses, and film crews who carry the whole shoot on one laptop. Forming · Second Saturdays, rotating union halls

• C R, Organizer: Hospitality union rep. Teaches what to carry to a picket line, and what to leave at home. (Speaks Spanish, English · Organizing, Devices)
• Y K, Facilitator: Helps Koreatown shop owners spot fake invoices, fake bank calls, and fake landlords. (Speaks Korean, English · Scams, Organizations)
• E V, Tech steward: Film crew data wrangler. Runs laptop clinics: updates, backups, encryption, in that order. (Speaks English, Armenian · Devices, Data & exposure)

Portland, Oregon (PDX)

Self-hosters, survivors' advocates, and mutual aid crews who'd rather run their own tools than rent them. Forming · Third Wednesdays, a bike co-op back room

• S H, Tech steward: Sysadmin who self-hosts everything, including a small open model for the co-op's paperwork. Teaches the local AI session. (Speaks English · AI, Organizations)
• N F, Accompaniment: Works with survivors' advocates on stalkerware, shared accounts, and safe device handoffs. (Speaks English, ASL · High-risk, Families)
• P G, Facilitator: Runs the drop-in device clinics out of a bike co-op. No judgment, lots of stickers. (Speaks English, Russian · Devices, Foundations)

Austin, Texas (ATX)

Construction and service workers, parents pushing back on school surveillance, and engineers who know what AI agents can reach. Forming · Last Sundays, a worker center

• G T, Organizer: Worker center volunteer. Helps crews document wage theft without exposing themselves in the process. (Speaks Spanish, English · Organizing, Scams)
• H B, Researcher: Software engineer who breaks AI assistants for a living. Explains prompt injection with real, boring examples. (Speaks English, Mandarin · AI, Accounts & comms)
• O J, Facilitator: Parent of three who got the school district to publish what its apps collect. Leads the holiday gadget check. (Speaks English · Families, Data & exposure)

Richmond, Virginia (RVA)

Worker co-ops, teachers, and the mutual aid networks that kept people fed in 2020 and never stopped. Founding chapter · First Tuesdays, a library meeting room

• K W, Accompaniment: Helped start three worker co-ops. Brings the privacy questions into bylaws and onboarding, not just the IT closet. (Speaks English · Organizations, Foundations)
• J L, Facilitator: High school teacher who read the terms of every app the district bought. Leads the teens-and-phones agreement nights. (Speaks English, Spanish · Families, Foundations)
• D P, Organizer: Runs a food distribution list with 400 households on it. Collects less data every year, on purpose. (Speaks English · Organizing, Data & exposure)

Washington, District of Columbia (DC)

Journalists, immigrant service groups, and policy nerds who read the bill so you don't have to. Founding chapter · Every other Thursday, online and in person

• A S, Researcher: Tracks privacy bills and workplace monitoring rules. Explains them in one page, with what changes on Monday. (Speaks English, French · Organizing, AI)
• B O, Facilitator: Trains reporters on safer first contact with sources. Will ask what your phone number is attached to. (Speaks English, Yoruba · High-risk, Accounts & comms)
• L M, Accompaniment: Volunteers with immigrant legal clinics. Cleans up case files, shared drives, and who can see them. (Speaks Spanish, English · High-risk, Organizations)

Dorchester, Boston, Massachusetts (DOR)

Triple-deckers, corner stores, and neighbors who speak Haitian Creole, Vietnamese, Cape Verdean Kriolu, and English. Founding chapter · First Thursdays, a community room near Fields Corner

• M D, Facilitator: Spent a decade fixing computers at the branch library. Now runs our scam-proof-your-parents nights, code words and all. (Speaks Haitian Creole, English · Scams, Families)
• T N, Tech steward: Sets up phones and point-of-sale tablets for family businesses on Dot Ave. Believes every shop needs two security keys. (Speaks Vietnamese, English · Devices, Accounts & comms)
• R A, Organizer: Tenant organizer. Moved the building association off a public group chat and onto Signal in one weekend. (Speaks Cape Verdean Kriolu, Portuguese, English · Organizing, Data & exposure)

Projects in flight

Example projects: anonymized composites, not real clients. Each moves through five stages: Order in (Request received) → Prep (Threat model) → In the oven (Fixes underway) → Quality check (Practice & drills) → Out the door (Handed off).

How a project works, step by step

1. Order in (Request received). You asked. We called back within a week and set up a first conversation.

• First call (ZPC lead): 30 minutes: what you do, what worries you, who's involved.
• Consent & data agreement (ZPC lead): What we'll see, what we'll keep, and when we delete it. In writing, before we look at anything.
• Pick your stewards (Your stewards): Two or three people who'll carry this after hand-off.
• Pay what you can, or match a sponsor (Partners & tools): Your group pays what fits; a sponsor covers the rest.

2. Prep (Threat model). Who wants what, where the data lives, who has access. We map it with your people, not for them.

• Threat-model session (Everyone in the group): Who wants what, how they'd get it, and what would hurt most.
• Data & access inventory (Your stewards): Every place your data lives and everyone who can open it.
• Anonymous device & account survey (Partners & tools): A short form, no names: phones, updates, MFA, shared logins.
• Rank the risks: top three first (ZPC lead): Likelihood times harm. Three fixes that matter beat thirty that don't.
• Plan sign-off by consent (Everyone in the group): The plan moves forward when nobody has a reasoned objection.

