Privacy on ARPOKRAT

Permanent geolocation: how your phone tracks you even when you think you have stopped it

Sun, 02 Aug 2026 00:00:00 +0000

In 2024, two researchers at the University of Maryland repeatedly queried Apple’s Wi-Fi positioning service, with no special privilege and no specialised hardware, and in a single year reconstructed the precise location of more than two billion Wi-Fi access points worldwide. Their paper, Surveilling the Masses with Wi-Fi-Based Positioning Systems , shows what that map makes possible: tracking equipment moving in and out of Ukraine, observing population displacement after the Maui wildfires, following an individual through their home internet router.

None of those devices had GPS switched on. The position came from somewhere else.

This is the most widespread blind spot in mobile privacy: the belief that there is a location switch, and that once it is off, the phone stops knowing where it is. That belief is wrong on seven separate levels.

Location is not a feature your phone turns on. It is a property of what your phone is.

GPS, the least troubling vector of all

The one mechanism everybody can name is also the one that should worry you least.

GNSS, the umbrella term covering American GPS, Galileo, GLONASS and BeiDou, works by listening. Satellites continuously broadcast timestamped signals, the receiver picks up several of them and computes its position from the differences in propagation time. Typical accuracy in the open: three to five metres, often several tens of metres in a city, where building façades reflect the signals.

The decisive point is that this calculation is passive. The phone transmits nothing towards the satellites, and no satellite operator knows you exist. If GNSS were the only thing in play, turning off GPS would be enough.

There is a caveat, however. To speed up the first fix, phones use A-GPS: they download satellite ephemeris data from a server, over the SUPL protocol. To receive the right data, the phone sends that server the identifier of the network cell it is attached to. Pure GNSS does not betray you, but the accelerator bolted onto it does.

The mobile network: what the operator knows by design

For a call to reach you, the network has to know roughly where you are. This is not an option you can enable, it is the precondition for the service existing at all. Your phone announces itself continuously to the nearest tower, and that registration leaves a record on the operator’s side. No installed app, no permission granted: an active SIM card is enough.

Accuracy depends on the method:

Cell ID alone: from 200 metres in a dense urban area to more than 30 kilometres in the countryside, where a single tower covers a very wide radius.
Enhanced Cell ID, which adds the antenna sector (most sites are split into three 120-degree sectors) and signal strength: from 100 metres to a few kilometres.
Timing advance, which measures the round-trip delay between phone and tower: on the order of 550 metres on GSM, around 78 metres on LTE.
Multilateration across three or more towers: 50 to 300 metres in urban LTE.

5G changes the scale for two cumulative reasons. Density first: 5G cells cover much shorter radii, so simple attachment is already fine-grained information. Standardisation second: since Release 16, 3GPP has built in native positioning signals. Commercial targets aim for under 3 metres indoors and under 10 metres outdoors for 80% of devices, and Release 18 goes down to centimetre level for certain industrial use cases.

The infrastructure that connects you therefore becomes a positioning system of a quality comparable to GPS, without you having enabled anything. That data is retained under national rules and made available to authorities through procedures that vary widely. It is the same underlying debate as the one covered in our piece on the jurisdiction applicable to hosted data : technical protection and legal protection do not overlap.

Wi-Fi: a map of the world made of hardware addresses

Every Wi-Fi access point continuously broadcasts a unique hardware identifier, the BSSID. These identifiers are fixed and geographically stable: a home router stays in the same place for years.

Apple, Google and a handful of specialised players maintain databases mapping each BSSID to coordinates, built by their own users’ phones, which report the list of visible access points together with a GNSS fix. The operation is then reversed: a phone that can see four known access points no longer needs a single satellite. In a dense urban area, accuracy routinely reaches a few tens of metres, and drops below that indoors.

Two properties make this mechanism hard to neutralise. First, the phone scans even when Wi-Fi appears to be off: since Android 4.3, the system keeps a periodic scan running to improve location accuracy, independently of the quick-settings toggle. This behaviour depends on a separate setting, buried in the location services, that almost no user has ever opened.

Second, the database can be queried from outside. That is the flaw Rye and Levin exploited: the positioning interfaces return not only the requested location but also that of nearby access points, which makes it possible to harvest the map without ever going near the places involved.

Bluetooth and BLE: located by other people’s phones

Bluetooth Low Energy adds a proximity layer, with a range of a few metres to a few tens of metres, making it far more fine-grained than the mobile network. Two uses coexist. Commercial beacons, deployed in shops, airports and shopping centres, broadcast an identifier that apps on the phone recognise, revealing which aisle you stopped in front of and for how long. And crowd-sourced location networks, of which Apple’s Find My is the model, since copied by Google and Samsung.

This second mechanism inverts an implicit assumption. The reference analysis, Who Can Find My Devices? , published in the PETS 2021 proceedings by researchers at the Technical University of Darmstadt, reverse-engineered Apple’s protocol. An offline device emits a BLE signal, any nearby Apple device picks it up, attaches its own position and sends it encrypted to Apple’s servers, without the knowledge of either its owner or the owner of the device being located.

The consequence is structural: a device with no SIM card, no Wi-Fi and no network connection of any kind remains locatable, as long as a stranger walks past with a phone in their pocket. Your isolation no longer depends on your settings, but on those of passers-by.

Inertial sensors: locating you without location permission

A phone contains an accelerometer, a gyroscope, a magnetometer and often a barometer. These sensors fall under a permission category separate from location: an app can read them without ever having asked where you are.

Researchers at Princeton demonstrated this with PinMe . Their app starts from the IP address and time zone for a coarse position, then reads the sensors: the accelerometer gives the acceleration and braking profile, the gyroscope the sequence of turns, the magnetometer the heading, the barometer the changes in altitude. A neural network identifies the mode of transport, walking, car, train or plane, and the route is matched against public mapping, elevation and weather data. The result: a trajectory of accuracy comparable to GPS, with no location permission. The method has limits, which the authors document, since it fails in areas without roads and degrades on uniform grid layouts, where many routes produce the same signature. It remains the demonstration that a denied permission is not a closed door.

