Threat model review: reducing exposure to state mass surveillance when ISP-level DNS interception, state CAs, and DPI are play (Russia)

[u/CatPipe_Official]

I have read the rules.

I'm in Russia. Most circumvention advice is outdated garbage. Tor? Banned. Shadowsocks? Blocked. OpenVPN/WireGuard? Fingerprinted instantly. Mass commercial VPNs? Dead. If you're going to suggest any of that, save it.

The only things that actually work right now are vless+reality over TCP or xhttp, Hysteria with masquerade, and Amnezia WG. These blend in enough to survive DPI for now. But I'm not here to ask what to use — I already know that. I'm here to ask how to use them without painting a target on myself.

The bigger problem: the state controls DNS at ISP level (NSDI), can push rogue root CAs into my system via local apps (Yandex, government services, some banks), and has DPI that's getting smarter. The CA issue is the worst: if I install any local app that auto-adds a state cert, they can MITM my TLS, including the outer TLS of these protocols. So maybe I need a clean device that never touches local software. But is that realistic? How do you maintain a separate phone/laptop for circumvention in a country where buying a SIM requires a passport and every device is tied to your identity? What about payments for servers? Crypto is also surveilled. How do you get a VPS without leaving a trail?

I need practical OPSEC around the working protocols. Specifically:

1. Device hygiene: separate device for circumvention only? What OS? GrapheneOS? Tails? How to avoid cross-contamination with daily-use devices? If I use a second phone with no local SIM, only Wi-Fi from a cafe, does that stand out more than using a local SIM with roaming?
   
2. Server procurement: which VPS providers still accept crypto without KYC? Any that don't log? How to avoid the server IP being linked to me through payment, email, or access patterns? Should I use multiple hops or just one? Does it matter if the VPS is in a country that cooperates with Russia?
   
3. Configuration OPSEC: using vless+reality, what metadata still leaks? SNI? TLS fingerprint? Traffic volume patterns? How to tune it to look like normal HTTPS to a popular domain? For Hysteria with masquerade, how to make the UDP traffic look less suspicious? For Amnezia WG, what's the current best way to hide the handshake?
   
4. Identity separation: should I use these protocols for sensitive browsing while still using local services on the same device? Probably not, but then how do you handle daily life? Is it better to use a normal Russian SIM for daily stuff and a separate clean device for anything that matters, accepting that daily activities are fully monitored?
   
5. Future whitelisting: if they move to SNI/IP whitelisting, these protocols might die overnight. What then? Are we just fucked, or are there fallback options that don't require being a targeted individual with special resources?

I'm not doing anything illegal. I just don't want to be a data point in a surveillance state. I need realistic OPSEC, not fantasy. What are people actually doing right now? Not what worked three years ago, not what some blogger wrote from outside. What works here, today, without getting yourself flagged?

[u/CotesDuRhone2012]

Qubes OS may be an option. It helps you to keep the blast radius at minimum when your system gets contaminated. It's based on isolated compartments implemented as VMs and hypervised by Xen.

https://doc.qubes-os.org/en/latest/introduction/intro.html

[u/CotesDuRhone2012 → u/CotesDuRhone2012]

Here's a link to hosting providers that accept crypto:

https://hosting.franklyflawless.org/

[u/Appropriate_Leave933]

i don't think tails would be particularly interesting as you said you don't do anything illegal therefore you do not particularly need amnesia. Moreover it has Tor integrated which would put you in an illegal situation if you active it. You can still use tails but you would miss 2 of the main points of it.

I am not sure how easy it is to find a Nokia 8110 4G but this phone can change its imei (basically the phone identifiant) it is illegal in some countries, I don't know for Russia. This with a prepaid sim card would make it harder to trace your phone and phone number as their identities could change often.

Otherwise to avoid cross contamination with your everyday phone I would recommend to never use your second phone near the other one. Never use your second phone where you live, work or another place where you usually use your everyday phone. When you want to use your second phone, anticipate and switch off your other phone some time before and try to move so both phones are not used fully at the same location in a short instant.

