Start here
Six episodes on what a normal phone gives away, who can see what, and the kit’s honest scorecard.
Start with A00 →The course
The whole course, on one shelf
Five tracks and 54 episodes, from what a normal phone gives away to a full build you can rehearse in the simulator. Watch in any order. The shelf remembers what you’ve seen in this browser, or on all your devices if you sign in. Each track ends with a short assessment.
Your progress
New here · Start Here, episode 1 of 6A00 · Less Exposure, Clear Limits: A Privacy Communications Kit in 90 Seconds
Start
This browser isn't letting the site save progress, so the shelf won't remember what you watch.
54 episodes
Watch plans
Pick a path
Four ways through the same material, depending on what you need first.
Build the kit
Twenty episodes that follow the Setup Guide phase by phase, from the shopping list to the readiness check.
Start with B00 →Know the why
Nine design decisions and twelve deep dives: what was chosen, what was rejected, and the reason.
Start with C00 →Rehearse first
Seven Hardware Lab sessions. Practice the whole build with training values before you buy anything.
Start with L01 →- Watched
- Up next
- Not yet
A · 6 episodes · 38 min
Start Here
What the kit is, what a normal phone gives away, who can see what, and the honest scorecard.
Watched1:36A00 · TrailerA00: Less Exposure, Clear Limits: A Privacy Communications Kit in 90 SecondsLess Exposure, Clear Limits: A Privacy Communications Kit in 90 Seconds
Watched7:05A01 · ExplainerA01: Why a Normal Phone Is a BeaconWhy a Normal Phone Is a Beacon
Watched8:27A02 · ExplainerA02: The Whole Kit in One VideoThe Whole Kit in One Video
Watched6:46A03 · ExplainerA03: Who Can See What: Hotel Wi-Fi, Cell Towers, Apps and Your VPNWho Can See What: Hotel Wi-Fi, Cell Towers, Apps and Your VPN
Watched6:53A04 · ExplainerA04: A Night in the Hotel: The Whole Privacy Kit Working TogetherA Night in the Hotel: The Whole Privacy Kit Working Together
Watched6:50A05 · ExplainerA05: The Honest Scorecard: What the Privacy Kit Does, and Doesn't, AchieveThe Honest Scorecard: What the Privacy Kit Does, and Doesn't, Achieve
B · 20 episodes · 1 h 58 min
The Build
The how-to series. Follows the Setup Guide phase by phase, demonstrated on the Hardware Lab simulator, ending with a readiness check.
Watched6:00B00 · ExplainerB00: Before You Build: The Order, the One Habit, and the Words You'll HearBefore You Build: The Order, the One Habit, and the Words You'll Hear
Watched6:32B01 · TutorialB01: Don't Buy the Wrong Pixel: The Privacy Kit Shopping List (Phase 0.1)Don't Buy the Wrong Pixel: The Privacy Kit Shopping List (Phase 0.1)
Watched6:14B02 · TutorialB02: Five Decisions Before Anything Turns On: Privacy Kit Phase 0.2 to 0.6Five Decisions Before Anything Turns On: Privacy Kit Phase 0.2 to 0.6
Watched7:19B03 · TutorialB03: Install Debian with Full-Disk Encryption: Privacy Kit Phase 1.1Install Debian with Full-Disk Encryption: Privacy Kit Phase 1.1
Watched7:45B04 · TutorialB04: Lock Down a Privacy Laptop: Firmware Password, Tails and Mullvad (Phase 1.2–1.5)Lock Down a Privacy Laptop: Firmware Password, Tails and Mullvad (Phase 1.2–1.5)
Watched6:15B05 · TutorialB05: Install GrapheneOS with the Web Installer, Step by Step (Phase 2.1)Install GrapheneOS with the Web Installer, Step by Step (Phase 2.1)
Watched4:54B06 · TutorialB06: Harden GrapheneOS Before It Goes Online (Phase 2.2)Harden GrapheneOS Before It Goes Online (Phase 2.2)
Watched4:54B07 · TutorialB07: Activate Cape on GrapheneOS, Then Prove It Fails Closed (Phase 2, Part 3)Activate Cape on GrapheneOS, Then Prove It Fails Closed (Phase 2, Part 3)
