The Ultimate OPSEC Guide: Building a Tank-Level Virtual Machine for Carding

[Professor]

Your Digital Panic Room: Complete Setup Guide for 2026​

Bro, let's cut the bullshit. You're here because you know the stakes. One mistake, one infected file, one moment of laziness, and it's over. The feds don't care about your excuses, and the script kiddies are getting smarter every day.

This guide isn't for casuals. This is for carders who want to build a digital fortress that would make the NSA sweat. We're going to build a virtual machine setup that's so secure, so isolated, and so disposable that even if you get compromised, you'll walk away clean.

TABLE OF CONTENTS​

1. Why Isolation Is Everything
2. The Two Scenarios That Will End You
3. Understanding Isolation in OPSEC
4. Hardware Requirements – What You Actually Need
5. Preparing Your Host System – The Clean Slate
6. VMware Workstation Pro vs VirtualBox – The Choice
7. Encrypted Storage with VeraCrypt
8. Creating the Virtual Machine – Step-by-Step
9. Installing and Hardening Windows in the VM
10. Network Security – The Layered Onion
11. VPN Configuration – Mullvad and Beyond
12. The Panic Protocol – When Shit Hits the Fan
13. Common Mistakes That Get You Caught
14. The Disposable VM Philosophy
15. Common Errors and Detailed Fixes
16. Risk Assessment and Mitigation
17. Complete Setup Checklist
18. Key Takeaways

1. WHY ISOLATION IS EVERYTHING​

In our line of work, isolation isn't just a best practice — it's the difference between walking free and eating prison food. Your main system should be cleaner than a Mormon's browser history. No personal files, no saved passwords, nothing that would tie you to your operations.

The core principle: Your operational activity should never touch your personal identity. Ever. Not once.

Think of it like this: a virtual machine creates a completely separate environment for your operations. Treat it as a digital burner phone that exists only in memory — after use, it disappears, leaving no trace on your main system.

2. THE TWO SCENARIOS THAT WILL END YOU​

Scenario 1: The RAT Attack​

You download a "bank card verification app" from some Telegram channel. It's full of RATs (Remote Access Trojans). Now some 16-year-old script kiddie is scrolling through your personal photos, cryptocurrency wallets, passwords, and documents. He's watching you through your webcam. He has your banking credentials. Your life is now his playground.

The Fix: Never download operational tools on your host system. Use a dedicated VM for all carding activities. If the VM gets infected, you nuke it and start fresh.

Scenario 2: The Raid​

4 a.m. The feds burst through your door. They seize your computer. On it, they find:

• Purchased credit card logs
• Fullz data
• Carding tools
• Stolen identities
• Your entire operation history

You're going to prison. Not for a slap on the wrist. For years.

The Fix: Keep all operational data in encrypted containers (VeraCrypt). When the pressure hits, your "nuke" protocol destroys everything.

3. UNDERSTANDING ISOLATION IN OPSEC​

Isolation isn't just about having a virtual machine. It's about creating a complete separation between:

Aspect	What It Means
Personal Activity	Your real life, real identity, real accounts
Fraudulent Activity	Carding, logs, stolen data, operations
Malware Protection	Containing infections so they can't reach your main system
Activity Separation	Different VMs for different operations (US banks vs EU banks)
Evidence Destruction	Rapid elimination of traces under pressure
No Cross-Contamination	Nothing from your "work" touches your "real life"

The Golden Rule: Your virtual machine is a digital burner phone. It exists only in memory. After use, it disappears, leaving no trace on your main system.

4. HARDWARE REQUIREMENTS – WHAT YOU ACTUALLY NEED​

Before we start building, make sure your hardware can handle this:

Component	Minimum	Recommended
CPU	Intel i5 / AMD Ryzen 5	Intel i7 / AMD Ryzen 7
RAM	16 GB	32 GB
Storage	256 GB SSD	512 GB+ SSD
Virtualization Support	Intel VT-x / AMD-V	Intel VT-x/AMD-V + VT-d/AMD-Vi
Network	Ethernet (for speed)	Ethernet + Backup WiFi

Why the specs matter: You're going to run a VM with 8 GB of RAM and 4 CPU cores. Your host system needs to handle that plus everything else without choking.