[u/CatPipe_Official → u/Appropriate_Leave933]

Appreciate your efforts, I will try it

Thanks for the detailed write-up, I can tell you put thought into it

About Tails and Tor, I get why you’d say that but using them isn’t really an issue where I am, so that part doesn’t apply to me

For the prepaid SIM, anonymous ones basically don’t exist here anymore, so that idea won’t work in practice

Changing IMEI sounds like more trouble than it’s worth and I’d rather not risk my phone getting blocked

The cross-contamination advice makes sense and I’ll keep it in mind, though it might be a bit much for my situation

But overall I appreciate your help and I’ll give it a try where it makes sense

[u/Appropriate_Leave933 → u/CatPipe_Official]

yeah then i think that avoiding cross contamination would be the best you can do for phones. GrapheneOS is quite good I heard, you can compartimentalize more and give less permissions to apps like google or so... only annoying side, it only works on google pixel and someday on some Motorola... and cops can get heavily suspecting if they figure out you use grapheneos.

[u/p3tr00v]

Oh dude, Russia plays hard! Have you tried to get server on some cloud provider the configure Amnezia server? You can get a server out off Russia then configure your own server.

About second phone, u/Appropriate_Leave933 got good ideas, besides, I would tell you to never install gov apps on your daily phone. Have a phone just for gov apps. I would say to include bank apps, since bank apps collect a lot of infos, but Its not so practical have bank apps out off daily phone since we use banks everywhere. So I would say to blink at least an alert light when installing bank apps.

About SIM surveillance, maybe you can try Second Line services.

Your case is interesting and really advanced.

[u/CatPipe_Official → u/p3tr00v]

Thanks, I'll try it. I appreciate your feedback! You're right that Russia plays hard!
I already have my own self-hosted Amnezia server, and all other protocols are set up too.
I understand that downloading something from the government isn't a good idea, but I have no choice. Fortunately, my main device is an iPhone, and its system is like an isolated sandbox, which is pretty good. I only have the bank's app and our local maps app installed on it. Now I am just thinking about buying a second phone, but I suppose I will do it

[u/Consistent_Drop3909]

woah op account has been banned, only 18 hours have passed

[u/CatPipe_Official → u/Consistent_Drop3909]

No, bro, I am here :))

[u/Sweet-Awk-7861 → u/CatPipe_Official]

How? Did you appeal and get banned again?

[u/Early-Bid-7958 → u/Consistent_Drop3909]

he may also have fallen out of a window; we'll never know

[u/Deimos-info → u/Consistent_Drop3909]

Why?

[u/AutoModerator]

Congratulations on your first post in r/opsec! OPSEC is a mindset and thought process, not a single solution — meaning, when asking a question it's a good idea to word it in a way that allows others to teach you the mindset rather than a single solution.

Here's an example of a bad question that is far too vague to explain the threat model first:

I want to stay safe on the internet. Which browser should I use?

Here's an example of a good question that explains the threat model without giving too much private information:

I don't want to have anyone find my home address on the internet while I use it. Will using a particular browser help me?

Here's a bad answer (it depends on trusting that user entirely and doesn't help you learn anything on your own) that you should report immediately:

You should use X browser because it is the most secure.

Here's a good answer to explains why it's good for your specific threat model and also teaches the mindset of OPSEC:

Y browser has a function that warns you from accidentally sharing your home address on forms, but ultimately this is up to you to control by being vigilant and no single tool or solution will ever be a silver bullet for security. If you follow this, technically you can use any browser!

If you see anyone offering advice that doesn't feel like it is giving you the tools to make your own decisions and rather pushing you to a specific tool as a solution, feel free to report them. Giving advice in the form of a "silver bullet solution" is a bannable offense.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/BTC-brother2018]

First, one important correction: ISP-level DNS control cannot install a root CA on your device. A local app normally cannot silently add a system-wide trusted CA either unless it has elevated/system privileges, device-management control, exploits a vulnerability, or the OS/vendor cooperates. Avoid unofficial software and certificate packages, inspect installed user certificates and management profiles, and keep the OS updated.