The barometer additionally supplies the dimension GNSS handles poorly, the vertical one. US requirements for emergency calls mandate floor-level accuracy of plus or minus 3 metres for 80% of indoor calls. Knowing which floor someone is on is a different kind of knowledge from knowing which city block they are in.

The data market: the most mundane vector

The mechanisms above describe how a position is computed. What remains is where it goes, and that is where most of the everyday risk lies.

Thousands of apps integrate advertising SDKs, third-party software components a developer adds to monetise their work or measure their audience. These components inherit the host app’s permissions: a weather app that legitimately needs your location passes it to companies whose names you have never read. To this are added advertising bid streams, where your approximate position is broadcast to dozens of potential buyers every time a banner is displayed, including to those who buy nothing and simply listen.

This raw material feeds an industry. The Electronic Frontier Foundation documented the case of Fog Data Science , which claimed billions of data points on more than 250 million devices, sold to local US police forces. Brian Krebs described Locate X , a product that lets you draw a polygon on a map and view the history of devices that entered and left that area.

This vector requires no technical feat, only that somebody is willing to pay. The price is modest.

IMSI catchers: active location

The mechanisms described so far exploit normal operation. There is also active location, carried out by a third party intervening on the network.

An IMSI catcher, or cell-site simulator, is a piece of equipment that impersonates a legitimate tower. Phones within range attach to it, revealing their subscriber identifier and their presence within a limited perimeter.

5G was supposed to close that door by replacing the permanent cleartext identifier with an encrypted one, the SUCI. The closure is partial. The work presented under the title 5G SUCI-catchers: still catching them all? documents linkage attacks that make it possible to re-correlate sessions despite the encryption. More importantly, the protection collapses entirely if the attacker forces the device to fall back to an earlier generation, 2G in particular, whose authentication is one-way. A 5G phone remains vulnerable to an attack designed for a 1990s network, because it still agrees to go down there.

Countermeasures, and how effective they really are

Every measure below does something. None of them does everything, and the gap between what they do and what people credit them with is what produces bad decisions.

Airplane mode

Airplane mode cuts transmission from the cellular modem, Wi-Fi and Bluetooth. That is real, and it is the best result available for such little effort.

What it does not do: it does not stop the inertial sensors, it does not delete already cached positions, which will be sent on reconnection, and on most devices it allows Wi-Fi or Bluetooth to be switched back on separately without leaving the mode. Finally, it is a software state, not a power cut: its reliability depends on the integrity of the system enforcing it.

An underrated detail: detaching from and re-attaching to the network are themselves timestamped events on the operator’s side. A phone that vanishes at 9 pm in one cell and reappears at 11 pm in another has produced information, not silence.

MAC address randomisation

Mobile systems today emit random MAC addresses when scanning, to prevent tracking from one place to another. The intent is good, the result incomplete. The reference work, including Why MAC Address Randomization is not Enough , shows that the content of discovery frames is often enough to re-identify the device: the number of information elements, their values and their order form a fingerprint. Add to that sequence numbers, which are incremental and therefore chainable, and the timing signature specific to each model. Some studies report successfully tracking half of all devices for at least twenty minutes.

Finally, a conceptual limit: randomisation only applies to the discovery phase. As soon as you connect to a network, the address used is stable for that network, by design, so that the connection works. The café you go to every morning recognises you.

Actually turning off scanning

This is the most cost-effective and most overlooked setting. On Android, Wi-Fi scanning and Bluetooth scanning are two separate options, located in the location services, independent of the quick-settings toggles. As long as they are active, turning Wi-Fi off from the panel is not enough: the scanning continues.

Disabling them removes an entire layer of collection, at no cost other than a slightly slower first position fix. For most readers, this is the best ratio between effort spent and result obtained.

App permissions

Revoking location permission from apps that manifestly do not need it remains useful, and recent systems offer three gradations: one-off authorisation, authorisation limited to active use, and approximate location, which only transmits an area on the order of a kilometre.

This does not, however, protect against SDKs hosted inside an app that has a legitimate reason to access your location, nor against inertial sensors, nor against the network layers, which go through no permission at all.

What a VPN does not protect

A point worth clarifying, because the opposite belief is very widespread: a VPN does not hide your location. It hides your public IP address, so it falsifies IP-based geolocation, which is in any case the crudest mechanism on this list.

A VPN touches neither the GNSS receiver, nor Wi-Fi scanning, nor Bluetooth, nor the sensors. It changes nothing about what your operator knows, since the encrypted tunnel travels through its towers and cellular attachment remains visible to it. It does not stop an app holding location permission from transmitting exact coordinates inside the tunnel. A VPN protects the content and destination of your communications on an untrusted network, and that is already a lot. Location is not within its scope.

Physical limits

A Faraday pouch works in the literal sense: it blocks transmission and reception. So does removing the battery, where that is still possible. A dedicated device, or simply leaving your phone elsewhere, remains the most robust measure.

These solutions share a flaw that has to be faced head-on: they produce an anomaly. A phone that goes quiet for two hours every Tuesday evening is saying something. Against an adversary who analyses patterns rather than instantaneous positions, absence is data.

Three adversaries, three strategies

This is the most important distinction in this article, and the one you read least often.

Against an advertiser or a data broker, the fight is winnable. Permission discipline, disabling scanning, a system without proprietary location services, resetting the advertising identifier: together these sharply reduce the volume collected. This adversary is after cheap volume, not your particular case.

Against your operator, no configuration is enough. Cellular location is the precondition for the service. The only real variables are legal, what the law permits to be retained and disclosed, and material: which device, which SIM card, in whose name, switched on where.

Against a targeted state adversary, the reasoning changes again, since it combines legal access to operator data, active location via cell-site simulator, requisitions to platforms and, where applicable, compromise of the device itself. Software countermeasures reduce the surface, but the realistic goal is not disappearance: it is knowing precisely what remains exposed.