3. In the oven (Fixes underway). Accounts, devices, drives, and group chats, fixed in order of risk. The top three first.

• Accounts: MFA, passkeys, password manager (Your stewards): Starting with email, because email resets everything else.
• Shared drives & link cleanup (Your stewards): No more “anyone with the link.” Former members removed.
• Group chats & communications (Everyone in the group): The right tool for each conversation, with disappearing messages where they help.
• Devices: updates & encryption (Everyone in the group): Every phone and laptop updating and encrypted, or on a plan to replace it.
• Collect less, delete more (ZPC lead): Cut forms down to what you use, and set dates to delete the rest.
• Hardware & kits (Partners & tools): Security keys and replacement phones, sourced direct and set up with you.

4. Quality check (Practice & drills). Everyone practices the new habits: the phishing drill, the lost-phone drill, the new sign-up flow.

• Phishing drill (Partners & tools): A friendly fake email. Nobody gets shamed; everybody learns the tell.
• Lost-phone drill (Everyone in the group): Walk through a lost or seized phone, start to finish, in ten minutes.
• Fake-invoice drill (Your stewards): Practice the two-person rule and the call-back rule for money.
• Access re-check (ZPC lead): Run the inventory again and confirm the fixes stuck.
• Fix what the drills found (Your stewards): Every drill finds something. Fix it while it's fresh.

5. Out the door (Handed off). It's yours: a playbook, trained stewards, and a 90-day check-in on the calendar.

• Playbook in your languages (ZPC lead): Short, specific to your group, and in the languages your members use.
• Steward training & handover (Your stewards): Your stewards run a drill on their own before we step back.
• Delete our copy of your details (ZPC lead): Inventories, notes, and contact lists: gone, and we tell you when.
• 90-day check-in on the calendar (Partners & tools): An automatic reminder for both of us.
• Share what we learned, anonymized (ZPC lead): Only with your OK, so the next group starts smarter.

How to book

Email hello@zenxyprivacy.org with the session you want, in person or online, a name (a nickname is fine), and any access needs (ASL, captions, childcare, anything else). Pay what you can: suggested $10, $25, or $50, or nothing. Nobody checks.

Want a session for your group, or to bring us to your city? Email us with your city and group.

Latest privacy & security headlines

From 17 newsrooms and watchdogs, collected by us once a day. Links go to the publisher.

• Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root (BleepingComputer, 2026-10-18 · Malware & ransomware)
• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer, 2026-10-17 · Breaches & leaks)
• Drupal patches critical RCE flaws, warns exploits may emerge soon (BleepingComputer, 2026-10-17 · Malware & ransomware)
• This Might Be the Earliest Known Spear Murder In Earth’s History (404 Media, 2026-10-17)
• Encryption Is Getting Squeezed From All Sides (Wired Security, 2026-10-17 · Encryption & accounts)
• The power of AI is worrying senior Labour figures – as is the fear of ‘falling behind the public’ (Guardian Data Protection, 2026-10-17 · AI & agents, Workers & organizing)
• Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact (Schneier on Security, 2026-10-16)
• OpenAI models hacked a crypto wallet and breached more websites (Ars Technica Security, 2026-10-16 · AI & agents, Breaches & leaks)
• Critical BlockStrap flaw lets hackers run code on Magento servers (BleepingComputer, 2026-10-16 · Malware & ransomware)
• Chicago-Area Cops Helped HSI Spy on Minnesota Anti-ICE Activists (Wired Security, 2026-10-16 · Surveillance, Workers & organizing)
• Targeted ads installed Candiru spyware in zero-click attacks (BleepingComputer, 2026-10-16 · Spyware & stalkerware, Data brokers & tracking)
• This is the best unpaywalled public-records-based reporting of the year (Freedom of the Press, 2026-10-16 · Law & policy, Workers & organizing)
• Behind the Blog: Doing Whatever (404 Media, 2026-10-16)
• Podcast: Cops Can Use AI to Pinpoint Your Home with Just One Photo (404 Media, 2026-10-16 · AI & agents, Surveillance, Law & policy)
• The Lawful Access Act’s threats to Canada’s national security (Citizen Lab, 2026-10-16 · Law & policy)
• Proofpoint lines up $6.3 billion deal for Varonis’ data security (The Record, 2026-10-16)
• Here’s What Telegram Giving Data to the U.S. Government Looks Like (404 Media, 2026-10-16 · Law & policy)
• Eiliko robot companion exposes private chats and can be hijacked (Malwarebytes, 2026-10-16)
• Cops Used AI Generated Photos of a Child to Lure Out a Suspected Predator (404 Media, 2026-10-16 · AI & agents, Spyware & stalkerware, Kids & families, Workers & organizing)
• Employees using personal ChatGPT at work? Here's what IT admins need to do (BleepingComputer, 2026-10-16 · AI & agents, Workers & organizing)
• Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia (The Record, 2026-10-16 · Breaches & leaks, Surveillance)
• Baltimore suburb confirms August data breach after ransomware claims (The Record, 2026-10-16 · Breaches & leaks, Malware & ransomware)
• Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (The Record, 2026-10-16 · Malware & ransomware)
• Burger King Japan data breach exposes 11 million customer records (BleepingComputer, 2026-10-16 · Breaches & leaks)
• “Spray and pray” job applications could make it harder for you to spot a scam (Malwarebytes, 2026-10-16 · Scams & phishing)
• Backdooring Open-Weight AI Models (Schneier on Security, 2026-10-16 · AI & agents, Malware & ransomware)
• OpenAI sued over children safety and data use (Malwarebytes, 2026-10-16 · AI & agents, Kids & families, Law & policy)
• Microsoft: October Windows update may break Smart App Control (BleepingComputer, 2026-10-16)
• BAE Systems cyberattack disrupts US federal court operations (BleepingComputer, 2026-10-16 · Law & policy)
• BeyondTrust patches zero-day exploited in attacks since August (BleepingComputer, 2026-10-16 · Malware & ransomware)