Watched5:40B08 · TutorialB08: Signal, SimpleX or Molly? Choose Your Messaging Setup (Phase 3.0–3.1)Signal, SimpleX or Molly? Choose Your Messaging Setup (Phase 3.0–3.1)
Watched4:59B09 · TutorialB09: Set Up Signal and SimpleX, Verify Contacts Offline (Phase 3.2–3.4)Set Up Signal and SimpleX, Verify Contacts Offline (Phase 3.2–3.4)
Watched3:54B10 · TutorialB10: Build a KeePassXC Recovery Vault, Then Test the Restore (Phase 3.5)Build a KeePassXC Recovery Vault, Then Test the Restore (Phase 3.5)
Watched7:28B11 · TutorialB11: Set Up a GL.iNet Travel Router with Mullvad WireGuard (Phase 4.1–4.4)Set Up a GL.iNet Travel Router with Mullvad WireGuard (Phase 4.1–4.4)
Watched5:39B12 · TutorialB12: Low-Signature vs Nested: Switch Travel Router VPN Modes (Phase 4.5)Low-Signature vs Nested: Switch Travel Router VPN Modes (Phase 4.5)
Watched8:21B13 · TutorialB13: Our VPN Test Lied: Test a Travel Router Properly (Phase 4.6)Our VPN Test Lied: Test a Travel Router Properly (Phase 4.6)
Watched4:21B14 · TutorialB14: Power Suite and Starlink Mini: Setting Up the Optional KitPower Suite and Starlink Mini: Setting Up the Optional Kit
Watched6:13B15 · TutorialB15: Airport, Border and Hotel Arrival with a Privacy Travel KitAirport, Border and Hotel Arrival with a Privacy Travel Kit
Watched5:07B16 · TutorialB16: Everyday Rhythm and the PACE Connection Plan (Privacy Travel Kit)Everyday Rhythm and the PACE Connection Plan (Privacy Travel Kit)
Watched4:20B17 · TutorialB17: Lost Phone or Tampered Kit? The Two Playbooks (Privacy Travel Kit)Lost Phone or Tampered Kit? The Two Playbooks (Privacy Travel Kit)
Watched6:17B18 · TutorialB18: Reusing a Privacy Kit: Wipe, Rebuild, or Hand It OnReusing a Privacy Kit: Wipe, Rebuild, or Hand It On
Watched5:26B19 · TutorialB19: Readiness Checks the State, Not the Steps (Privacy Travel Kit)Readiness Checks the State, Not the Steps (Privacy Travel Kit)
C · 9 episodes · 39 min
Why This, Not That
Short design-rationale videos, one decision each: what was chosen, what was rejected, and the reason.
Watched4:25C00 · DecisionC00: Nine Decisions That Shape a Travel Privacy KitNine Decisions That Shape a Travel Privacy Kit
Watched4:36C01 · DecisionC01: Why Pixel + GrapheneOS (Not iPhone, CalyxOS, LineageOS or /e/OS)Why Pixel + GrapheneOS (Not iPhone, CalyxOS, LineageOS or /e/OS)
Watched4:12C02 · DecisionC02: Why a Privacy Carrier? Cape Is Private, Not AnonymousWhy a Privacy Carrier? Cape Is Private, Not Anonymous
Watched5:16C03 · DecisionC03: Why Debian for a Privacy Laptop (and Where Tails and Qubes Fit)Why Debian for a Privacy Laptop (and Where Tails and Qubes Fit)
Watched4:26C04 · DecisionC04: Why a VPN Router Isn't Enough: Put the VPN on Every DeviceWhy a VPN Router Isn't Enough: Put the VPN on Every Device
Watched4:31C05 · DecisionC05: Why Mullvad, and the Honest Single-Provider TradeWhy Mullvad, and the Honest Single-Provider Trade
Watched3:29C06 · DecisionC06: Why Not Two Android Profiles? Two Identities on One Phone InsteadWhy Not Two Android Profiles? Two Identities on One Phone Instead
Watched4:37C07 · DecisionC07: Why Pay Cash for the Phone (and Why the Laptop Doesn't Need It)Why Pay Cash for the Phone (and Why the Laptop Doesn't Need It)
Watched3:55C08 · DecisionC08: Why Starlink Is the Last Resort in a Travel Privacy KitWhy Starlink Is the Last Resort in a Travel Privacy Kit
D · 12 episodes · 1 h 22 min
Deep Dives
The methodology: threat model, the three properties, principles, radio limits, network modes, obfuscation, identifiers, messaging trust models, doctrine and residual risk.
