D11 · Deep dive
The Residual-Risk Register: 11 Risks a Privacy Kit Writes Down
Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode.
A deep dive into the Communication Suite's residual-risk register: the eleven risks that remain after the kit's controls, each with its threat tier and its status. Identity and location: seizure of an unlocked device, the permanent IMEI, Cape's payer of record and SS7 location queries. The higher tiers: global timing correlation, a single VPN provider, an endpoint zero-day and supply-chain interdiction. Operator error, the dominant real-world risk, addressed by doctrine and drills but never fully. And the network you're on: visible VPN endpoints and flow signatures, IPv6 and router service routing. Then the register's honest headline: what the suite's hotel test lab supports, and what it does not establish. Every risk stays on the list; none of them is solved.
What you’ll learn
- Know all eleven residual risks
- Know which is the dominant real-world risk
- Read the honest headline
Chapters
The honest limits
Every risk stays on the list; none of them is solved. The hotel test lab's results are the Debian laptop's, on IPv4; IPv6 needs its own tests. The kit is data-minimised, not anonymous.
Check before you rely on it
These details change. Confirm them against the vendor’s current pages.
- Cape's documented differentiators.
- Mullvad features; Proton as a regional fallback.
- GrapheneOS feature set and device support.