Common security fails, and the fix for each

Accounts & access

• Phishing and fake login pages. “Your mailbox is full”, a shared-document notice, a delivery text, or a QR code on a flyer sends you to a page that looks exactly like your real login. The attacker relays your password and code in real time. Fix: Use hardware security keys or passkeys for email and admin accounts — they refuse look-alike domains. If your password manager doesn't autofill, stop and check the address. Never log in from a link.
• Password reuse. One old shopping site gets breached. Attackers automatically try the same email and password on email, banking, and work tools (“credential stuffing”). Fix: A password manager with a unique, generated password for every account. Check your addresses on Have I Been Pwned and change anything that shows up.
• No MFA, or SMS-only MFA. A leaked password is all it takes. Or an attacker talks your carrier into moving your number to their SIM and receives your codes. Fix: Turn on MFA everywhere, starting with email. Prefer security keys or passkeys, then an authenticator app. Add a carrier PIN / port-out lock.
• MFA fatigue and help-desk social engineering. Dozens of “Approve sign-in?” prompts at 2 AM until someone taps yes. Or a caller posing as a locked-out colleague asking for an MFA reset. Fix: Use number-matching or security keys instead of simple push approvals. Write down an identity-verification procedure for resets and never skip it under pressure.
• Accounts nobody turned off. A volunteer left two years ago but still has the shared drive, the social password, and admin on the website. Or everyone shares one login, so nobody can be removed. Fix: Keep a simple access inventory. Individual accounts, a team vault for shared passwords, and an offboarding checklist run the same day someone leaves. Review quarterly.

Communications

• The wrong person in the group chat. Encryption works perfectly, but the chat has grown to include people nobody remembers adding, an ex-member, or an autocomplete mistake. Fix: Name an owner for every sensitive group. Check the member list before sharing, verify safety numbers, use disappearing messages, and start fresh groups rather than growing old ones forever.
• Payment and invoice fraud (including deepfakes). An “urgent” email from a coordinator or vendor with new bank details. Increasingly, a call with a convincing cloned voice or face. Fix: A written rule: any new payment or bank-detail change is confirmed by calling back a known number and approved by two people. Agree on a verbal code phrase for emergencies.
• Hidden metadata in files and photos. A photo carries the GPS coordinates of your home. A PDF carries the author's name, tracked changes, or “redactions” you can copy text from underneath. Fix: Strip metadata before sharing (mat2, ExifTool, or your phone's “remove location” option). Redact with a proper tool, export a fresh PDF, and check it.
• Pasting sensitive data into cloud AI tools. Member records, donor lists, source code, or case notes pasted into a free chatbot to “summarize this.” That data may be stored, reviewed, or used for training. Fix: A one-page AI agreement: what data may go where. Use plans with training turned off, or run models locally for sensitive material (Workshop 3).

Devices & data

• Unpatched devices and routers. “Remind me later” for months. A router or office NAS still on its default admin password. Fix: Turn on automatic updates. Replace devices that no longer get security updates. Change default passwords and turn off remote admin.
• Lost or stolen device without encryption. A laptop left in a car or a USB stick lost at an event holds everything, readable by whoever picks it up. Fix: Full-disk encryption (FileVault, BitLocker, LUKS), a strong screen lock, encrypted USB drives, and remote locate and wipe.
• Publicly shared cloud links. “Anyone with the link can view” on a folder of member records, or a public calendar showing meeting locations. Fix: Default to named-people sharing. Audit link shares quarterly. Keep sensitive calendars private.
• Ransomware with no working backup. Files are encrypted and the “backup” was a synced folder that got encrypted too — or one nobody had ever restored. Fix: 3-2-1: three copies, two kinds of storage, one offline or immutable. Test a restore twice a year.
• Malicious browser extensions and app permissions. A helpful extension gets sold and starts reading every page you visit. A “Sign in with…” pop-up asks for full mailbox access. Fix: Keep extensions to a short, known list. Review connected apps and remove anything you don't recognize.
• Secrets committed to code or documents. An API key or database password in a public repo, a shared doc, or a screenshot. Bots scan for these within minutes. Fix: Use a secrets manager or environment variables, turn on secret scanning, and rotate any exposed key immediately. Deleting the commit is not enough.