Watched6:45D01 · Deep diveD01: The Threat Model: What a Privacy Kit Protects, From Whom, and Why Narrow Is a FeatureThe Threat Model: What a Privacy Kit Protects, From Whom, and Why Narrow Is a Feature
Watched5:44D02 · Deep diveD02: Encrypted Isn't Private: Confidentiality, Attribution Resistance and Low SignatureEncrypted Isn't Private: Confidentiality, Attribution Resistance and Low Signature
Watched8:24D03 · Deep diveD03: The 5 Design Principles Behind a Privacy Travel KitThe 5 Design Principles Behind a Privacy Travel Kit
Watched6:08D04 · Deep diveD04: What Your VPN Can't Hide: IMEI, IMSI, SS7 and 2G ExplainedWhat Your VPN Can't Hide: IMEI, IMSI, SS7 and 2G Explained
Watched5:01D05 · Deep diveD05: BFU vs AFU: What Protects a Phone That's Been TakenBFU vs AFU: What Protects a Phone That's Been Taken
Watched6:19D06 · Deep diveD06: What the Hotel Sees: Two Travel Router VPN Modes, and Where DNS GoesWhat the Hotel Sees: Two Travel Router VPN Modes, and Where DNS Goes
Watched5:49D07 · Deep diveD07: QUIC, DAITA, Multihop: What VPN Obfuscation Actually BuysQUIC, DAITA, Multihop: What VPN Obfuscation Actually Buys
Watched5:43D08 · Deep diveD08: Identifiers: What Rotates, What Can't, and the Persona TrapIdentifiers: What Rotates, What Can't, and the Persona Trap
Watched7:35D09 · Deep diveD09: Signal vs SimpleX vs Molly: Trust Models Matched to the RelationshipSignal vs SimpleX vs Molly: Trust Models Matched to the Relationship
Watched6:39D10 · Deep diveD10: Doctrine as a Control: Irreversible Moments and Build OrderDoctrine as a Control: Irreversible Moments and Build Order
Watched9:13D11 · Deep diveD11: The Residual-Risk Register: 11 Risks a Privacy Kit Writes DownThe Residual-Risk Register: 11 Risks a Privacy Kit Writes Down
Watched8:43D12 · Deep diveD12: Rejected Designs and Upgrade Paths for a Travel Privacy KitRejected Designs and Upgrade Paths for a Travel Privacy Kit
L · 7 episodes · 48 min
The Lab
Practice the entire build on a simulated laptop, Pixel and router, with training values and a lab that tells you exactly what went wrong.
Watched4:59L01 · Lab drillL01: Tour: The Hardware Lab and the Reference LibraryTour: The Hardware Lab and the Reference Library
Watched12:16L02 · Demo runL02: The Whole Privacy Kit Build in One Sitting: All 36 Milestones in the Hardware LabThe Whole Privacy Kit Build in One Sitting: All 36 Milestones in the Hardware Lab
Watched6:31L03 · Lab drillL03: Beat the Captive Portal: Hotel Arrival Drill in Practice ModeBeat the Captive Portal: Hotel Arrival Drill in Practice Mode
Watched3:58L04 · Lab drillL04: Drill: Recover Your Accounts From the Vault (Hardware Lab)Drill: Recover Your Accounts From the Vault (Hardware Lab)
Watched6:16L05 · Lab drillL05: Failure Drills: Break the VPN 4 Ways, Watch It Fail ClosedFailure Drills: Break the VPN 4 Ways, Watch It Fail Closed
Watched6:33L06 · Lab drillL06: 10 Privacy-Kit Mistakes the Simulator Won't Let You Make10 Privacy-Kit Mistakes the Simulator Won't Let You Make
Watched7:35L07 · Lab evidenceL07: We Attacked Our Own Privacy Kit in a Fake Hostile HotelWe Attacked Our Own Privacy Kit in a Fake Hostile Hotel
Field notes
Shorts released so far
A new one every Monday, Wednesday and Friday. Each points back to its full episode.
