NKNW security guide

01 / THREAT MODEL

Name the risk before choosing the tool.

A useful plan is specific enough to change a decision. Revisit it when the people, place, device or political conditions change.

01
What data, relationship, account or physical safety must be protected?
02
Who may want it, and what access or authority do they have?
03
What happens if they succeed?
04
How likely is the risk now?
05
What burden can the people involved sustain every day?
06
Who can help before and during an incident?

ROUTINE

Account theft, device loss, phishing and accidental disclosure are the main risks.

SENSITIVE

A source, unpublished record or separate identity could be exposed.

ACTIVE

There is evidence of targeting, legal pressure, seizure, stalking or account compromise.

Method: EFF security planning (opens in a new tab) and Freedom of the Press Foundation checklist (opens in a new tab).

02 / ACCOUNTS

Secure the keys to every other account.

Email, recovery channels and the password manager often control the rest of your access.

Use unique generated passwords.

PROTECTS: Password reuse attacks and guessing.
LIMIT: A password does not stop phishing, malware or an unlocked device.
DO THIS: Generate and store a different password for every account in a password manager.

Prefer phishing-resistant MFA.

PROTECTS: Many remote account takeovers after a password is stolen.
LIMIT: A security key cannot repair a compromised recovery channel or device.
DO THIS: Use FIDO or WebAuthn security keys where available. Register a second key, store it separately and save recovery codes offline.

Harden recovery.

PROTECTS: The route that can reset your strongest login method.
LIMIT: Providers may still retain account and access records.
DO THIS: Review recovery email, phone, active sessions, forwarding rules and third-party access. Remove what is unnecessary.

Standards: NIST password guidance (opens in a new tab) and CISA phishing-resistant MFA guidance (opens in a new tab).

03 / DEVICES

Treat the device as part of the conversation.

Encryption in transit cannot protect text visible on a screen or files available to malware.

Install supported updates.

PROTECTS: Known vulnerabilities that vendors have repaired.
LIMIT: Updates do not remove every unknown flaw or unsafe configuration.
DO THIS: Enable automatic security updates for the operating system, browser and communication clients. Replace unsupported devices.

Encrypt and lock the device.

PROTECTS: Stored data when a powered-off device is lost or stolen.
LIMIT: Full-disk encryption offers less protection while the device is unlocked.
DO THIS: Use device encryption, a strong passcode and a short lock timeout. Power down before a predictable seizure risk when doing so does not create immediate danger.

Reduce what appears and what is installed.

PROTECTS: Message previews, excessive permissions and unnecessary attack surface.
LIMIT: Separation on one device is weaker than separation across dedicated devices.
DO THIS: Hide lock-screen previews, remove unused apps, review permissions and keep sensitive work in a separate profile or device.

04 / COMMUNICATION

Choose a channel for the risk.

End-to-end encryption protects message content in transit. Identity, device and traffic risks remain.

CHANNEL	IDENTITY AND ROUTING	USEFUL WHEN	BOUNDARY
NKNW XMPP with OMEMO	Pseudonymous address on a federated network.	Choose it for federation, pseudonymous addresses and access from compatible clients.	Verify OMEMO per conversation. Servers still handle routing data, and client support varies.
Signal	A phone number is required to register. A username can start contact without sharing it.	Choose it when participants already use Signal and simple encrypted contact is the priority.	Registration data and device security remain part of the risk.
SimpleX	Its design avoids a stable network-wide user identifier for contacts.	Choose it when reducing persistent identifier exposure is central to the plan.	Traffic correlation and compromised devices remain risks.
Matrix	Accounts and room state live on one or more federated homeservers.	Choose it for managed encrypted rooms and ongoing group collaboration.	Room membership and server-held state can spread across the federation.

OMEMO specification Signal identity documentation SimpleX documentation Matrix encryption documentation

These descriptions summarize official documentation. They are not independent audits or guarantees.

05 / FILES

Preserve evidence before removing traces.

Metadata can expose a source and can also be evidence. Preserve the original before cleaning a copy.

01
Preserve the original.
Keep the received bytes unchanged in encrypted, access-controlled storage.
02
Hash the original.
Record a SHA-256 digest, receipt time, source channel and handler.
03
Inspect a working copy.
Use a document sandbox or isolated system chosen for the file type and threat. A file can be malicious even when it appears to come from a known source.
04
Prepare a publication copy.
Remove unnecessary metadata or redact visible details from a copy. Hash the result separately.
05
Record the transformation.
Write what changed, with which tool and when. Share the publication copy and retain the original according to policy.

NKNW Share boundary

NKNW Share encrypts files in the browser, can clean supported metadata locally and limits retrieval through the service. It does not scan for malware, authenticate a sender, hide network metadata or remove copies already saved by a recipient.

NKNW Share is not an anonymous submission system.

Open NKNW Share

Safer document handling: Dangerzone isolation model (opens in a new tab) and SecureDrop document workflow (opens in a new tab).

06 / NETWORK

Know who can observe the connection.

Network tools change who can see traffic. They do not erase identity revealed by accounts or behaviour.

HTTPS protects a connection to a site.

PROTECTS: Content in transit between the browser and the site.
LIMIT: The site still sees requests, and surrounding network data can remain visible.
DO THIS: Check the domain and certificate warning. Stop if the browser reports a certificate error.

A VPN moves network trust.

PROTECTS: Traffic from local network observers and the access provider.
LIMIT: A VPN is not anonymity. The VPN provider can observe connection information, and accounts can identify you.
DO THIS: Use one only after deciding why the local network is a greater risk than the VPN provider.

Tor separates browsing from a direct route.

PROTECTS: A direct link between the browser connection and destination when used correctly.
LIMIT: Logging in, sharing identifying details, opening downloads externally or a compromised device can reveal you.
DO THIS: Use Tor Browser as provided. Do not add extensions. Keep identities separate and update it promptly.

Read the EFF VPN guidance (opens in a new tab) and Tor Browser safety guidance (opens in a new tab).

07 / INCIDENT

Contain first. Rebuild trust carefully.

Use a separate trusted device for recovery. If physical safety is at risk, seek qualified help before changing the suspected device.

Suspected account compromise

Secure the recovery email and password manager first.
Change the affected password from a trusted device.
Revoke unknown sessions, app passwords and recovery methods.
Replace exposed MFA and recovery codes.
Warn contacts through a previously verified channel.
Record what happened and monitor for renewed access.

Suspected device compromise

Stop using it for sensitive communication.
Do not use it to change passwords.
Document signs, time and recent actions without probing further.
Get specialist help from another trusted device.
After evidence decisions, rebuild from a known-good source and rotate credentials.

Access Now says its Digital Security Helpline offers free, round-the-clock help to civil society, journalists, activists and human rights defenders.

Open the Digital Security Helpline

08 / REVIEW RECORD

Check the advice again when the tools change.

LAST REVIEW: 2 October 2026
CURRENT REVISION: Version 1.1: navigation, accessibility and language revision.
REVIEW BASIS: Primary standards, protocol documentation and specialist civil-society guidance linked on this page.
NEXT REVIEW: Within 90 days, or sooner after a material service or protocol change.
REPORT A CORRECTION: 0xffff@nknw.chat

This guide provides operational information. It cannot determine your threat model or replace help from a qualified digital security responder.