People & places

• Data broker exposure and doxxing. Your address, phone, and relatives are listed on people-search sites. Combined with social media, that's enough to show up at your door. Fix: Search yourself (Workshop 1), opt out of people-search sites, use a PO box or registered agent for public filings, and lock down profiles.
• Stalkerware and hidden trackers. Monitoring software installed by someone with access to your phone, a family location share nobody turned off, or a Bluetooth tracker in a bag. Fix: Review location and device-sharing settings; use unknown-tracker alerts. If you suspect stalkerware, plan with an advocate before removing it — removal can alert the abuser.
• Physical access: tailgating, shoulder surfing, USB drops. Someone follows people through a locked door. A password is read over a shoulder. A “found” USB stick gets plugged in. Fix: Lock screens when you step away, use privacy screens, never plug in unknown USB devices, and make it normal to ask visitors who they're with.

Tools we actually trust

Communication & collaboration: Encrypted messaging

• Signal: End-to-end encrypted messaging, calls, and groups. Open-source protocol with independent audits. Desktop and mobile. (Open source · E2E · Free · Easy)
• Matrix / Element: Decentralized, self-hostable messaging with E2E encryption. Federated like email. Bridges to other networks. (Open source · Self-hostable · E2E · Free · Medium)
• Briar: Peer-to-peer messaging that works without internet if needed. Tor-integrated. Useful under censorship. (Open source · Peer-to-peer · Free · Medium · Android)

Communication & collaboration: Email & document exchange

• Proton Mail: End-to-end encrypted email with open-source cryptography and zero-access design. (Open-source apps · E2E · Free–$ · Easy)
• Mailbox.org: Privacy-respecting email with optional PGP. German privacy law, strong anti-surveillance stance. (Proprietary · $ · Easy)
• OpenPGP: Resources and tools for PGP encryption. A legacy standard, still widely supported in the security community. (Open standard · Free · Advanced)

Communication & collaboration: Project collaboration

• Nextcloud: Self-hosted file sync, calendar, contacts, and tasks. Full control over your shared data. (Open source · Self-hostable · Free–$$ · Medium)
• Forgejo / Gitea: Self-hosted git. Forgejo is the community-governed fork, with federation work underway. (Open source · Self-hostable · Free · Medium)
• OnlyOffice: Self-hosted document collaboration, interoperable with Microsoft and Google formats. (Open source · Self-hostable · Free–$$ · Medium)
• CryptPad: End-to-end encrypted docs, sheets, forms, and kanban boards. A private alternative to Google Docs. (Open source · Self-hostable · E2E · Free–$ · Easy)
• Jitsi Meet: Video meetings in the browser, no account required. Self-host for full control. (Open source · Self-hostable · Free · Easy)

Local & self-hosted infrastructure: AI & language models (local-first)

• Ollama: Run large language models locally. Simple CLI. No cloud, no tracking. (Open source · Local · Free · Medium)
• LM Studio: Desktop app for running local models. GUI-based and beginner-friendly. (Proprietary app · Local · Free · Easy)
• Open-weight models: Llama, Mistral, Qwen, Gemma and others. Pick by size and licence; check each licence before commercial use. (Open weights · Local · Free · Medium)

Local & self-hosted infrastructure: Infrastructure & deployment

• Docker & Podman: Containers for reproducible, isolated deployments. Podman is the daemonless alternative. (Open source · Free · Medium)
• Kubernetes: Container orchestration at scale. Complex, but powerful for larger deployments. (Open source · Free · Advanced)
• OpenTofu / Terraform: Infrastructure as code. OpenTofu is the open-source fork created after Terraform's licence change. (OpenTofu: open source · Terraform: BSL · Free · Advanced)

Device security & privacy: Operating systems

• Linux (Fedora, Debian): Full transparency and control. Fedora for current software, Debian for stability. (Open source · Free · Medium)
• Tails: Live OS from USB. Uses Tor by default and leaves no traces. (Open source · Free · Medium · High-risk tier)
• Whonix: Two VMs: one for Tor, one isolated for apps. Stronger isolation than Tails. (Open source · Free · Advanced · High-risk tier)
• Qubes OS: Runs each task in its own VM, so a compromised browser can't reach your documents. (Open source · Free · Advanced · High-risk tier)

Device security & privacy: Browsers & blockers

• Firefox, hardened: Configurable for strong privacy. Pair with uBlock Origin. (Open source · Free · Easy)
• Tor Browser: Anonymizes your traffic. Essential for high-risk work or censored regions. (Open source · Free · Easy · High-risk tier)
• uBlock Origin: Blocks ads, unwanted scripts, and tracking pixels. (Open source · Free · Easy)

Device security & privacy: Passwords & secrets

• Bitwarden: Open-source password manager with shared vaults for teams. (Open source · Self-hostable · Free–$ · Easy)
• 1Password: Professional-grade, publishes audits and security design. Team vaults for organizations. (Proprietary · $ · Easy)
• Pass: Command-line password manager using GPG. Minimal, Unix-style. (Open source · Free · Advanced)

Device security & privacy: Mobile

• GrapheneOS: Hardened Android for Pixel phones. Strong sandboxing, no Google services by default. (Open source · Free · Medium · High-risk tier)
• Aegis / Ente Auth: Authenticator apps with encrypted backups. Ente Auth is cross-platform. (Open source · Free · Easy)
• F-Droid: App store for free and open-source Android apps, with anti-feature labels. (Open source · Free · Medium)