-
S58 · Short
The Likeliest Privacy Failure Isn't a Hacker
The likeliest failure isn't a hacker. The kit's Design Rationale keeps a residual-risk register: eleven risks that remain after its controls, written down so they can't be discovered at the wrong moment.
-
S57 · Short
Never Share One VPN Key Between Devices
Never share one VPN key between devices. One Mullvad account is fine for one person's devices, but every device gets its own registration and its own key, the router included.
-
S56 · Short
Two VPN Tunnels Aren't Two Providers
Two VPN tunnels aren't two providers. In nested mode, the kit runs Mullvad twice: plain WireGuard on the travel router, and each device's own Mullvad tunnel inside it.
-
S55 · Short
Swap the Phone, Keep the Number: Almost Nothing Changes
Swapping your phone but keeping the number changes almost nothing. That comes from the first of the kit's five design principles: identity lives at the account layer, not the hardware layer.
-
S54 · Short
No Traffic Doesn't Prove Your VPN Works
No traffic doesn't prove your VPN works. In the Hardware Lab's failure drill, the laptop's VPN goes down and the laptop reads Blocked, endpoint policy: that's Lockdown mode in its Mullvad app, so no tunnel, nothing out.
-
S53 · Short
Clicking Every Step Doesn't Make Your Privacy Kit Ready
Clicking every step doesn't make it ready. In the Hardware Lab, the Readiness panel keeps two things apart: milestones record the steps you've done, and they stay recorded; readiness checks the kit's current state.
-
S51 · Short
Don't Put Tor on Your Router
The kit's Design Rationale rejects one tempting setup: transparent Tor on the travel router, pushing every device's traffic into Tor without the apps knowing.
-
S50 · Short
Privacy Extensions Can Make You More Unique
The kit's Design Rationale rejects stacking browser privacy extensions, say Privacy Badger on top of uBlock.
-
S49 · Short
New Identity Every Trip? Why Too Many Personas Backfire
Minting a fresh, full persona for every trip feels like more privacy. It usually isn't.
-
S48 · Short
Looking Like Web Traffic Isn't Invisibility: VPN Obfuscation
Mullvad's QUIC option makes the VPN tunnel look like QUIC traffic; on the tested Debian laptop, in the endpoint-only mode, it showed up as UDP on port 443.
-
S47 · Short
Why Fingerprint Unlock Is Off on a Privacy Phone
A fingerprint is an identifier you carry on your body, and it can be compelled with a touch. A passphrase is a secret, with different legal and practical properties.
-
S46 · Short
BFU vs AFU in 45 Seconds: Why Your Phone Restarts Itself
Your phone is safest right after it restarts. Before first unlock, BFU, the decryption keys aren't in memory, and most extraction tools fail.
-
S44 · Short
This Privacy Kit Is Built for Two of Six Adversaries
The kit's adversaries are tiered by capability and, critically, by how they collect: passive collection is always on, active collection is triggered by suspicion, and the kit is optimised against the passive tiers.
-
S43 · Short
Starlink Tells the Network Where You Are
Starlink Mini is the kit's optional satellite connection for places with no signal. Powerful, but it stays off by default, because it's the loudest thing in the kit.
-
S42 · Short
Don't Ship Privacy-Kit Gear to Your Office
Buying the laptop and router online is fine, even on a business card shipped to a business address, but there are two ways to undo it.
-
S41 · Short
You Don't Need Cash for All of It: Buying a Privacy Kit
Cash across several stores is still the ideal, but it's worth being honest about what it buys.
-
S40 · Short
Your VPN Router Can't Protect Your Phone on Cellular
The obvious design puts the VPN on the travel router, and everything behind it rides that one tunnel. But on cellular, the router is out of the circuit entirely, so the phone's traffic never reaches the tunnel.
-
S39 · Short
Shut Down, Don't Sleep: Sleep Mode Leaves the Disk Key in Memory
The kit's laptop encrypts its drive. If it's lost or seized while switched off, the drive can't be read without the passphrase.
-
S38 · Short
Your Privacy Carrier Still Knows the Card That Pays
Cape signs you up without your name or Social Security number, and it rotates your IMSI, your subscriber ID, every day, which attacks long-horizon tracking by that ID.