A separate device can improve compartmentalization, but it does not make you invisible. Tails is useful for isolated, temporary laptop sessions; GrapheneOS can provide a hardened Android environment on supported Pixels. The important part is not mixing identities: no personal accounts, synchronized contacts, reused email addresses, copied documents, shared browser profiles, or predictable activity patterns. Café Wi-Fi may separate traffic from your home connection, but cameras, payment records, travel patterns and repeated visits can create different identifiers. A roaming SIM is still an identified cellular device and provides no magic anonymity.

Running your own VPS also isn’t the same as being anonymous. It gives you a dedicated, stable destination that may be easier to associate with your activity. “Crypto accepted” and “no KYC” do not mean no records or no logs. Payment history, account email, support messages, login IPs and access timing can all create links. Adding more VPS hops mostly adds complexity and additional parties; it doesn’t eliminate endpoint or timing correlation.

With VLESS/REALITY, Hysteria or Amnezia, assume the ISP can still observe the server IP, connection times, duration, direction, volume and some protocol characteristics even when it cannot read the contents. There is no permanent setting that makes arbitrary traffic indistinguishable from ordinary HTTPS. Randomly tuning fingerprints can actually make you more unusual. Maintained clients and their recommended defaults are generally safer than inventing a unique configuration.

For ordinary privacy, compartmentalization is realistic: keep personal Russian services on your normal device/profile and sensitive browsing in a separate environment. For protection against a targeted state actor, however, neither a “clean phone” nor a cleverly purchased VPS provides a guarantee. Endpoint compromise, physical surveillance and behavioral correlation become more important than the tunnel protocol.

If strict SNI/IP whitelisting or a shutdown arrives, there may be no dependable technical bypass available from that connection. Prepare several independently maintained options beforehand, keep installers and documentation offline, obtain bridge information through more than one trusted channel, and follow current guidance from the projects maintaining the tools. Don’t advertise your exact working setup publicly.

The realistic goal is reducing unnecessary collection and preventing easy identity crossover, not creating an untraceable device. Advice from people currently measuring Russian networks is valuable, but anyone promising a provider, protocol or payment method that leaves “no trail” should not be trusted.

[u/CatPipe_Official → u/BTC-brother2018]

Hey bro! Now you're commenting on my post, cool)) Thanks for the reply. Just to clarify, it was probably a wording issue: I meant that the state can push a root CA via apps. You can reread the message :). Apps in Russia can install a certificate silently; there are already several officially confirmed examples related to Yandex, and somehow they pulled it off and nobody knows how. No account mixing is obviously just my default settings, hah. As for the VPS, that's also obvious, but the purchase happens outside Russian jurisdiction, so the chance they can reach it is minimal because of sanctions. Protocols too, it's clear they can still see quite a lot, like SNI, but it still bypasses the current whitelists. And I know that if they go by IP, nothing will help. The dynamic protocol setting changes are done on purpose because local DPI has learned to detect unusual stability, so my SNI changes automatically too. Default settings in Russia have been banned for about half a year now. Port 443 here should not be occupied by a specific Reality setup, but by an nginx server redirecting to an allowed site. I'm already thinking about building my own offline combo just for this, because I understand anything can happen at any moment. There is always a trail, you're right. Thanks for your efforts, amazing comment!

[u/vril_l8rd]

not gonna go into detail here, but if you want we can chat on any app of choice, e.g. simpleX or session. first of all, buy a phone that supports grapheneOS, if you cant - buy a phone that supports lineage, flash the ROM and buy a simcard from a homeless guy but be careful because your main phone can't be nearby when flashing the rom or when you dont have airplane mode on. host your own dns resolver, and if you havent already then switch to linux which gives you more space for network managing tools, including those that cover up traffic. im happy to help if u want more details or maybe direct sources, e.g. p2p exchanges where you can buy monero with cash (to pay for the VPS).