GHOST
STACK
SETUP
GUIDE

Your primary email address is the single most exposed identifier you have. Every site that gets breached, every form you fill out, every forum you sign up for — they all collect it. The fix: stop giving out your real address entirely. Use aliases that forward to it instead.

• 01
  Create your SimpleLogin account using your real email

  This is the only place your real address is stored. Use a strong unique password and enable 2FA immediately after signup.
• 02
  Install the browser extension (Chrome, Firefox, Safari)

  The extension adds a one-click alias generator to any email field in your browser. You never have to think about it — just click when signing up anywhere.
• 03
  Create a naming convention for your aliases

  Example system: site-name@youralias.simplelogin.com — so you always know which site leaked your address when spam arrives.
• 04
  Update your highest-risk accounts to use aliases

  Start with: shopping sites, forums, newsletters, apps you rarely use. Do not alias: banking, government accounts, or critical services that need to reach you reliably.

Password reuse is the single most exploited attack vector in credential theft. The solution isn't memorizing more passwords — it's using a password manager to generate and store a unique 20+ character password for every single account. You only need to remember one master password.

• R1
  Minimum 20 characters, randomly generated

  Use Bitwarden's built-in generator. Never create passwords yourself — human-generated passwords have predictable patterns that cracking tools exploit.
• R2
  Every account gets a unique password. No exceptions.

  Even slight variations (adding a number, changing a symbol) are defeated by modern credential stuffing tools that test thousands of variations automatically.
• R3
  Master password must be a passphrase, not a password

  Use 5–6 random unrelated words: maple-frog-circuit-window-88. Long and memorable. Never write it down digitally.
• R4
  Enable emergency access and backup your vault

  Export an encrypted backup of your Bitwarden vault quarterly. Store it on an encrypted USB drive or encrypted local folder. Losing vault access = losing all accounts.

2FA stops 99% of automated account takeover attacks. But not all 2FA is equal — SMS-based 2FA can be defeated by SIM-swap attacks in under 10 minutes. Authenticator app-based 2FA cannot. Here's how to upgrade your entire account stack.

Your browser leaks your identity constantly — through fingerprinting, trackers, cookies, and search history. You don't need to switch browsers entirely. These configuration changes reduce 80% of passive tracking with zero impact on your browsing experience.

• 01
  Type about:config in Firefox address bar → accept the risk

  Set privacy.resistFingerprinting → true. This randomizes browser fingerprint data to prevent sites from identifying you across sessions.
• 02
  Settings → Privacy & Security → Enhanced Tracking Protection

  Set to Strict. Enable "Delete cookies and site data when Firefox is closed." Enable DNS over HTTPS using Cloudflare or NextDNS.
• 03
  Disable telemetry data collection

  Settings → Privacy & Security → Firefox Data Collection → uncheck all boxes. This stops Firefox from sending your usage data to Mozilla.

Your phone is the most personal data collection device you own. Every app requests permissions it doesn't need. Location data, contacts, microphone access, and advertising IDs are harvested constantly. These settings disable the worst offenders without breaking your phone.

A VPN hides your browsing from your ISP and masks your IP address from websites — but it does NOT make you anonymous. It shifts trust from your ISP to your VPN provider. The free tier of Proton VPN is the only free VPN worth using.

• ✓
  Always use on public WiFi (cafes, airports, hotels)

  Public networks are trivial to monitor. VPN encrypts your traffic so other users on the network can't intercept your data.
• ✓
  When researching sensitive topics

  Health conditions, legal matters, financial research — your ISP logs every domain you visit. VPN prevents this logging.
• ✗
  Don't rely on VPN alone for anonymity

  If you're logged into Google while using a VPN, Google still knows who you are. VPN hides your IP — it doesn't hide your identity from sites you log into.

Your complete privacy infrastructure when all modules are deployed. Each layer addresses a different exposure vector. Together they form an integrated, zero-cost privacy stack that prevents most passive data collection.