5. PREPARING YOUR HOST SYSTEM – THE CLEAN SLATE​

Step 1: Wipe Everything​

Start from zero. Completely wipe your computer to factory settings. Your host system should be a blank slate. No personal files, no saved passwords, no browser history, nothing.

Settings → Update & Security → Recovery → Reset this PC
→ Remove everything → Just remove my files

Step 2: Install Windows 11 Pro​

Why Pro? Because it gives you more control over Group Policy, BitLocker, and network settings that Home edition doesn't offer.

During installation:

• Choose "I don't have internet" to create a local account
• Don't use a Microsoft account
• Opt out of everything — telemetry, ads, personalized experience
• Set a strong local password

Step 3: Disable Windows Spyware​

Run these commands in PowerShell as Administrator:
powershell:

# Disable telemetry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0

# Disable Cortana
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowCortana" -Type DWord -Value 0

# Disable Windows Defender
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1

Step 4: BIOS/UEFI Settings​

Enter BIOS (F2 or Del key during boot):

• Enable Intel VT-x/AMD-V (Virtualization Technology)
• Enable Intel VT-d/AMD-Vi (if available)
• Disable Secure Boot
• Set a BIOS password
• Disable hardware-assisted virtualization (VBS) in Windows features

Step 5: Install System Updates​

This is the one time you allow your host to touch the internet. Install all critical updates, then disconnect permanently.

6. VMWARE WORKSTATION PRO VS VIRTUALBOX – THE CHOICE​

Feature	VMware Workstation Pro	VirtualBox
Price	$199	Free
Isolation	Superior (sandboxing)	Good
Performance	Faster (optimized for Windows)	Slower
Network Control	Advanced (custom NAT, VLAN)	Limited
Encryption	Built-in VM encryption	External (VeraCrypt)
Snapshots	Superior (memory snapshots)	Basic

The Verdict: VMware Workstation Pro is objectively better, but it costs money. Since you're a fraudster, use what you can get. If you're too poor or stupid to get VMware, VirtualBox is a free alternative, but with fewer security features.

For this guide, we're using VMware Workstation Pro 17.x.

7. ENCRYPTED STORAGE WITH VERACRYPT​

Your VM files should never touch an unencrypted drive. Ever. VeraCrypt is an open-source encryption tool that acts as an unbreakable vault for your operational data.

Why VeraCrypt?​

• Open-source and free: Trusted by security professionals worldwide
• Strong encryption: AES, Twofish, Serpent, and cascades of these algorithms
• Hidden volumes: Plausible deniability if you're forced to reveal a password
• Portable: You can keep the container on a USB drive

Step-by-Step VeraCrypt Setup:​

1. Download VeraCrypt from the official source (veracrypt.fr)
2. Create a New Encrypted Container:
   • Click "Create Volume"
   • Select "Create an encrypted file container"
   • Choose "Standard VeraCrypt volume"
   • Select a location (not your system drive!)
   • Create a new file or overwrite an existing one
3. Encryption Settings:
   • Encryption Algorithm: AES or AES-Twofish-Serpent (cascade for maximum security)
   • Hash Algorithm: SHA-512
   • Volume Size: At least 100 GB (200 GB+ recommended)
4. Password:
   • Minimum 20 characters
   • Mix uppercase, lowercase, numbers, symbols
   • Something memorable but complex
   • DO NOT FORGET THIS PASSWORD
5. Add Key Files (Optional, 2FA):
   • You can add any file (image, document, audio) as a second authentication factor
   • Without the key file, even the correct password won't unlock the volume
   • Store the key file separately from the container
6. Generate Entropy:
   • Move your mouse randomly for 30-60 seconds
   • This creates true randomness for the encryption key
7. Formatting:
   • Choose NTFS for Windows compatibility
   • exFAT if you need to access from macOS/Linux
   • Quick format is fine

Using the Container:​

• Mount: Click "Select File" → choose your container → "Mount" → enter password
• Unmount: Click "Dismount" or press Ctrl+D

Security Practice: Never leave the container mounted when not in use. Dismount it immediately after you finish your operations.

