WH15P3R

User Security Guide · Post-Quantum Edition

UNDERSTANDING YOUR THREAT LEVEL

Select the security approach that matches your risk profile:

LEVEL 1: BASIC SECURITY

Who This Is For

• Privacy-conscious individuals
• Casual secure communications
• Avoiding corporate surveillance
• Basic confidentiality needs

Quick Start

1. Use a modern browser: Chrome 142+, Edge 142+, or Firefox 120+
2. Visit: wh15p3r.link
3. Look for: POST-QUANTUM READY
4. Confirm VPN/Tor usage: Check the security confirmation box
5. Click: "Text only" to generate session code
6. Share code with your contact via separate channel
7. Verify: Status shows PQ SECURE
8. Chat safely: Messages are quantum-resistant encrypted
9. End session: Close browser when finished

LEVEL 2: ENHANCED SECURITY

Who This Is For

• Journalists communicating with sources
• Business professionals with confidential information
• Activists in partially-free countries
• Anyone facing moderate surveillance threats

Additional Requirements

Browser & Network Protection

Alternative: Use VPN (ProtonVPN, Mullvad, IVPN)

• Connect to VPN before accessing WH15P3R
• Choose privacy-focused providers
• Avoid free VPN services

Session Code Verification (CRITICAL)

When you generate a session code, you must verify it with your contact:

SECURITY CHECK: Verify session code out-of-band

For maximum security:
• Call your contact on a separate phone
• Verbally confirm the session code matches
• Or exchange codes in person

Why this matters: Prevents man-in-the-middle attacks

Safe verification methods:

1. Phone call on different device: Read code aloud, confirm it matches
2. In-person exchange: Show codes on screens, verify they match
3. Existing secure channel: If you already use Signal securely, that works

Operational Security

• Access location: Avoid using from home/work if possible
• Device security: Ensure device is clean, updated, trusted
• Message discipline: Keep messages brief, avoid unnecessary details
• Session hygiene: End sessions immediately when finished
• Browser cleanup: Close browser completely after session

LEVEL 3: HIGH SECURITY

Who This Is For

• Individuals in authoritarian countries
• Whistleblowers with sensitive information
• Human rights activists facing real threats
• Anyone under active government surveillance

Operating System Requirements

OPTION 1: Tails OS (Recommended for Desktop)

Tails = The Amnesic Incognito Live System

Characteristics:
• Boots from USB drive
• Runs entirely in RAM
• Leaves no traces on computer
• Includes Tor Browser pre-configured
• All data destroyed on shutdown

Download: tails.boum.org
IMPORTANT: Verify cryptographic signature

Usage:

1. Download Tails and verify signature
2. Create bootable USB drive
3. Boot computer from USB (nothing on hard drive)
4. Access WH15P3R through built-in Tor Browser
5. Shut down = all traces erased

OPTION 2: GrapheneOS (Mobile)

• Hardened Android OS for Pixel phones
• Enhanced privacy and security features
• Regular security updates
• Install from: grapheneos.org
• Use with hardened browser or Tor Browser (Android)

Access Location Protocol

ALWAYS access from:

• Random public WiFi (libraries, cafes, airports)
• Different location every time
• High-traffic areas with many people
• Locations you've never been to before
• Vary timing and neighborhood

Session Code Exchange (High Security)

BEST PRACTICE: In-Person Verification

1. Arrange meeting at random public location
2. Use counter-surveillance awareness
3. Exchange codes face-to-face
4. Verify codes match exactly
5. Memorize if possible, destroy paper immediately
6. Leave separately by different routes
7. Wait 2-6 hours before connecting
8. Connect from completely different locations

ACCEPTABLE: Burner Phone Voice Call

• Use burner phone purchased with cash
• Remove battery between uses
• Call from public location
• Read code using phonetic alphabet
• Destroy SIM after single use
• Never reuse burner for same contact

LEVEL 4: MAXIMUM SECURITY

Reality Check

If You Must Communicate Digitally

Hardware Security

• Use air-gapped devices for sensitive work (never connected to internet)
• Disposable devices: Burner laptops purchased with cash, used once
• Hardware verification: Inspect for tampering
• Faraday bags: Store devices in RF-blocking bags when not in use

Communication Strategy

PRIMARY RULE: Use WH15P3R for meeting coordination only.
          Discuss actual sensitive topics in person.

• Digital = coordination: Times, places (in code)
• Physical = sensitive info: Meet in person for details
• Time delays: Long gaps between digital contact and physical meeting
• Dead drops: Physical information exchange
• Compartmentalization: Different devices for different contacts

BROWSER COMPATIBILITY

Post-Quantum Encryption Support

Browser	Version Required	PQ Status	Notes
Chrome	142+	FULL SUPPORT	October 2025
Edge	142+	FULL SUPPORT	October 2025
Firefox	120+	FULL SUPPORT	November 2024
Tor Browser	Latest	RECOMMENDED	Based on Firefox
Brave	Latest	RECOMMENDED	Privacy-focused Chromium

Fallback: Older browsers use strong classical encryption (secure against current threats, not quantum-resistant)

WHAT IS PROTECTED

WHAT IS NOT PROTECTED

EMERGENCY PROCEDURES

If You Suspect Device Compromise

1. Immediately: End session, close browser, power off device
2. Do not turn on again until device can be examined
3. If high-risk: Destroy device and SIM card
4. Use different device for future communications
5. Change all patterns: Timing, locations, contacts

If Arrested or Detained

FREQUENTLY ASKED QUESTIONS

Q: Is this really quantum-resistant?

A: Yes, when using Chrome 142+, Edge 142+, or Firefox 120+. Uses NIST-standardized ML-KEM (FIPS 203) which is designed to resist attacks from quantum computers.

Q: Can the government read my messages?

A: They cannot decrypt messages in transit, even with quantum computers. However, they CAN read messages if your device is compromised before encryption or after decryption.

Q: Why do I need out-of-band verification?

A: To prevent man-in-the-middle attacks. An attacker could intercept your session code and pose as your contact. Verifying via phone call or in-person ensures you're really talking to who you think you are.

Q: What if I can't use Tor Browser?

A: Use a reputable VPN service. This hides your IP address from the signaling server, though not as effectively as Tor. For high-risk situations, Tor is strongly recommended.

Q: How do I know there's no backdoor?

A: The code is open source and can be audited. We use standard browser cryptography (not custom implementations), which is maintained and audited by browser vendors. Transparency is our security model.

Q: What happens if I lose connection?

A: Session ends and all encryption keys are destroyed. You'll need to start a new session with a new code.

FINAL GUIDANCE

Trust Your Instincts

If something feels wrong:

• STOP
• ASSESS
• CHANGE APPROACH

Better to be paranoid and safe than trusting and caught.

This is a Tool, Not a Shield

WH15P3R provides strong cryptographic protection. It does NOT make you invincible. Use wisely, understand limitations, combine with other security measures, and always prioritize your physical safety.