The ArpokratOS approach

ArpokratOS answers this landscape with a choice that follows from the distinction above: what needs to be neutralised is neutralised at system level, not in a menu.

On GNSS, the hardware driver is removed. The device behaves as if the chip did not exist, both for applications and for the system itself. The difference from a settings toggle is not cosmetic. A toggle is a policy: it is enforced by a layer that can be bypassed by a sufficiently privileged component, re-enabled by an update, or ignored by a compromised system. Removing the code path removes the question, since there is no longer anything to enable.

Bluetooth is handled at the Core level, on the same logic. Bluetooth switched off in the settings in practice leaves the software stack alive on many devices, to feed proximity services and crowd-sourced location networks. Absent at system level, it cannot talk to a shop beacon, take part in a Find My-style network, or serve as a zero-interaction attack surface.

It has to be said plainly what this does not do. ArpokratOS does not make a phone undetectable. As long as a SIM card is active, the operator knows the cell you are attached to, and no operating system changes that, not even with all traffic routed over Tor. Routing protects the content and the destination, not the radio geometry. Anyone promising invisibility is selling a story.

What such an architecture provides is more modest: the removal of the application and proximity layers, through which the vast majority of real-world collection passes, and an explicit threat model for what remains. It is the same reasoning applied to choosing a desktop system, detailed in our operating system comparison : the useful question is not whether a tool protects, but what it protects against and at what price.

Conclusion

This article does not provide a method for disappearing. That method does not exist, and texts claiming otherwise mostly produce false confidence, which is more dangerous than no protection at all because it makes people take risks.

The aim was to replace a binary question, am I locatable or not, with a useful one: by whom, with what accuracy, at what cost to them, and does it matter to me. The answer differs for a journalist protecting a source, an executive travelling in a sensitive jurisdiction, a lawyer whose appointments reveal a strategy, or a private individual annoyed that an advertiser knows their habits.

What deserves attention, in fact, is not the performance of each of these mechanisms taken in isolation, but the fact that they overlap. A position accurate to fifty metres is not very interesting. A position accurate to fifty metres, every fifteen minutes, for two years, draws a home, a workplace, a religion, a health condition, an affair, a source. Location data is the metadata that makes all the others legible, and that is why it is worth so much.

Sources

Erik Rye, Dave Levin, Surveilling the Masses with Wi-Fi-Based Positioning Systems , IEEE Symposium on Security and Privacy, 2024
Alexander Heinrich et al., Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System , PoPETs, 2021
Arsalan Mosenia et al., PinMe: Tracking a Smartphone User around the World , IEEE Transactions on Multi-Scale Computing Systems
Mathy Vanhoef et al., Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms , AsiaCCS, 2016
Merlin Chlosta et al., 5G SUCI-catchers: still catching them all? , ACM WiSec, 2021
5G NR Positioning Enhancements in 3GPP Release-18
Electronic Frontier Foundation, Inside Fog Data Science, the Secretive Company Selling Mass Surveillance to Local Police , 2022
Krebs on Security, The Global Surveillance Free-for-All in Mobile Ad Data , 2024
Electronic Frontier Foundation, Mobile Phones: Location Tracking , Surveillance Self-Defense

Which operating system for your security and privacy? Windows, macOS, Linux, Tails, Whonix and Qubes OS compared

Mon, 22 Jun 2026 00:00:00 +0000

Choosing an operating system is not merely a matter of interface preference or software compatibility. It is also — and increasingly so — a security and privacy decision. Each OS collects data differently, exposes different attack surfaces, and offers a highly variable level of control to the user. This comparison analyzes the main systems on the market exclusively through this lens, from the most widely used to the most specialized.

The central criterion: who controls your system?

Before diving into the details of each OS, one structuring principle: the security of an operating system fundamentally depends on who holds the code and what architectural decisions were made at design time. A proprietary closed-source OS (Windows, macOS) delegates that trust to its publisher. An open-source OS delegates that trust to the community auditing the code. An OS designed for compartmentalized security (Qubes OS) starts from the assumption that no component of the system should be entirely trusted.

Windows 11

Data collection and telemetry

Windows 11 is the most widely used desktop OS in the world, and also one of those that collects the most data by default. Microsoft divides its telemetry into two official categories:

Required data (cannot be disabled on Home and Pro editions): hardware configuration, device identifiers, error and stability reports, update and driver data. This data is transmitted to Microsoft regardless of user preferences.

Optional data: usage behavior, application interactions, personalization data. Can be disabled in settings, but is automatically re-enabled during certain major updates.

Windows 11 24H2 introduced several new collection layers tied to AI:

Windows Recall: takes a screenshot every five seconds to create a searchable timeline of everything you have done on your machine. Can be disabled, but is enabled by default and linked to access rights that can be extended by other applications
Copilot: every query is transmitted to Microsoft servers, including screenshots, selected text, and the context of open applications
Defender Cloud Protection: sends hashes of suspicious files and behavioral data to the Microsoft cloud for analysis

The conclusion documented by numerous independent technical sources is unequivocal: it is impossible to fully disable Windows 11 telemetry on Home and Pro editions. The only way to achieve this is to use an Enterprise or Education edition, apply specific group policies, or resort to third-party tools such as O&O ShutUp10++ or WPD, with the stability risks that may entail.

Attack surface and security

Windows 11 is the target of the vast majority of malware, ransomware, and exploits available worldwide, proportional to its market share. Microsoft has introduced significant security mechanisms (mandatory TPM 2.0, Secure Boot, VBS, Credential Guard), but these operate within a monolithic model: a compromise of the kernel or a privileged system service affects the entire environment.