8. CREATING THE VIRTUAL MACHINE – STEP-BY-STEP​

Step 1: Create a New VM​

File → New Virtual Machine → Custom (Advanced)
→ Choose "I will install the operating system later"
→ Select Windows 11 x64
→ Name: "Work Environment" (or something boring)
→ Location: Your VeraCrypt container (e.g., D:\VMs\Work Environment)

Step 2: Hardware Configuration​

Component	Setting	Why
Processors	4 cores	Enough power for carding tools
Memory	8 GB	Fixed allocation (not dynamic)
Disk	80 GB	Pre-allocated for performance
3D Acceleration	Disabled	Unnecessary and a security risk
Sound Card	Remove	You don't need sound
Printer	Remove	You're not printing anything
USB Controller	Remove	Unless absolutely needed
Network	NAT only	No bridged connections

Step 3: Network Adapter Configuration​

Configure the network adapter:

Edit virtual machine settings → Network Adapter
→ NAT (Network Address Translation)
→ Advanced → Set static MAC address

Why NAT? It creates an isolated subnet that your host can't directly access. Your VM's IP is hidden behind your host's NAT, which then goes through your router and VPN.

Why static MAC? It prevents your VM from being identified by a changing MAC address. Change it weekly to avoid pattern detection.

9. INSTALLING AND HARDENING WINDOWS IN THE VM​

Step 1: Clean Installation​

1. Mount your Windows 11 ISO
2. Start the VM
3. DO NOT CONNECT TO THE INTERNET during installation
4. Choose "I don't have internet" → create a local account
5. No Microsoft account, no telemetry
6. Set a different local password than your host system

Step 2: Post-Installation Cleanup​

Run these immediately after installation:

Disable Windows Update Service:

Search → Services → Windows Update → Disabled

Disable All Telemetry:
powershell:

# In PowerShell as Administrator
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0

Disable Windows Defender:

Search → Windows Security → Virus & threat protection
→ Manage settings → Real-time protection → Off

Step 3: Install VMware Tools​

VM → Install VMware Tools
→ Run the installer → Complete installation
→ Reboot

Why? VMware Tools provides stability, better performance, and clipboard integration (which you'll disable anyway).

Step 4: Disable All Sharing Features​

Control Panel → Network and Sharing Center
→ Change advanced sharing settings
→ Turn off network discovery
→ Turn off file and printer sharing
→ Turn off public folder sharing

Step 5: Configure Windows Firewall​

Control Panel → Windows Defender Firewall
→ Advanced settings
→ Inbound Rules → Block all inbound connections
→ Outbound Rules → Allow only specific apps

Block all ports except:

• Port 53 (DNS)
• Port 80 (HTTP)
• Port 443 (HTTPS)
• Port 123 (NTP)

Step 6: System Hardening​

Based on zero-trust security principles, apply these additional hardening measures:

• Disable PowerShell Script Execution: Set-ExecutionPolicy Restricted
• Enable Windows Firewall Logging: Track all blocked connections
• Disable Remote Desktop: No need for remote access
• Remove All Windows Apps: Use a debloater script

10. NETWORK SECURITY – THE LAYERED ONION​

You're going to build a multi-layered security system like a paranoid onion:

Layer 1: Host System VPN​

1. Install Mullvad VPN (accepts cryptocurrency, no logs)
2. Enable Kill Switch:
   • Mullvad's kill switch is always on and cannot be disabled
   • Blocks all traffic if the VPN drops unexpectedly
   • Proactive, not reactive — no vulnerability window
3. Enable Lockdown Mode:
   

   Settings → Lockdown Mode → On

   • Blocks all traffic when VPN is disconnected
   • Acts as a kill switch for the VPN connection
   • Only Mullvad daemon traffic is allowed (for reconnection)
   • Command-line version:

   mullvad lockdown-mode set on
   mullvad auto-connect set on

4. Block IPv6:
   

   Settings → IPv6 → Block all IPv6 traffic

   • Prevents IPv6 leaks (IPv6 often bypasses VPNs)
5. Tunnel Protocol:
   

   Settings → Tunnel Protocol → WireGuard

   • WireGuard is faster and more secure than OpenVPN

Layer 2: VM Network Configuration​

1. Set Static MAC Address:
   

   Edit VM Settings → Network Adapter → Advanced
   → MAC Address → Manual → Enter a new MAC

   • Change MAC address weekly to avoid detection
2. NAT Only:
   • No bridged connections
   • No host-only networking
   • The VM should only talk to the internet through the host's VPN

Layer 3: Second VPN Inside VM (Recommended)​

Install a second VPN service in the VM
→ Connect to a different provider than your host
→ Rotate exit nodes regularly

Why two VPNs? If one fails, the other is still active. If one is compromised, the other provides a buffer.