Network, encryption & sharing: Aliases & virtual cards

• SimpleLogin: One email alias per service, forwarded to your real inbox. Now part of Proton. (Open source · Free–$ · Easy)
• Addy.io: Unlimited aliases on the fly; turn one off the moment it gets spam. (Open source · Self-hostable · Free–$ · Easy)
• Privacy.com: Virtual card numbers per merchant, with spending limits. A breach at one shop can't touch the rest. (Proprietary · Free–$ · Easy · US only)
• Proton Pass aliases: Password manager that creates an alias as you sign up. (Open source · Free–$ · Easy)

Network, encryption & sharing: VPN & DNS

• Mullvad VPN: No email needed, flat price, accepts cash. Audited. A VPN moves trust; it doesn't make you anonymous. (Open-source apps · $ · Easy)
• Quad9: Nonprofit DNS resolver that blocks known malicious domains. (Free · Easy)
• Pi-hole / AdGuard Home: Network-wide ad and tracker blocking for every device on your Wi-Fi. (Open source · Self-hostable · Free · Medium)

Network, encryption & sharing: Encryption & backup

• VeraCrypt: Encrypted containers and drives across Windows, macOS, and Linux. (Open source · Free · Medium)
• Cryptomator: Encrypts files before they reach any cloud drive. (Open source · Free–$ · Easy)
• restic / BorgBackup: Encrypted, deduplicated backups. Pair with an offline copy. (Open source · Free · Advanced)

Network, encryption & sharing: Sharing & cleanup

• OnionShare: Share files or host a drop box over Tor, no account or third-party server. (Open source · Free · Easy · High-risk tier)
• mat2 / ExifTool: Strip location, author, and device metadata before sharing. (Open source · Free · Medium)

Research & threat intelligence: OSINT & exposure

• SpiderFoot: OSINT automation framework with 200+ modules. Runs locally. (Open source · Local · Free · Medium)
• theHarvester: Domain footprinting: emails, subdomains, IPs from public sources. (Open source · Free · Advanced)
• OWASP Amass: Attack surface mapping and network reconnaissance. (Open source · Free · Advanced)
• Shodan: Search internet-connected devices and exposed services. (Proprietary · Free–$ · Medium)
• Censys: Certificate and host data with historical depth. (Proprietary · Free–$$ · Medium)
• Have I Been Pwned: Check whether your addresses appear in known breaches. (Free · Easy)

Research & threat intelligence: Threat modeling

• Maltego: Visual link analysis and investigation. Free tier for learning. (Proprietary · Free–$$$$ · Advanced)
• MITRE ATT&CK: Knowledge base of adversary tactics and techniques. (Open knowledge base · Free · Medium)

Gear (buy direct, buy two keys)

Everyday carry

The physical layer. Small things that close the gap between the digital world and the real one.

• Two security keys: Keep one on your keys, one at home. The single best thing to carry. (Phishing-proof · $–$ · Easy)
• BusKill kill cord: Magnetic cable from wrist to laptop. If yanked, it locks, shuts down, or wipes. (Open source · $ · Medium)
• Faraday pouch: Wireless-dark on demand: no cell, Wi-Fi, or Bluetooth until you take it out. ($–$ · Easy)
• USB data blocker: Charge from public ports without letting data through. ($ · Easy)
• Privacy screen: Your screen reads clearly to you and blank to the person next to you. ($ · Easy)
• Rayhunter (IMSI-catcher detector): EFF's tool that flags signs of fake cell towers at protests and events. (Open source · $ · Advanced · High-risk tier)
• Cash: The original privacy tool. No record of where, when, or how much. (Free · Easy)

Security keys & authentication

The single best purchase for most people. Buy two per person: one daily, one backup.

• YubiKey 5 / Security Key: FIDO2 passkeys, one-time codes, smart-card features. Widest service support. (Phishing-resistant · $–$$ · Easy · Closed firmware)
• Nitrokey 3: Open-source firmware and hardware. FIDO2, one-time codes, OpenPGP. (Open source · Phishing-resistant · $–$$ · Easy–Medium)
• Token2 FIDO2 keys: Low-cost keys, including fingerprint and PIN models. Good for outfitting a whole team. (Phishing-resistant · $ · Easy)
• OnlyKey: PIN-pad key that also stores passwords; FIDO2 and OpenPGP. (Open source · $$ · Medium)

Phones

Usually the most sensitive device you own. Choose one with long-term security updates.

• Google Pixel + GrapheneOS: Buy new and unlocked, then install GrapheneOS yourself. (Open source OS · $$$ · Medium setup · High-risk tier)
• Librem 5 (Purism): Linux phone with hardware kill switches. Expect trade-offs in apps and polish. (Open source · $$$$ · Advanced)
• PinePhone (Pine64): Low-cost Linux phone for learning and tinkering. (Open source · $ · Advanced · hobbyist)
• Fairphone: Ethically sourced, user-repairable phone with long support. Available with /e/OS. (Repairable · $$ · Easy)
• Murena (/e/OS): Phones sold with /e/OS: Android without Google tracking, ready to use. (De-Googled · $–$$ · Easy)
• Punkt MC02: Swiss privacy phone running AphyOS with a subscription model. (De-Googled · $$ · Easy)
• Cape: Mobile carrier built to resist SIM swaps and collect minimal data. (Privacy carrier · $ / month · Easy)

Laptops & desktops

Runs Linux well, gets firmware updates, can be repaired instead of replaced.