Security/privacy verdict: the most exposed system in this comparison, telemetry that cannot be fully disabled, trust model entirely delegated to Microsoft and US jurisdiction.

macOS

Data collection and telemetry

Apple has built part of its marketing image on privacy. The technical reality is more nuanced.

macOS collects significantly less data than Windows by default, but collection remains real and partially non-disableable:

Gatekeeper and OCSP verification: every time an application is opened, macOS performs an online check with Apple servers to confirm the application has not been revoked. This request transmits information about the opened application and the device’s IP address. No native setting allows disabling these checks without breaking the security chain
macOS Analytics: collects data on system usage, disableable in System Preferences > Privacy > Analytics
Apple application telemetry: Maps, Siri, App Store, and other built-in Apple applications each maintain their own collection with rotating identifiers, independently of the system analytics setting

For users who want to go further, security experts recommend using an application firewall (Little Snitch or LuLu, which is open source and free) to monitor and block outgoing connections on a per-application basis.

Attack surface and security

macOS benefits from several robust security mechanisms: System Integrity Protection (SIP), which protects system files as read-only; Kernel Integrity Protection at the hardware level on Apple Silicon chips; sandboxing of App Store applications; and the Secure Enclave on recent machines. The relationship with an Apple ID is the primary vector for personal data collection.

Security/privacy verdict: better than Windows on default telemetry, but still subject to non-disableable OCSP checks, US jurisdiction, and Apple’s closed model. Difficult to audit independently.

Linux (general-purpose distributions)

Linux is not a single operating system but a kernel upon which very different distributions are built. From a security and privacy standpoint, they share a common foundation but diverge on several points.

Ubuntu is the most popular distribution for beginners. It sparked controversy in 2012 by sending local search queries to Amazon servers — behavior that has since been removed. Ubuntu maintains its own usage data collection (whoopsie, ubuntu-report), which is disableable, and tightly integrates Snap repositories controlled by Canonical Ltd.

Debian is the base upon which Ubuntu is built, without the layers added by Canonical. Governed by a non-profit community project with a strict commitment to free software, it collects no telemetry by default. Its conservative update policy is generally preferable in terms of attack surface.

Fedora, sponsored by Red Hat (an IBM subsidiary), is technically modern with a fast update cycle. No telemetry by default, but the relationship with Red Hat/IBM introduces a corporate dependency worth noting.

Linux Mint, derived from Ubuntu, is designed for users coming from Windows. It has removed the most controversial Ubuntu components (Snap is absent by default) and introduces no telemetry of its own.

Arch Linux targets advanced users with a minimalist philosophy: the user installs only what they need. No telemetry, rolling release updates, and total freedom of customization.

What Linux fundamentally offers

Open and auditable source code: any security researcher can inspect the kernel and main component code
No imposed telemetry: no major distribution forces non-disableable data collection
Stricter permissions model by default: use of a root account separate from daily actions
Reduced attack surface: Linux is less targeted by mass malware

Security/privacy verdict: clearly superior to Windows and macOS on data collection. No general-purpose distribution protects against a compromised application spreading across the entire system.

Tails OS

Philosophy: amnesia as protection

Tails, an acronym for The Amnesic Incognito Live System, is a Debian-based operating system that merged with the Tor Project in 2024. Its philosophy is radically different from all other OSes: rather than attempting to secure a persistent environment, it eliminates all persistence by default. Tails exists only for the duration of a session.

Technical architecture

Tails runs entirely from a USB drive (8 GB minimum) and operates entirely in RAM. When you shut it down, no trace remains on the host machine: no temporary files, no history, no credentials, no forensic artifacts on the PC’s hard drive. It does not matter if that PC is compromised at the software level: Tails never writes to its disk.

Tor by default and without exception

All network traffic in Tails is systematically routed through the Tor network. If an application attempts to establish a direct connection bypassing Tor, Tails blocks it. It is not possible to use Tails to browse without Tor, even by mistake.

Encrypted persistent storage (optional)

By default, Tails forgets everything on each shutdown. For users who need to retain certain data between sessions, Tails offers a Persistent Storage: an encrypted volume (LUKS) created on the USB drive itself, protected by a passphrase. The user chooses precisely what is stored there: certain files, application configurations, PGP keys, etc. This persistent storage does not change the amnesic nature of Tails with respect to the host machine — it only affects what is retained on the USB drive between sessions.

Pre-installed tools

Tails comes with a set of pre-configured tools: Tor Browser, an encrypted email client, a file encryption tool (Kleopatra/GnuPG), secure messaging clients, and LibreOffice for office tasks. No additional software needs to be installed for common high-security use.

2026 technical note: Tails 7.7 added a notification for outdated Secure Boot certificates, as Microsoft’s 2011 keys are beginning to expire in June 2026. Users whose UEFI firmware has not been updated may no longer be able to boot Tails on certain machines.

What Tails protects against and what it does not

Threat	Tails Protection
Forensic analysis of the host disk after seizure	Total: the host disk is never touched
Network surveillance (IP, sites visited)	Strong via Tor, but depends on Tor’s robustness
Persistent malware on the host machine	Bypassed: Tails does not use the installed system
BIOS/UEFI malware (compromised firmware)	None: Tails cannot protect against the firmware of the machine being used
Human error (logging into a personal account)	None: if you log into Gmail under Tails, you de-anonymize the session
Compromise of software during the session	Limited to the current session, destroyed on shutdown

Honest limitations

Tails is not suitable for everyday use: the lack of persistence means reconfiguring the environment on every boot
A BIOS or firmware-level malware (such as a UEFI-level implant) can potentially compromise a Tails session, because Tails does not control the firmware layer of the machine it runs on
Logging into a personal account (email, social network) cancels the anonymity of the session, regardless of Tor

Who is it for?

Journalists working with sources via SecureDrop, activists under surveillance in repressive regimes, and anyone needing a one-off high-sensitivity session on hardware they do not control. Used by Glenn Greenwald and Laura Poitras to process the Snowden documents, recommended by the EFF, the Freedom of the Press Foundation, and the Tor Project.

Verdict: a first-choice tool for one-off high-sensitivity sessions. Not a primary everyday OS.