Qubes OS Alternative:
In Qubes OS, you can implement a three-layer kill switch:

1. VPN's built-in lockdown mode
2. Custom firewall rules in the VPN ProxyVM
3. sys-firewall rules that only allow VPN endpoints

Layer 4: Firewall Integration​

Mullvad's firewall system uses atomic transactions:

• All firewall rule changes are applied instantaneously
• No time window exists where traffic could leak
• Implemented via nftables on Linux, PF on macOS, WFP on Windows

Key firewall states:

• Blocked Policy: Blocks all traffic except allowed endpoints (applied when VPN is disconnected)
• Connecting Policy: Allows only VPN relay connections
• Connected Policy: Allows full tunnel traffic

11. VPN CONFIGURATION – MULLVAD AND BEYOND​

Mullvad Setup​

Setting	Value	Why
Kill Switch	Always on (cannot be disabled)	Prevents IP leaks
Lockdown Mode	On	Blocks all non-VPN traffic when disconnected
Tunnel Protocol	WireGuard	Faster and more secure
IPv6	Block all IPv6 traffic	Prevents IPv6 leaks
Use Custom DNS Server	Yes (1.1.1.1 or 9.9.9.9)	Prevents DNS leaks

Why Mullvad?

• Accepts cryptocurrency payments
• No logs policy (audited)
• Built-in kill switch and lockdown mode
• Based in Sweden (strong privacy laws)
• Atomic firewall transactions prevent leak windows

Backup VPN Provider​

Have a second VPN service ready as a backup:

• ProtonVPN (accepted payment: crypto)
• AirVPN (accepted payment: crypto)
• Any provider that accepts anonymous payment and has a no-logs policy

OpenVPN vs WireGuard:​

Feature	WireGuard	OpenVPN
Speed	Faster	Slower
Security	Modern cryptography	Older but still secure
Codebase	Small (easier to audit)	Large (more potential bugs)
Standard	Still evolving	Mature and widely adopted

Recommendation: Use WireGuard for speed and security. Fall back to OpenVPN if needed.

Split Tunneling Consideration:​

If you need to exclude some applications from the VPN tunnel:

• Disable lockdown mode for flexibility
• Use mullvad split-tunnel commands

Warning: Split tunneling reduces security. Only use it if absolutely necessary.

12. THE PANIC PROTOCOL – WHEN SHIT HITS THE FAN​

When everything goes wrong and you hear those heavy thuds at the door, you need immediate, drastic action. This is your digital cyanide pill.

Batch File 1: lock.bat (Dismount and Lock)​

Create this file on your host system's desktop:

batch
@echo off
REM Force dismount all VeraCrypt volumes
"C:\Program Files\VeraCrypt\VeraCrypt.exe" /dismount /force /silent

REM Clear RAM to prevent cold boot attacks
"C:\Program Files\VeraCrypt\VeraCrypt.exe" /wipecache /silent

exit

Batch File 2: nuke.bat (Kill VM and Wipe)​

WARNING: THIS DELETES EVERYTHING. PERMANENTLY. USE ONLY IN EMERGENCIES.

batch
@echo off
REM Kill VMware processes
taskkill /F /IM vmware.exe /T
taskkill /F /IM vmware-vmx.exe /T

REM Secure delete VM files (using SDelete for secure wiping)
sdelete -p 3 -r "D:\VMs\Work Environment\*.*"

REM Delete the entire folder
rmdir /S /Q "D:\VMs\Work Environment"

REM Wipe free space to prevent recovery
cipher /w:D:\VMs

REM Shut down the computer immediately
shutdown /s /f /t 0

exit

Batch File 3: shred.bat (Alternative for Linux Users)​

For Linux-based setups using VeraCrypt with LUKS:

#!/bin/bash
# Shred the entire container
shred -vfz -n 3 /path/to/your/container.vc
# Unmount and wipe
veracrypt -d
sync

Emergency Protocol Steps:​

1. Hit nuke.bat (if you have 5-10 seconds)
2. Pull the power cord (if you have 1-2 seconds)
3. Destroy the hard drive (if you have 30+ seconds)

Pro Tip: Practice this. Run through it in your head. Make it muscle memory. When the cops are at your door, you don't want to be fumbling with folders.