• Framework Laptop: Modular, repairable, runs Linux well. (Repairable · $$$–$$$$ · Easy)
• NovaCustom: Coreboot/Dasharo firmware; some models Qubes-certified. (Open firmware · $$$$ · Medium · High-risk tier)
• Purism Librem: Coreboot, PureBoot tamper detection, kill switches. (Open firmware · $$$$ · Medium)
• System76: Linux-first laptops and desktops with Pop!_OS. (Linux preinstalled · $$$–$$$$ · Easy)
• Star Labs: Linux laptops with coreboot option, shipped from the UK. (Open firmware · $$$–$$$$ · Easy)

Network & shared infrastructure

Your router sees everything. These put you back in control of it.

• Protectli Vault: Fanless firewall boxes for OPNsense or pfSense. (Self-hosted · $$–$$$ · Medium–Advanced)
• GL.iNet travel routers: Pocket OpenWrt routers with WireGuard. Protects you on conference Wi-Fi. (Open-source base · $–$$ · Easy)
• Raspberry Pi: Cheap computer for Pi-hole, a password vault, or a lab. (Self-hosted · $ · Medium)
• Start9 / Umbrel: Plug-in home servers for Nextcloud, Vaultwarden, and more. (Self-hosted · $$$ · Easy–Medium)
• Home Assistant Green: Local smart-home hub that doesn't depend on a vendor cloud. (Local-first · $$ · Medium)

Storage & physical privacy

Protect data at rest and devices in transit.

• Apricorn Aegis Secure Key: USB drive with on-device PIN pad; no software needed. (Hardware-encrypted · $$–$$$ · Easy)
• Mission Darkness Faraday bags: Signal-blocking bags for travel, evidence handling, or device-free meetings. ($–$$ · Easy · High-risk tier)
• SLNT Faraday bags: Everyday-style Faraday backpacks and sleeves. ($–$$ · Easy)
• Privacy screens & webcam covers: Cheap, effective protection against shoulder surfing. ($ · Easy)

Open hardware makers

Places to find auditable, community-built devices.

• Crowd Supply: Crowdfunding and store for open-source hardware. (Open hardware · Varies)
• Pine64 store: Open, low-cost boards, phones, and laptops for learning. (Open hardware · $–$$)

Services worth paying for

Paying directly is often the most private option: you're the customer, not the product.

• Mullvad VPN: Flat price, no email to sign up, accepts cash. (Audited · $ / month · Easy)
• Proton (Mail, Drive, VPN, Pass): Encrypted suite from one Swiss provider, with team plans. (E2E encrypted · $ / month · Easy)
• Bitwarden Premium / Teams: Security-key login, vault health, shared team vaults. (Open source · $ / year · Easy)

Library: words that keep you safe

3-2-1 backups

Three copies, on two kinds of storage, with one offline or off-site. Why it matters: Ransomware, fires, and AI agents that “clean up” files all end the same way without a tested backup. Try it: Restore one file this week. If you can't, you don't have a backup yet.

AI agents

AI that takes actions: clicking, sending, coding, buying, deleting. Why it matters: Useful and obedient, but easily fooled, and fast enough to do damage in seconds. Try it: Give agents their own limited accounts. Require your approval for anything irreversible.

Attack surface

Every door someone could use to reach you: accounts, devices, people, habits, and the AI tools you've connected. Why it matters: You can't close doors you haven't counted. Try it: Take our open-doors quiz, then list every account that can reset another account.

Border & device searches

Authorities at borders, protests, or traffic stops may try to search or copy your devices. Why it matters: Everything on your phone can be copied in minutes with forensic tools. Try it: Travel with less. Power off before checkpoints. Know your rights where you live.

Browser fingerprinting

Sites identify your browser from its setup (fonts, screen, graphics) without cookies. Why it matters: It survives clearing cookies, private mode, and often VPNs. Try it: Run EFF's Cover Your Tracks test, then try Tor Browser or Mullvad Browser and compare.

Cell-site simulators (IMSI catchers)

Fake cell towers that trick nearby phones into connecting and identifying themselves. Why it matters: They've been used to log who attended protests. Try it: Airplane mode or a Faraday pouch at sensitive events. EFF's Rayhunter can flag suspicious towers.

CISA (Cybersecurity and Infrastructure Security Agency)

The U.S. agency responsible for defending civilian government networks and helping everyone else. Publishes free guides like Secure Our World. Why it matters: Its small-organization guides and ransomware resources are free, plain-language, and practical. Try it: Use CISA's Cyber Essentials as a one-page checklist for your group.

Citizen Lab (Citizen Lab, Munk School of Global Affairs, University of Toronto)

An academic research lab that investigates spyware and digital attacks against journalists, activists, and civil society. Why it matters: It exposed tools like the Pegasus spyware used against reporters and human-rights defenders. Try it: If you're high-risk, read one of their reports to see what targeted attacks look like.

Compartmentalization

Keeping separate parts of your life on separate accounts, numbers, browsers, or devices. Why it matters: When one compartment is exposed, the others stay safe. Try it: Give your organizing work its own email and phone number. Never log into it from your personal browser profile.