Whonix

Philosophy: structural anonymity through network isolation

Whonix addresses a different question than Tails: rather than erasing all traces after the session, it ensures that malware running in the work environment structurally cannot know the user’s real IP address, even if it has root privileges on the work virtual machine.

Whonix is based on Debian (via KickSecure, a hardened version of Debian developed by the same team) and runs inside a Type 2 hypervisor (VirtualBox, KVM) on any host OS, or natively in Qubes OS as a Type 1.

The two-VM architecture

The central principle of Whonix is a strict separation between the network layer and the application layer, implemented via two distinct virtual machines:

Whonix-Gateway is the first VM. It runs the Tor daemon and serves exclusively as a network gateway. It is the only VM with Internet access. It contains no user applications. Its sole role is to intercept all incoming and outgoing network traffic and force it through Tor.

Whonix-Workstation is the second VM. It is the working environment: browser, messaging, file processing, development. It is connected to the Internet only through the internal virtual network pointing to the Whonix-Gateway. It has no direct Internet access, no ability to connect in a way that would bypass the Gateway.

Here is what happens when a network request is made from the Workstation:

The application issues a network request
The Workstation sends it via its internal network interface to the Gateway
The Gateway intercepts the request and reroutes it through Tor (three successive relays)
The response returns by the same path in reverse
The Workstation receives the response without ever having knowledge of the real exit IP address

The fundamental guarantee: even if malware compromises the Workstation with root privileges, it cannot know the user’s real IP address, because the Workstation itself never has access to it. The Workstation only sees the internal IP address of the Gateway.

Additional security mechanisms

Stream isolation: Whonix uses separate Tor circuits for different applications (the browser does not use the same circuit as the email client, etc.), which prevents traffic correlation between different activities.

Boot clock randomization: the Workstation’s system clock is slightly and randomly offset on each boot to prevent timing attacks based on the exact system time.

sdwdate: Whonix uses its own time synchronization daemon (sdwdate) that retrieves the time via Tor from onion servers, instead of classic NTP which could leak the IP address.

AppArmor: AppArmor profiles harden the sandboxing of critical applications such as Tor Browser at the system level.

Disposable VMs: Whonix supports disposable Workstations (Whonix-Workstation DispVM in Qubes-Whonix) for one-off tasks without persistence, similar to the Tails approach but within an otherwise persistent environment.

The three deployment modes

Whonix on VirtualBox or KVM (Type 2): the most accessible mode. Both VMs run on an existing host OS (Windows, Linux, macOS). Convenient, but introduces an additional trust layer in the host OS: if the host is compromised, Whonix’s protection can be bypassed.

Qubes-Whonix (Type 1, recommended): Whonix is natively integrated into Qubes OS as templates. The Gateway becomes a ProxyVM (sys-whonix) and the Workstation an AppQube (anon-whonix). This is the most robust configuration because the isolation relies on the bare-metal Xen hypervisor rather than a Type 2 hypervisor running on a potentially vulnerable host OS. This is the configuration recommended by both projects.

Physical isolation (advanced mode): the Gateway and the Workstation run on two separate physical machines connected by an Ethernet cable. The Workstation has no network card except the one connected to the Gateway. This mode drastically reduces the trust base but requires two dedicated machines.

What Whonix protects against and what it does not

Threat	Whonix Protection
IP address leak from the Workstation	Structurally impossible by architecture
DNS leaks	Impossible: all DNS goes through Tor via the Gateway
Root malware on the Workstation seeking the real IP	None: it will not find it
Compromise of the Gateway itself	Partial: if the Gateway is compromised, the IP can leak
Host OS compromise (in Type 2 mode)	None: a compromised host can observe both VMs
De-anonymization through user behavior	None: Whonix does not protect against human error
Forensic analysis of the disk after seizure	Partial: Whonix is persistent by default, except for disposable VMs

Honest limitations

Whonix does not erase disk traces: it is persistent by default (unlike Tails). If your machine is seized and host disk encryption is absent or weak, VM data can be recovered
In Type 2 mode (VirtualBox/KVM on a host OS), Whonix’s security is limited by the security of the host OS. A compromised host can potentially observe traffic between the two VMs
Performance is impacted by double virtualization and routing through Tor: connections are slow, and large downloads are difficult on a daily basis

Who is it for?

Anyone needing a persistent working environment with structural network anonymity: development of sensitive software, extended pseudonymous research, management of multiple distinct digital identities, onion servers. The Qubes-Whonix combination is considered by many security experts to be the most robust anonymous working environment currently available for everyday use.

Verdict: the reference OS for structural network anonymity in a persistent environment. Complementary to Tails (which handles one-off sessions), not a competitor.

Qubes OS

Philosophy: security through compartmentalization

Qubes OS represents a fundamentally different approach from all the preceding systems. Whereas other OSes attempt to prevent compromises, Qubes starts from a radically different postulate: the compromise of certain components is inevitable. The objective is to ensure it cannot spread.

Created in 2012 by security researcher Joanna Rutkowska, Qubes OS is publicly recommended by Edward Snowden, among other security professionals.

Technical architecture

The Xen hypervisor as the base layer

Qubes is not a Linux distribution in the classical sense. It uses the Xen hypervisor, bare-metal virtualization software that runs directly on the hardware without an intermediate host OS, to create lightweight virtual machines called qubes. Isolation between qubes is enforced at the hardware level via Intel VT-x/VT-d and AMD-Vi (IOMMU) technologies, which prevent VMs from accessing the memory or devices of other VMs without explicit permission.

dom0: the maximum-trust domain

At the top of the hierarchy sits dom0, a privileged domain from which the desktop manager is run. dom0 manages the display of all windows from other qubes. For security reasons, dom0 has no network connection and runs no user applications. It serves only to orchestrate display and domain management.