13. COMMON MISTAKES THAT GET YOU CAUGHT​

Mistake	Why It's Fatal	How to Avoid
Checking personal email in the VM	You've connected your personal identity to the operation	Keep operations in the VM, personal life on the host
Using the same proxy for multiple attempts	Creates a pattern for fraud detection	Rotate proxies after every 2-3 attempts
Data center proxies	Easily detected and blocked	Use residential proxies (Bright Data, IPRoyal)
Saving passwords in browser	If the VM is compromised, everything is gone	Use a password manager inside the VM (KeePass)
Forgetting to enable VPN	Your real IP is exposed	Set VPN to start automatically with the VM
Not rotating MAC addresses	Creates a unique fingerprint	Change MAC weekly
Reusing VMs	Leaves traces across operations	Use disposable VMs for each major operation
Testing cards on the same merchant	Triggers fraud flags	Diversify your targets
Using weak VeraCrypt password	Vulnerable to brute-force	Use 20+ character passphrase with special chars
Not using key files	Single point of failure	Add key files for 2FA
Storing container on system drive	Easily seized	Store on removable drive

14. THE DISPOSABLE VM PHILOSOPHY​

Think of your VM as a digital burner phone. It should be:

Disposable

• Once you're done, you kill it
• No traces, no leftovers

Temporary

• Create a fresh VM for each major operation
• Don't reuse VMs for different types of work

Traceless

• Encrypted storage (VeraCrypt)
• No personal data stored inside
• No browser history saved
• No cookies kept

The Process:

1. Create new VM
2. Do your operation
3. Destroy VM
4. Repeat for next operation

15. COMMON ERRORS AND DETAILED FIXES​

Error 1: "Virtualization is not enabled"​

Symptoms: VMware/VirtualBox fails to start VM, error about VT-x/AMD-V

Causes:

• Intel VT-x/AMD-V not enabled in BIOS
• Hyper-V or VBS conflicting

Detailed Fix:

1. Enter BIOS (F2/Del during boot)
2. Enable Intel VT-x or AMD-V
3. Disable Secure Boot
4. In Windows, disable Hyper-V and Virtual Machine Platform
5. Reboot

Error 2: "VeraCrypt container won't mount"​

Symptoms: "Incorrect password" or "Invalid volume"

Causes:

• Wrong password
• Key file missing
• Container file corrupted

Detailed Fix:

1. If using key file, select the correct file
2. Check caps lock
3. Ensure you're using the correct encryption algorithm
4. Use "Mount Options" → "Use backup header" if available
5. Last resort: If you have a backup header, restore it

Error 3: "VPN connection drops, kill switch blocks internet"​

Symptoms: No internet access, VPN status shows "Disconnected"

Causes:

• Network instability
• Server overload
• Firewall blocking VPN traffic

Detailed Fix:

1. Check VPN status: mullvad status
2. If lockdown mode is enabled and VPN is disconnected, connect first: mullvad connect
3. If you need emergency internet, temporarily disable lockdown mode: mullvad lockdown-mode set off
4. Check firewall settings: ensure outbound ports 51820 (WireGuard) and 53 (DNS) are open
5. Restart Mullvad daemon: sudo systemctl restart mullvad-daemon

Error 4: "VM performance is extremely slow"​

Symptoms: Lagging, stuttering, slow boot times

Causes:

• Insufficient RAM allocated
• Disk not pre-allocated
• Host system overloaded

Detailed Fix:

1. Allocate more RAM (8 GB minimum)
2. Pre-allocate disk space
3. Disable 3D acceleration
4. Ensure host has at least 16 GB RAM
5. Use SSD storage for VM files

Error 5: "MAC address not changing"​

Symptoms: VM keeps same MAC address even after editing

Causes:

• MAC address override disabled
• VM config corrupted

Detailed Fix:

1. Shut down VM
2. Open .vmx file in Notepad
3. Find or add: ethernet0.addressType = "static"
4. Add: ethernet0.address = "00:50:56:XX:XX:XX" (where X is hex)
5. Save and restart VM

16. RISK ASSESSMENT AND MITIGATION​

Risk	Likelihood	Impact	Mitigation
VeraCrypt container seized	Low	Critical	Use hidden volumes; store key file separately
VM compromise (RAT)	Medium	High	Use disposable VMs; never run untrusted software
VPN logs	Low	Medium	Use Mullvad (no logs, crypto payments)
Physical seizure	Low	Critical	Nuke protocol; encrypted storage; emergency drills
IP leak	Medium	High	Multiple VPN layers; kill switch; lockdown mode
MAC address tracking	Medium	Medium	Rotate MAC weekly
Browser fingerprinting	High	Medium	Use antidetect browsers; rotate fingerprints
Proxy detection	Medium	Medium	Use residential proxies; rotate frequently

17. COMPLETE SETUP CHECKLIST​

• □ Hardware: Virtualization enabled in BIOS, 16+ GB RAM, SSD storage
• □ Host System: Clean Windows install, no personal data, all updates applied
• □ Encryption: VeraCrypt installed, encrypted container created (100+ GB)
• □ VM Software: VMware Workstation Pro or VirtualBox installed
• □ VM Created: 4 cores, 8 GB RAM, 80 GB pre-allocated disk, NAT only
• □ Windows Installed: Local account only, no internet during install
• □ VM Hardened: Telemetry disabled, Windows Defender off, firewall configured
• □ VMware Tools: Installed and configured
• □ Host VPN: Mullvad installed, kill switch active, lockdown mode on, IPv6 blocked
• □ VM VPN: Second VPN installed (optional but recommended)
• □ MAC Address: Static MAC set, scheduled for weekly change
• □ Panic Protocol: lock.bat and nuke.bat created and tested
• □ Backup: Encryption key backup stored separately
• □ Emergency Drill: Full panic protocol practiced

18. KEY TAKEAWAYS​

1. Isolation is everything. Your operational activity should never touch your personal identity.
2. Encrypt everything. VeraCrypt containers for VM storage are non-negotiable.
3. Layered security. Host VPN + VM VPN + disposable VMs = maximum protection. Mullvad's kill switch is always on and cannot be disabled.
4. Practice the panic protocol. When the feds come knocking, you don't have time to think. Use mullvad lockdown-mode and mullvad auto-connect for automated protection.
5. Stay paranoid. Trust nothing, verify everything. Use key files with VeraCrypt for 2FA.
6. No cross-contamination. Personal life stays on the host. Operations stay in the VM.
7. Keep it clean. No saved passwords, no saved cookies, no browser history.
8. Rotate everything. IPs, MAC addresses, proxies, VMs — all of it needs to be regularly changed.
9. Test your setup. Don't wait until you're compromised to find out something doesn't work.
10. Be professional. This isn't a game. Treat it like a job, or it will end your freedom.

FINAL WORDS​

Bro, setting up a secure virtual machine isn't just about installing some software. It's about creating a digital safehouse that will protect you when things go wrong. And believe me, in our line of work, things will go wrong sooner or later.

Think of your virtual machine as a digital emergency kit. When red and blue lights start flashing outside, you don't want to have to frantically remember which files to delete first. Your emergency response protocols should be rehearsed to the point of automatism — one click, and everything goes down the drain.

But here's the important thing: Even the best security system is useless if you're lazy. I've seen too many carders get caught not because their system was terrible, but because they got complacent. They started checking their personal email in their "secure" virtual machine. They forgot to turn on the VPN. Small mistakes have big consequences.

Remember:

• Your virtual machine is a burner phone, not your personal iPhone
• Those batch files are not just decoration — practice using them
• If something doesn't seem right, nuke it first and ask questions later
• VeraCrypt encryption with AES is unbreakable if you use a strong password and key files
• Mullvad's kill switch is always on — use it to your advantage

Stay in the shadows. Stay paranoid. Stay free.