## Basic Principles

Security is not a product, but an ongoing process. There are no stupid questions – when in doubt, always check! The following points distinguish between standards (should be reliably observed) and recommendations.

- Disciplined handling of passwords and updates
- Only open-source software, only end-to-end encrypted services

## Smartphone

- **Passwords:** At least 16 characters consisting of letters, numbers and special characters. No pure number codes, no patterns, no already used passwords. Passphrases are particularly secure from 20+ characters.
- **Fingerprint:** Carries risks. Restart/turn off the phone before sleeping or in critical situations (biometric unlocking is deactivated after restart).
- **Face ID:** Even greater risk – enables access almost without problems and regularly scans the environment. Better not to use!
- **Location services:** Google/Apple location services enable precise movement patterns, sometimes even when switched off. Turn off!
- **Cell towers:** Data is collected even when phones are switched on (flight mode is often not enough). If cell tower data is to be avoided: activate flight mode AND switch off.
- **VPN & TOR:** Use VPN (e.g. Proton VPN) and TOR browser.
- **Cloud:** When in doubt, avoid cloud services. Exceptions for trustworthy providers (e.g. Proton), but remain critical.
- **Updates & restarts:** Restart daily (kills most malware processes). Keep apps and operating system up to date. Check whether the manufacturer still provides security updates – if not, the device can be read by authorities.
- **Proton app:** Activate the app lock in the settings.
- **Browser:** Use secure browsers: Firefox, Brave, Vivaldi. Not: Edge, Safari, Opera.

## Signal

- Do not use on unencrypted laptops.
- Regularly delete Signal data on the laptop app, disconnect devices after each use.
- Always lock Signal on the smartphone with a password.
- Enable disappearing messages (tip: set all chats to be deleted after X weeks in the settings).
- Hide your number in the settings.
- Do not display messages on the lock screen, notifications without sender and content.
- Do not assign real names via the nickname function.
- Regularly check for updates.

## Laptop

- **Encryption:** Ideally encrypt the entire laptop (system partition), e.g. with VeraCrypt. If not possible: keep the laptop free of political material! Workaround: VeraCrypt container with a long password (min. 32 characters).
- Use VPN and TOR browser (e.g. Proton VPN).
- When in doubt, avoid cloud services.
- Regular restarts and updates (apps and operating system).
- **AI assistants are the enemy:** Disable with Winaero on Windows.
- **Password manager:** Use KeePassXC (local) or Vaultwarden (self-hosted). Remember a single strong master password – do not only use biometrics.
- **Antivirus:** 99% of antivirus software is scam. What is sufficient is: uBlock Origin in the browser and the operating system's built-in default (Windows: Microsoft Defender).
- **Browser:** Use secure browsers: Firefox, Brave, Vivaldi. Not: Edge, Safari, Opera.

## Password Best Practices

- Use passphrases instead of passwords (from 20+ characters particularly effective). Use many special characters and develop your own system for upper/lower case.
- Enable 2-factor authentication (2FA) on all accounts.
- Use passkeys where possible.

## Meetings & Protocols

- No real names or traceable abbreviations in protocols.
- Consider which information should not be recorded at all (when in doubt, ask!).
- Well-encrypted technology is always safer than well-hidden paper.
- Only use jointly agreed tools for plenum-related data (e.g. protocols in Proton, Signal chats with disappearing messages). Handle your own notes responsibly: destroy paper promptly, no unencrypted data.

## Social Media & Finances

- Bear in mind that PayPal, Instagram, BeReal etc. can make social relationships and networks transparent.
- Replace PayPal with Wemio or Revolut.

## Alternative Tools & Infrastructure

- **Messenger alternatives:** Element (Matrix-based, end-to-end encrypted).
- **Collaborative documents:** CryptPad/CryptDrive as an alternative to cloud services.
- **Proton:** Open source, but still a company with capital interests. Okay for the moment, critically question for long-term data storage.
- **Mattermost/Framateam:** Database stores unencrypted – problematic in case of access by authorities. Not recommended.

## Further Resources

- activistchecklist.org
- OAV Leipzig: Basics of IT Security
- Contact local CCC groups (Chaos Computer Club) – information at ccc.de