-
S36 · Short
Reuse the Hardware, Never the Number
Handing the kit to someone new? The tempting shortcut is keeping the same Cape number, to save the re-signup. That one shortcut welds the new user to the old user's history: expose either one, and both are exposed.
-
S35 · Short
A Factory Reset Doesn't Change Your Phone's IMEI
A factory reset clears the data on the phone, but its hardware ID, the IMEI, doesn't change.
-
S34 · Short
Think Your Phone Was Tampered With? Don't Try to Clean It
If you think the kit has been tampered with, stop: turn the radios off and put the kit in the Faraday bag. Check things from a clean channel, a different phone or another person. Don't try to clean a suspect device.
-
S33 · Short
PACE in 60 Seconds: Decide Your Backup Connection in Advance
PACE is the kit's connection plan: primary, alternate, contingency, emergency, the order to try connections, decided in advance. Primary: hotel or public Wi-Fi, through the router, the cheapest and most normal.
-
S32 · Short
No Messages Overnight? Why Your Phone Is Silent After a Reboot
The phone's 2-to-4-hour auto-reboot, set in Phase 2, restarts it once it's been left locked that long, returning it to its most-secure locked state.
-
S31 · Short
Why You Shouldn't Keep Your Phone in a Faraday Bag Every Night
A phone that vanishes every night and reappears at the same cell each morning is a clean, distinctive anomaly. So the Faraday bag is reserved for deliberate blackout, like checkpoints, sensitive meetings and transit.
-
S30 · Short
What Your Hotel Desk Should Look Like
Set up in the same order every time: first the router, through the hotel's login page; right after, restore any protection the login suspended and repeat the leak and DNS checks before browsing; then the laptop, then the phone.
-
S29 · Short
Hotel Wi-Fi Login Pages Are a Gap: Keep It Short
In the hotel room, the router goes through the hotel's login page first, using GL.iNet's supported captive-portal flow, before normal use.
-
S28 · Short
Don't Let Your Phone Check In Next to Your Passport
In the terminal, keep the phone switched off or inside the Faraday bag, so it never attaches to an airport tower and never creates a record next to your passport scan.
-
S27 · Short
Why Your Starlink Mini Keeps Dying at Start-Up
Why does a Starlink Mini keep dying at start-up? Page 12 of the presentation gives the power rule: it needs a 100 W USB-C source, or it can brown out.
-
S26 · Short
Our VPN Test Passed. It Was Wrong.
In the suite's hotel test lab, full nesting, with DAITA and Multihop on inside the router's tunnel, seemed to work.
-
S25 · Short
Flipping the Router VPN Isn't Enough: Switching Modes
The kit has two tested modes. Low-signature: router VPN off, with DAITA and Multihop on each device. Nested: router WireGuard and Kill Switch on, with DAITA and Multihop off.
-
S24 · Short
Your Router's VPN Isn't a Disguise
The kit's tested router build is plain WireGuard to Mullvad, with the router's Kill Switch on.
-
S23 · Short
Your Travel Router's Name Gives It Away
Your travel router's Wi-Fi name gives it away. Rename it to look like an ordinary phone hotspot (the Guide's example is Pixel_4821; pick your own) and change it each trip.
-
S22 · Short
An Untested Backup Is Only a Hope
Have you ever restored your backup? The Setup Guide's line for it is blunt: an untested backup is only a hope. Once the recovery vault and its backup copy exist, do one real restore test on a spare or reset device.
-
S21 · Short
Your Signal PIN Won't Bring Your Messages Back
Signal's registration-lock PIN lets you re-claim your number on a replacement device. It isn't a message backup, and re-registering still needs to verify the number.
-
S20 · Short
Verify Your Contacts in Person, Radios Off
Before the kit's phone enters your home, put it in airplane mode with Wi-Fi off.
-
S19 · Short
A Phone Number Is a Handle. Choose Where It Goes.
In this kit, Signal runs on a phone number and SimpleX has none at all. The tie-breaker: put SimpleX on whichever channel you'd least want someone to be able to target by phone number.
-
S18 · Short
Signal + Molly Isn't a Backup
Molly is a private version of Signal that runs alongside your normal Signal, each on its own Cape number.
