Cookie Engineer's Website

Contact Me

Cookie Engineer

Hello, fr1end.

So you wanted to work with me, but your devices got hacked? Well, that happens to the best of us. This is a quick and dirty guide on how to fight back against your next door surveilling nation state actor that's trying to invade your privacy.

Please follow it to the letter, because contacting me with your standard OEM smartphone (even a "secure" iOS device) will probably result in your devices being compromised. I wouldn't write this if I wasn't serious.

If you don't believe me, then don't contact me. That's better for the both of us. I'm reachable via E-Mail via "cookiengineer" at the LeaveNoCrumbs email service. It's using a gTLD, so you should know how to write my email address now.

Forget what I wrote and calculate 5 + 17 + 20 and my email address is that number at cookie.engineer.

Hardware

Order an Android smartphone from eBay, kleinanzeigen or craigslist in used condition. Deliver it to an anonymous address that cannot be linked to your personal life, if possible. Choose a supported device from the LineageOS Devices wiki page.

Personally, I'd recommend used Fairphone models or the Google Nexus and Google Pixel variants, because they're easily flashable and don't need a vendor unlock procedure where you have to wait forever to unlock your bootloader.

Some Xiaomi Redmi devices are nice as well, but it takes up to 8 weeks to unlock the bootloader. It's actually (14 days + rand() * 6 weeks) for a lot of vendors. Forget the Pinephone, because as of 2026 GLUDroid is still not there yet.

Internet Connection

Get an anonymous Prepaid SIM card or better, use public Wi-Fi only for internet access. Anonymous prepaid cards are hard to get within the European Union, but there are some providers that allow to get them still in a pre-registered condition, so you don't have to link your passport to the SIM card.

Always keep in mind that changing SIM cards is useless, because both the SIM and the modem in your phone have a unique identifier. If you throw away the SIM card, you have to dispose of your phone as well.

Android ROM

Follow the installation instructions in the LineageOS Devices page for your device.

Flash TWRP first, then an official LineageOS build from their website. NEVER download or install an unofficial X DA -developer forums build, they're known to contain malware and trojans, especially from our neighbors in Russia.

Only use the official LineageOS build, and only the ones without gapps . This will disable the usage of the Google Play framework and services and you'll have to use F-Droid as an App Store, but we don't want to be spied upon anyways, right?

After successful installation of LineageOS, make sure to deactivate ADB and file transfer in the device's Developer Settings. Cellebrite UFED relies on that to transfer files, so it makes it a little harder for them in case they steal/take your phone from you. Don't use fingerprints for unlocking, because they can be faked/manufactured quite easily.

  • Open Settings App, scroll down and go to About Phone , then tap the Build Number 10 times to activate Developer Settings.
  • Open Settings App, scroll down and go to System , then go to Developer Options , then enable Use Developer Options .
  • Under the Debugging section, disable USB Debugging .
  • Under the USB section, open Default USB Configuration , then set it to No Data Transfer .

Android Apps

Never install SuperSU or Magisk . You don't need a rooted phone, it's a huge security risk and you're best to avoid it. A lot of spyware like Pegasus and Predator have support for exploiting the su command among other rootkit techniques. So you're reducing your attack surface by not installing a root privilege escalation App.

  • Install F-Droid which is an Open Source App Store.
  • Install NetGuard which is an Open Source Firewall.
  • Install Fennec which is an Open Source Firefox build.
  • Install the Fennec uBlock Origin extension.
  • Install the Fennec LocalCDN extension.
  • Inside the uBlock Origin Settings, synchronize/download the newest filter lists.
  • Install AppWarden and scan/audit/remove all known Trackers from your Apps.

Operational Security

After the FSB and GRU tried to luckystrike me in 2021, I'm taking my opsec pretty serious. Please do the same.

Here's a bullet point list of things you need to remember:

  • VPN s are kind of useless, the most popular ones are owned by the former Pegasus malware developers, also known as Kape Technologies.
  • If you insist on using a VPN , please use Mullvad VPN and pay them in cash with a letter.
  • Always keep in mind that VPN gateways make you uniquely identifiable due to how network latencies and network routing works.
  • Always treat your phone as a throwaway device.
  • Never use any Social Media on your phone.
  • Never add any family or real-life contacts on your phone.
  • Never store any password or 2FA generator on your phone.
  • Always use your phone in Airplane Mode, only activate the SIM card when necessary.
  • Never deactivate Airplane Mode when you're close to relatives or friends.
  • Deactivate Airplane Mode only inside the forest/jungle somewhere far away from your home.
  • Never connect the phone to another computer via USB .
  • Never enable ADB on your phone.
  • If possible, install OpenWRT on your router and use a separate guest Wi-Fi for your phones and IoT devices.