Qubes: airtight compartments

The user defines as many qubes as needed, each corresponding to a trust context:

A “work” qube for professional applications
A “personal” qube for emails and social networks
A “banking” qube dedicated solely to financial transactions
An “untrusted” qube for opening suspicious attachments
Disposable qubes that disappear entirely on closure

Each qube has its own network stack, its own memory space, and its own processes. Malware that compromises the “untrusted” qube is confined to that qube. It cannot access files in the “work” qube, nor traverse to other domains.

Visual color coding

Each window displays a colored border corresponding to the trust level of its qube: red for untrusted domains, green for high-security isolated domains, yellow for semi-trusted domains. This simple visual system allows users to know at all times in which context each action is taking place.

Templates and centralized management

Qubes do not contain their own full OS installation: they share templates (Fedora, Debian, and Whonix by default). Security updates are applied to the template, and all qubes based on that template benefit from them automatically.

PCI passthrough and hardware isolation

Whereas classic OSes run hardware drivers in the same space as user applications, Qubes assigns each physical device (network card, USB controller) to a dedicated qube via PCI passthrough. A compromised network driver cannot access data from other qubes.

Whonix integration

Qubes natively integrates Whonix as templates, allowing the traffic of any qube to be routed through Tor transparently. This is the Qubes-Whonix configuration described in the previous section.

What Qubes actually protects against

Attack scenario	Classic OS	Qubes OS
Malware in a PDF attachment	Potential access to the entire system	Confined to the “untrusted” qube, destroyed on closure
Web browser exploit	Access to user profile, files	Confined to the browser qube
Network driver compromise	Access to system memory	Confined to the network qube via PCI passthrough
Stolen PGP key	Yes, if the signing software is compromised	No, if the key is in a dedicated qube with no network
Leakage between applications	Possible via IPC, shared memory	Impossible between distinct qubes

Honest limitations

Qubes does not protect against a dom0 compromise: if the Xen hypervisor itself is compromised, isolation can be broken (bulletin QSB-115 dated June 9, 2026, regarding vulnerability XSA-491)
No isolation within a single qube: two applications in the same qube are not isolated from each other
Significant hardware requirements: processor supporting VT-x/VT-d, minimum 16 GB RAM (32 GB recommended), 32 GB storage. Apple Silicon machines are not supported
Real learning curve: copy-pasting between qubes requires a conscious action, and installing software goes through templates

Who is it for?

Qubes OS is designed for profiles whose threat model includes serious adversaries: journalists working with sensitive sources, lawyers managing confidential files, security researchers, professionals handling industrial or diplomatic secrets.

Verdict: the reference standard for personal workstation security against capable adversaries. The Qubes + Whonix combination is considered the most robust environment currently available.

How these systems combine

It is important to understand that these OSes are not exclusively alternatives to one another: they address different needs and are often combined.

Qubes + Whonix: the most robust combination for high-security everyday use. Qubes handles compartmentalization, Whonix handles network anonymity within certain qubes
Qubes + Tails: some advanced users use Qubes as their primary OS and boot Tails from a dedicated qube for particularly sensitive one-off sessions
Linux + Whonix in VMs: an accessible entry point into structural network anonymity without the full complexity of Qubes

Summary table

Criterion	Windows 11	macOS	Linux (Debian)	Tails	Whonix	Qubes OS
Default telemetry	Significant, cannot be fully disabled	Moderate, partially non-disableable	None	None	None	None
Auditable source code	No	No	Yes	Yes	Yes	Yes
Data persistence	Permanent	Permanent	Permanent	None by default	Permanent (VMs)	Permanent per qube
Network anonymity	None	None	None	Strong (Tor enforced)	Structural (Tor enforced)	Via Whonix integration
Isolation between applications	Weak	Moderate	Weak	Moderate	Moderate	Strong (hypervisor)
Resistance to compromise	Weak	Moderate	Moderate	High (amnesic)	High (network isolation)	High (compartmentalization)
Ease of use	High	High	Moderate	Moderate	Low to moderate	Low
Required hardware	Standard	Mac only	Standard	Standard + USB	Standard + RAM	x86-64 with VT-d, 16+ GB RAM
Suitable profile	General use	General use	Intermediate profile	One-off sensitive sessions	Persistent network anonymity	High-security daily use

Choosing an OS based on security is not a binary decision. It is an alignment between a real threat model and acceptable trade-offs in terms of compatibility and ease of use. For the vast majority of users, a well-configured Linux distribution already offers a level of protection radically superior to Windows 11 or macOS. For high-sensitivity profiles, Tails , Whonix , and Qubes OS represent three complementary approaches, each optimized for a distinct threat model.

Arpokrat Swap: exchange your cryptocurrencies without leaving a trace

Tue, 16 Jun 2026 00:00:00 +0000

We believe that the act of exchanging value should not leave a trace. Today, we make that belief a reality with the launch of Arpokrat Swap : a cryptocurrency exchange platform designed from the ground up for absolute privacy.

An infrastructure that doesn’t know you

The vast majority of exchange platforms, even those that claim to be “private”, collect data by default: IP address, session cookies, browser fingerprinting, transaction logs. These metadata, often underestimated, build an exploitable behavioral profile — by third parties, by regulators, or by malicious actors in the event of a data breach.

Arpokrat Swap is built on the opposite principle: we cannot identify you because we do not try to.

No cookies — no session, tracking, or analytics cookies
No IP logs — your network address is neither recorded nor transmitted
No sign-up — no account, no email address, no KYC
No fingerprinting — no third-party JavaScript, no data collection scripts

Accessible via Tor

For users who want an additional layer of protection at the network level, Arpokrat Swap is fully available via our .onion address:

arpokrat4asurnhw7v3s6rinjqgcwo2fx54fq7zlacawc2xuq7wppsad.onion

Accessible from the Tor browser or via Orbot, this interface is functionally identical to the clearnet version — no compromise on features, no degradation of experience.