Data breaches & credential stuffing

When a company leaks your data, attackers automatically try those passwords everywhere else. Why it matters: Your oldest forgotten account can open your newest important one. Try it: Check your emails on Have I Been Pwned and change anything that shows up.

Data brokers

Companies that collect and sell your address, phone, relatives, and habits. Why it matters: It's how strangers, stalkers, and scammers find you, and AI makes stitching it together instant. Try it: Search your name on people-search sites and submit opt-outs, or use a removal service.

EFF (Electronic Frontier Foundation)

A nonprofit founded in 1990 that defends civil liberties online through lawsuits, research, and free tools like Surveillance Self-Defense and Rayhunter. Why it matters: EFF writes some of the clearest, most trusted security guides for ordinary people and activists. Try it: Pick a playlist on Surveillance Self-Defense that matches you.

Email aliases

Throwaway forwarding addresses so every site gets a different email. Why it matters: Breaches can't be linked together, and spam is easy to shut off. Try it: Try SimpleLogin or addy.io for new sign-ups.

End-to-end encryption (E2EE)

Only the people in the conversation hold the keys. The company in the middle can't read it. Why it matters: It protects content from hacks, subpoenas, and snooping employees. It doesn't hide who you talk to. Try it: Move sensitive conversations to Signal. Verify safety numbers with the people who matter most.

Every alias is a canary

Give every service its own email alias. If spam shows up at “shop-x7k@…”, you know exactly who sold or leaked your address. Why it matters: Your real email is a universal ID that links you across brokers and breaches. Aliases cut that thread, one relationship at a time. Try it: Next sign-up, use SimpleLogin, Addy.io, or your password manager's alias feature instead of your real email.

FIDO Alliance (Fast IDentity Online)

The industry group behind the open standards for security keys and passkeys. Why it matters: It's the reason one security key works with Google, Apple, Microsoft, and your password manager. Try it: Look for “FIDO2” or “passkey” support before you buy a key or pick a service.

Full-disk encryption

Scrambles everything on a device so it's unreadable without your passcode. Why it matters: A lost or seized laptop becomes a paperweight instead of a data leak. Try it: Turn on FileVault, BitLocker, or LUKS. Use a real passcode on your phone, not just your face.

Group-chat hygiene

Rules for who's in a group, who owns it, and how long messages last. Why it matters: The most secure app can't help if the wrong person is in the room. Try it: Name an owner for every sensitive group. Review members monthly. Turn on disappearing messages.

ICA (International Cooperative Alliance)

The global body for cooperatives, founded in 1895. Keeper of the seven cooperative principles. Why it matters: Our way of working, from democratic control to concern for community, adapts its principles. Try it: Read the seven principles, then ask which ones your group already practices.

ID checks & face scans (KYC)

“Know your customer” checks where a company scans your ID and face, often through vendors like Persona, Jumio, or Onfido. Why it matters: Those vendors keep biometric data you can't change. Cloaking tools don't work on live video checks. Try it: After a verification, send the vendor a deletion request if your state or country gives you that right.

Least privilege

Give each person, app, or AI agent only the access it needs, for only as long as it needs it. Why it matters: When something goes wrong, the damage stays small. Try it: List who has admin on your website, bank, and drive. Remove anyone who doesn't need it.

License-plate readers (ALPR)

Cameras, like Flock, that log every car that passes and share the data widely. Why it matters: They build a searchable history of where your car has been. Try it: Find out if your city uses them (EFF's Atlas of Surveillance) and show up at council meetings.

Local AI

Running AI models on your own computer instead of a company's cloud. Why it matters: Sensitive data never leaves your machine or trains someone else's model. Try it: Install Ollama and try a small open model on a non-sensitive task.

Location tracking

Your phone, apps, car, and ad networks recording where you go. Why it matters: Location data is sold, subpoenaed, and used to identify people at clinics, protests, and homes. Try it: Turn off ad tracking and precise location for apps that don't need it. Review location sharing.

Metadata

Data about data: who, when, where, how long. Plus hidden info inside photos and files. Why it matters: Metadata can reveal your routine, relationships, and location even when content is encrypted. Try it: Strip photo location before posting. Use disappearing messages for sensitive chats.

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems)

MITRE's ATT&CK-style matrix for attacks on AI systems: poisoning training data, stealing models, hijacking agents. Why it matters: As more tools run on AI, attackers go after the AI itself. ATLAS catalogs real cases. Try it: Read two or three of its case studies to see how AI attacks actually happen.

MITRE ATT&CK (MITRE is a name, not an acronym. ATT&CK = Adversarial Tactics, Techniques, and Common Knowledge)

MITRE is a U.S. nonprofit that runs federally funded research centers. ATT&CK is its free, public map of how real attackers behave, organized by goal (tactics) and method (techniques). Why it matters: It gives defenders one shared language for attacks. Our Open Doors Matrix is a people-sized version of the same idea. Try it: Open our Open Doors Matrix first; it's the plain-language version.

Multi-factor authentication (MFA)

Logging in with something you know plus something you have, like an app code or security key. Why it matters: It stops most account takeovers, even when your password leaks. Try it: Turn it on for email first, since email resets everything else. Avoid SMS codes when you can.

