Privacy & Anonymity

Secrets & Disk

The layers so far protect your traffic and your identity while you work. This one protects the data you keep. Security work generates sensitive material — client credentials, findings, captured hashes, screenshots, loot — and a laptop that’s lost, stolen, or seized shouldn’t hand all of it over. Oniomarchy installs the two tools that guard data at rest: a password manager for your secrets, and full encryption for your files.

KeePassXC — your credentials

KeePassXC keeps your passwords in a single strong-encrypted database file that only you can open. Everything lives in one .kdbx file protected by a master password (and optionally a key file or a hardware key like a YubiKey), so your credentials are never scattered across notes, browser stores, or plaintext files. It has a built-in password generator, browser integration, and TOTP support, and because the database is just a file, you control where it lives and how it’s backed up.

Installed from the official repositories. For security work specifically:

• Keep engagement credentials, API keys, and discovered logins here rather than in the browser or a text file — this is why the hardened browser is set to not save passwords.
• The generator makes strong, unique passwords for the accounts and services you stand up during an assessment.
• One database per engagement keeps client secrets cleanly separated.

VeraCrypt — your disk

VeraCrypt provides on-the-fly encryption for whole volumes and containers. You can create an encrypted container — a single file that mounts as a drive and holds whatever you put in it — or encrypt an entire partition or USB stick. Everything written to it is encrypted transparently; unmount it and it’s an indistinguishable blob of random data. It’s the successor to TrueCrypt, and it even supports hidden volumes for plausible deniability.

Installed from the official repositories. For security work:

• Keep engagement loot — captures, dumps, screenshots, client data — in a VeraCrypt container, so a lost device doesn’t expose a client’s data.
• A per-client container keeps engagements separated and makes clean handoff or destruction simple: it’s one file.
• Store the container’s password in KeePassXC, and the two tools cover each other.

Together

These two are the at-rest complement to the in-transit layers. Route your traffic through Tor, forget your session with the hardened browser, randomize your MAC — and then make sure that if the machine itself falls into the wrong hands, the credentials are in an encrypted vault and the sensitive files are in an encrypted volume. That’s the full stack: protected while you work, protected at rest.