Privacy cryptocurrencies first

Arpokrat Swap supports over 350 digital assets across all major blockchains. We pay particular attention to privacy-enhanced cryptocurrencies, which form the core of our philosophy:

Monero (XMR) — opaque transactions by default, the gold standard for on-chain privacy
Zcash (ZEC) — shielded payments via the zk-SNARKs protocol
Bitcoin (BTC) — on mainnet and Lightning networks
Ethereum (ETH) — as well as all ERC-20 tokens
Litecoin (LTC), Dogecoin (DOGE), Cardano (ADA), Solana (SOL)
Avalanche (AVAX), Polkadot (DOT), Chainlink (LINK), Uniswap (UNI)
Tether (USDT) and USD Coin (USDC) on Ethereum, Tron, BSC and Polygon
XRP, Stellar (XLM), Cosmos (ATOM), Algorand (ALGO)
Toncoin (TON), Near (NEAR), Aptos (APT), Sui (SUI)
Shiba Inu (SHIB), Pepe (PEPE) and the main memecoin tokens
Dai (DAI), FRAX and decentralized stablecoins
And hundreds of other tokens and cross-chain pairs

OPSEC tip: For swaps involving traceable assets, we recommend using Monero as an intermediary — for example BTC → XMR → ETH rather than a direct BTC → ETH swap. This breaks the on-chain link between the two addresses.

xStocks: tokenized stocks, tradeable without a broker

Arpokrat Swap also integrates xStocks — tokenized US stocks and ETFs, backed 1:1 by the underlying asset held by a regulated custodian. Each token represents exactly one share of the corresponding company, with immediate on-chain settlement and 24/7 availability, with no market hours.

Available xStocks include:

Technology AAPLx Apple · MSFTx Microsoft · NVDAx NVIDIA · GOOGLx Alphabet · METAx Meta · AMZNx Amazon · TSLAx Tesla · AMDx AMD · ADBEx Adobe · ACNx Accenture · APPx Applovin · AMATx Applied Materials · APLDx Applied Digital

Finance & Crypto-adjacent COINx Coinbase · HOODx Robinhood · MSTRx MicroStrategy · CRCLx Circle · AMBRx Amber

Healthcare & Pharma MRKx Merck · AZNx AstraZeneca · ABTx Abbott · ABBVx AbbVie

Consumer & Miscellaneous MCDx McDonald’s · NFLXx Netflix · GMEx GameStop

ETFs & Indices SPYx S&P 500 · QQQx Nasdaq-100 · GLDx Gold · PALLx Palladium · PPLTx Platinum

And many more — the full list exceeds 131 assets (100 stocks, 27 ETFs and 4 specialized assets), available directly on the platform.

xStocks do not confer voting rights or direct dividends. Dividends are automatically reinvested into the token balance. Geographic restrictions apply — not available to residents of the United States, Canada, the United Kingdom, and Australia.

A route aggregator, not a single provider

Arpokrat Swap is not an exchange platform in its own right: it is an aggregator. When you initiate a swap, we simultaneously query multiple partner providers and present you with the best available options based on two transparent criteria:

1. The lowest fees The displayed rate already includes all fees — network fees and the provider’s commission. You pay nothing extra for using our aggregator: our commission is taken directly from the provider’s fee, with no impact on your rate.

2. The provider’s KYC rating Each route is associated with a privacy rating that we establish by reading the terms and conditions and privacy policies of each partner, by directly questioning them about their practices, and by taking their track record into account:

Rating	Meaning
✅ A	Never requests identity verification
🟡 B	Very rarely requests KYC, refunds upon refusal
🟠 C	Rarely requests KYC, refund within a few days
🔴 D	May request KYC and potentially freeze funds

We recommend prioritizing routes rated A or B, particularly for large volumes or swaps involving privacy-enhanced cryptocurrencies.

Why this makes a difference

Most aggregators redirect you to the most favorable rate without informing you of the privacy risks associated with the underlying provider. An exchange may display an excellent rate while enforcing an aggressive KYC policy that will block your transaction after the fact and hold your funds.

Arpokrat Swap is the only platform where cost and KYC risk are presented together, allowing you to make an informed choice rather than a blind trade-off.

Access Arpokrat Swap →

Arpokrat Swap is a non-custodial service. We never have access to your funds at any point. Swaps are executed directly between your wallet and the selected partner provider.

The Shouting Silence: What is a Warrant Canary and Why Its Disappearance Should Worry You

Mon, 01 Jun 2026 00:00:00 +0000

Deep in the coal mines of the 19th century, miners carried caged canaries with them. These small birds, extremely sensitive to toxic gases like carbon monoxide, succumbed long before the miners perceived the danger. They served as a silent, but highly effective early warning system.

In our modern digital world, this bird has come back to life in the form of the “Warrant Canary”.

What is a Warrant Canary?

It is a public statement, published and updated regularly by a service provider (messaging app, VPN, host), stating that, up to that exact date, it has not received any secret legal request forcing it to compromise its users’ data — such as an American National Security Letter (NSL) or an order issued by a FISA court.

The subtlety — and the gravity — of the canary lies in what happens when it disappears.

If a service that displayed the statement “We have received no secret orders” every month suddenly stops updating it, the informed user deduces the obvious: the canary is dead.

The company has been targeted by a surveillance measure accompanied by a gag order, legally forbidding it from revealing the existence of this request. Unable to say that they have been compromised, they simply stop saying that they haven’t been.

The Era of Invisible Surveillance and Bypassing Silence

At a time when extraterritorial legislations like the CLOUD Act and FISA (Foreign Intelligence Surveillance Act) allow the U.S. government to access data hosted by companies without ever informing the targets, the Warrant Canary constitutes one of the few mechanisms to bypass this forced silence.

With the CLOUD Act, the geographical barrier no longer exists: if data is under the “control” of an American company, the United States government claims the right to access it, even if these servers are physically located in Europe. The canary then becomes the last warning signal before a user’s digital sovereignty is silently sacrificed.