NIST (National Institute of Standards and Technology)

A U.S. Commerce Department agency that sets measurement and technology standards, including widely copied password and security guidance. Why it matters: NIST's advice is why modern guidance says long passphrases beat forced password changes and odd symbols. Try it: Adopt NIST's core password advice: long, unique, no forced rotation, MFA on top.

Offboarding

Removing someone's access to accounts, drives, and chats when they leave. Why it matters: Former members with live access are one of the most common ways groups get hurt. Try it: Keep a one-page access list. Run it the same day someone leaves.

OPSEC

Operational security: the habits that keep small details from adding up to a big exposure. Why it matters: Most leaks aren't hacks. They're a photo, a check-in, a group chat, a pattern. Try it: Before posting, ask: what does this reveal about where I am, who I'm with, and when?

OSI model (Open Systems Interconnection)

A seven-layer reference model from the 1980s that network engineers use to describe how data moves, from physical cables up to apps. Why it matters: Our “Your tech stack” visual is loosely inspired by it, translated for people rather than engineers. Try it: Turn on nerd mode on the stack page to see which layer is which.

OSINT (Open-Source Intelligence)

Information gathered from public sources: social posts, records, photos, maps, data brokers. Why it matters: It's how journalists investigate, and how stalkers and scammers find you. Layer 7 of your stack. Try it: Search yourself the way an OSINT investigator would, then close what you find.

OWASP (Open Worldwide Application Security Project)

A nonprofit foundation and volunteer community that publishes free, open guides to making software safer. Best known for its Top 10 lists of the most critical security risks. Why it matters: Developers and security teams worldwide use the OWASP Top 10 as a checklist. Its Top 10 for LLM Applications is where risks like prompt injection got a shared name. Our People's Top 10 borrows the format. Try it: If your group builds anything with AI, skim the LLM Top 10 before you ship.

Passkeys

A password replacement stored on your device or security key, tied to one website. Why it matters: Nothing to phish, nothing to reuse, nothing to leak. Try it: Accept the passkey offer next time a major site asks. Keep a backup method.

Password manager

An encrypted vault that creates and remembers a unique password for every account. Why it matters: Password reuse is how one breach turns into ten. A manager also refuses to autofill on fake sites. Try it: Install one, then change your email, bank, and phone-carrier passwords first.

PGP (Pretty Good Privacy)

Encryption software for email and files, released by Phil Zimmermann in 1991. Lives on as the OpenPGP standard. Why it matters: It made strong encryption available to ordinary people. Zimmermann's essay on why he wrote it gave us the postcard argument. Try it: Read Zimmermann's short essay, “Why I Wrote PGP.”

Phishing

A fake message that gets you to click, log in, pay, or share. Now written by AI, in any language. Why it matters: It's still the number-one way attackers get in. Try it: Never log in from a link. Open the site yourself or use a bookmark.

Prompt injection

Hidden instructions in an email, web page, or file that hijack an AI assistant reading it. Why it matters: Whatever your AI can read, a stranger can try to steer. Labs say it may never be fully solved. Try it: Don't let an AI agent browse or read mail while it can also send, pay, or delete.

Security keys (FIDO2)

A small physical key that proves it's you, and only works on the real website. Why it matters: Phishing-proof: even a perfect fake login page can't use it. Try it: Buy two. Register both on your email and password manager. Keep one somewhere safe.

SIM swapping

An attacker convinces your carrier to move your number to their phone. Why it matters: They get your texts, including login codes and password resets. Try it: Set a carrier PIN or port-out lock today. Move important accounts off SMS codes.

Social engineering

Hacking people instead of computers: urgency, authority, and friendliness used against you. Why it matters: Help desks, carriers, and busy coordinators are all targets. Try it: Write a verification rule: big requests get confirmed by calling back a number you already had.

Threat modeling

A simple way to decide what to protect, from whom, and how much effort it's worth. Why it matters: Without one, you either do nothing or buy everything. With one, you do the three things that matter. Try it: Answer five questions: What do I want to protect? From whom? How likely? How bad if it happens? How much trouble am I willing to go through?

Virtual cards

Single-merchant card numbers with their own limits, linked to your real account. Why it matters: When one shop is breached, only that number leaks. Pause it and nothing else changes. Try it: Use a virtual card for your next subscription, with a limit just above the price.

Voice clones & deepfakes

AI-generated audio or video of someone you know, asking for money or secrets. Why it matters: A few seconds of your voice from a voicemail or video can be enough. Try it: Pick a family or team code word. Hang up and call back on a known number.

Your data rights

Laws that let you see, correct, and delete data about you: GDPR in Europe, CCPA/CPRA in California, BIPA for biometrics in Illinois, PIPEDA in Canada, and a growing list of U.S. states. Why it matters: Deletion requests are free, and companies are required to answer. They're the legal side of shrinking your public layer. Try it: Send one access request (“what do you have on me?”) to a company you've used for years.

Zero-knowledge / zero-access design

A service built so the provider can't read your data even if they wanted to. Why it matters: A company can't hand over, leak, or train on what it can't read. Try it: When choosing a cloud tool, ask: can the company read my files? If yes, keep sensitive stuff elsewhere.

Generated 2026-10-18.