-
S17 · Short
The 24 Words That Are Your Phone Line
When you activate Cape, save its 24-word recovery phrase right away: it's the only way to recover the account later.
-
S16 · Short
Airplane Mode Is the Wrong Kill-Switch Test
Airplane mode only tests losing the network. What you need to test is the VPN failing while the network is still up. So keep Wi-Fi connected and turn the Mullvad app off: nothing should load until the VPN is back.
-
S15 · Short
Before You Test Your Duress PIN
A duress PIN is a second code: enter it, and instead of unlocking, the phone erases itself.
-
S14 · Short
One Setting Removes the Cheapest Way to Intercept Your Phone
A fake cell tower, an IMSI catcher, can force a phone down to 2G, which has no meaningful mutual authentication and weak or absent encryption, to capture identifiers and content.
-
S13 · Short
The Cable That Breaks GrapheneOS Installs
Installing GrapheneOS and the laptop can't see the phone? Some USB cables only carry power.
-
S12 · Short
Don't Continue Until All Three Are True: The Privacy Laptop Test
Before the privacy laptop is done, three things must be true. A cold restart asks for the disk passphrase. The Tails stick boots.
-
S11 · Short
Lose This and the Laptop Is Gone: The Disk Passphrase
When Debian's installer asks about the disk, choose Guided, use entire disk and set up encrypted LVM. Then set the disk passphrase to five or more random words, write it on paper and keep the paper safe.
-
S10 · Short
The Backup That Never Runs Out of Battery
A small paper card in your wallet is the kit's backup if the phone dies: your daily check-in time and one contact phone number, nothing else.
-
S09 · Short
Kids Repeat Things. Plan for It.
If anyone asks about the kit's phone, the family agrees one simple answer: it's a work phone for travel.
-
S08 · Short
The Whole Family Plan Is Three Sentences
The family check-in for this privacy kit is three lines, agreed in one short conversation. One: I'll message you most days on our channel. Two: if our channel is down, try me on the agreed backup before you worry.
-
S07 · Short
Order This Weeks Before Anything Else: Paying a VPN in Cash by Mail
The VPN account is the slow one, so it goes first. Generate a Mullvad account number and write it on paper.
-
S05 · Short
This Privacy Kit Fails One Test on Purpose
This kit fails one test on purpose: if an official takes the phone and unlocks it, they may see who the user really is. The messaging identities, the contacts and the device itself can identify them.
-
S04 · Short
What Your Hotel Wi-Fi Can Still See, Even With a VPN
From the hotel's side, a VPN tunnel hides the content and where you're really going. The hotel's Wi-Fi still sees the address of the VPN relay you connect to and the shape of your traffic, its timing and volume.
-
S03 · Short
The Whole Privacy Kit in Under a Minute
The whole Communication Suite kit in under a minute: a factory-unlocked Google Pixel on GrapheneOS with a Cape eSIM, a ThinkPad-class laptop on Debian with an encrypted disk and a Tails USB, a GL.iNet Slate 7 travel router, a power suite, and an optional Starlink Mini that stays off and is used only where it's legal: that's the kit's rule, not legal advice, so check local law.
-
S02 · Short
Encrypted Doesn't Mean Anonymous
Encryption protects the content of what you send, not the link between your phone and you. Named accounts, payment records, co-location and behavior can all still link a device to its owner.
-
S52 · Short
What Our Hotel Test Lab Didn't Prove
Here's what our testing didn't prove. The suite's hotel test lab is a real test network, set up to act like a hostile hotel, and it recorded raw packets where the router joined it.
-
S45 · Short
Your Phone's IMEI Never Changes
One number your phone always sends is the IMEI, the phone's hardware identity. It's transmitted to the network every time the phone attaches, it can't lawfully be changed, and it's constant for the life of the handset.
-
S37 · Short
Why Not an iPhone? It's Not About the iPhone Being Weak
It's not about the iPhone being weak.
-
S06 · Short
"Unlocked" Doesn't Mean GrapheneOS-Ready
A Pixel the store calls unlocked may still be unable to run GrapheneOS. SIM-unlocked means the phone takes any carrier's SIM card; bootloader-unlockable means you can replace the operating system.
-
S01 · Short
Your Phone Remembers Where It Was Born
The first time a new phone connects to a cell tower, where that happened is recorded permanently.