This is why major actors in the Privacy sphere have adopted this tool as a standard of transparency:

Proton : The Swiss messaging and email service publishes a transparency report including a strict Warrant Canary.
Riseup : The secure communication collective for activists maintains one of the most famous and monitored canaries on the web.
Arpokrat : Our own ecosystem maintains a public Warrant Canary, cryptographically updated, to guarantee absolute transparency to our community.

Legal Analysis: The Right Not to Lie

The very existence of the Warrant Canary rests on one of the most fascinating pillars of constitutional law: the doctrine of compelled speech and its collision with judicial secrecy.

The legal basis rests on a simple principle: if the State has the power to impose silence on you (via a gag order), it does not have the constitutional power to force you to lie.

Under the First Amendment of the United States Constitution (and analogous principles in Europe), the government cannot force a company to produce a factually false statement. Thus, when a company removes its canary, it does not violate the silence order — since it does not explicitly announce having received a warrant. It simply exercises its fundamental right to stop making a statement that is no longer true.

The Conflict with European Law

The relevance of the canary is today reinforced by Article 32 of the Data Act (EU Regulation 2023/2854). This provision requires providers to implement technical and legal measures to prevent data access by authorities of third countries when this contradicts European law. The death of a canary immediately signals this conflict of laws: the provider is likely being forced to bypass European guarantees to satisfy a foreign mandate.

The Arpokrat Approach: Sovereignty by Design

In the Arpokrat ecosystem, operating under the jurisdiction of the Swiss FADP (Federal Act on Data Protection - RS 235.1), the canary takes on an even more powerful dimension. It is part of a holistic approach to digital sovereignty: Zero-Knowledge.

The architecture is designed in such a way that the company creates a technical and mathematical impossibility to obey a mandate. The State or an intelligence agency can issue all the orders it wants, the answer will remain the same: there are no private keys, no identities (Zero-ID), and no centralized metadata to hand over.

In this context, the canary is no longer just a warning of compromise; it is the continuous public proof that the infrastructure has remained technically inviolable and faithful to its principles.

Conclusion

Ultimately, the Warrant Canary is the piece of legal agility that complements the cryptographic agility necessary to face the horizon of modern threats (such as post-quantum computing). In an infrastructure where data is sovereign by design, the canary is not just a simple bird in a mine: it is the silent guardian of your digital fortress.

Utiq: The new telecom 'Super-Cookie' threatening your privacy

Mon, 01 Jun 2026 00:00:00 +0000

The scheduled end of third-party cookies on web browsers has triggered a true arms race in the targeted advertising industry. While Google is trying to impose its own standards (like the Privacy Sandbox), another unexpected player has decided to grab a piece of the pie: your Internet Service Provider (ISP).

Thus was born Utiq (formerly known as project TrustPid), a joint venture founded by European telecommunications giants. Sold to the general public as a “transparent and respectful” solution, Utiq is actually what cybersecurity experts fear most: a “supercookie” operating at the network level.

What is Utiq and how does it work?

Traditionally, advertising tracking (cookies) is managed by your web browser (Chrome , Firefox , Safari ). You could block it using extensions (like uBlock Origin ) or a privacy-oriented browser (like Brave ).

Utiq shifts the problem one step back: to the level of your network connection.

Here is how the trap springs:

Network interception: When you browse the internet via your mobile connection (4G/5G) or your fiber box, Utiq uses your IP address and your telecom subscription data to identify you.
Consent (the false choice): Upon arriving at a partner site, a pop-up window asks you to accept Utiq. Due to the fatigue associated with cookie banners (Consent Fatigue), millions of users click “Accept” without reading.
The “Network Signal”: Once consent is given, Utiq directly contacts your telecom operator. The latter generates a unique, pseudonymized identification token (the network signal) which it transmits to advertisers.

You are now trackable from site to site, not by a file stored on your computer, but by the very infrastructure that provides you with the internet.

Why Utiq is a privacy nightmare (OPSEC)

The initiative raises serious problems for digital sovereignty and the confidentiality of your data:

Tracking at the source: Unlike classic cookies, you cannot simply “clear your history” or “empty your cache” to get rid of Utiq. The identification token is generated by your ISP.
The centralization of profiles: Telecom operators already know your name, physical address, banking details, and location in real-time. By linking your web browsing history via Utiq to this, they create behavioral profiling of daunting precision.
The flaw of pseudonymization: Utiq defends itself by not sharing your name in plain text, claiming to use “encrypted” tokens. However, in the cybersecurity world, it is proven that pseudonymization is reversible. Cross-referencing these tokens with other databases allows individuals to be easily re-identified.

Which operators use Utiq?

Utiq was founded by an alliance of the four largest European operators. If you are a customer of one of them (or one of their low-cost subsidiaries), your connection is potentially already “compatible” with this tracking.

Here are the founders and links to their respective privacy policies:

Orange (France, Spain, Poland, etc.)
Vodafone (Germany, Spain, UK, etc.)
Telefónica / O2 / Movistar (Spain, Germany, etc.)
Deutsche Telekom (Germany, Central Europe)

The OPSEC tip: Although Utiq offers a centralized consent management portal (consenthub.utiq.com ) to revoke access, the best defense remains technological.

The Zero-Trust approach to counter Utiq

The philosophy of digital sovereignty, driven by ecosystems like Arpokrat, relies on a simple principle: never trust the network infrastructure.

To technically neutralize systems like Utiq, the solution is to hide your traffic from your own internet service provider:

Using a sovereign VPN: By encrypting your traffic as soon as it leaves your device, your ISP only sees an unreadable stream of data directed towards a VPN server. It can no longer inject or read Utiq tokens.
The Tor network (Orbot ): Onion routing prevents any end-to-end identification.
DNS Encryption (DoH/DoT): Prevents your operator from knowing which websites you request to visit.

In summary, Utiq is proof that internet service providers are no longer content with being mere “pipes”; they want to become data brokers. More than ever, encrypting your traffic is no longer a security option, but an absolute necessity to preserve your digital silence.