wireprot@clearnet: ~
$ cat /etc/identity operator: wireprot product: The Private Browsing Stack v1.1 pgp: C37E CE5E A0A9 7333 E387 F86B 04D5 2B77 F088 FFF1 $ _

The Private Browsing Stack

A practitioner's guide to building a Tor-to-ISP proxy chain with kernel-level traffic enforcement. No VPN trust required.

⚡ Monero Accepted ₿ Bitcoin Accepted 🔒 PGP-Signed Releases 💻 Self-Hosted BTCPay

What This Is

A complete build-along infrastructure manual for a privacy architecture that eliminates the VPN trust model entirely. Instead of trusting a VPN provider's "no logs" claim, you build a proxy chain: Tor exits to a residential ISP connection you control, enforced at the kernel level so leaks are structurally impossible.

Eight chapters with full source code. Every VPN logging incident is sourced to court records or verified reporting. The enforcement module is real nftables rules, not advisory suggestions.

What's Inside

  1. Why VPNs Fail — six documented logging incidents, sourced to court records
  2. The Proxy Chain Concept — architecture, trust model, threat surface
  3. Building the Chain Proxy — full proxy server implementation with source code
  4. Kernel Enforcement — nftables rules that make leaks structurally impossible
  5. Browser Automation — Kasm Workspaces for disposable browsing sessions
  6. Fingerprint Isolation — per-session identity separation
  7. Cluster Deployment — production k8s deployment (includes real-world security hardening)
  8. Verification & OpSec — tcpdump proofs, leak tests, operational discipline

Pricing

All tiers receive the same PDF. Tiers exist for early-bird pricing and optional consultation.

Launch
$49
Early-bird, limited inventory
Standard
$79
Regular price
Pro
$149
Same PDF + private consultation

Every tier gets the same book. No content gating. No upsells inside the PDF.

Purchase via Tor

Checkout runs on a self-hosted BTCPay Server behind a Tor onion service. You'll need the Tor Browser to complete your purchase.

🔒 Onion-only checkout. No JavaScript required. No account needed.
Open Store →
p67fs256gya5gyv23xwhettsg2fyvm4oqdyamgpoodnx32wjfhibg5qd.onion

Verify Authenticity

Every release is PGP-signed. The checksums file is detached-signed by the author's key. Verify before trusting any copy.

Author PGP fingerprint:
C37E CE5E A0A9 7333 E387 F86B 04D5 2B77 F088 FFF1
This is the same key used across all wireprot properties.
Verify it out-of-band before trusting any release.
Verification: 
gpg --import wireprot-public-key.asc
gpg --verify checksums.md5.asc checksums.md5
md5sum -c checksums.md5

Changelog

v1.1 — 2026-08-03

Security hardening: Chapter 7 (Cluster Deployment) rewritten after real-world deployment revealed an open proxy failure mode inherent to standard deployment patterns. Now includes nodeAffinity constraints, loopback-bound Tor, hostNetwork trap analysis, verification checks, and Prometheus alert rules. Anonymized real-world incident writeup included as a cautionary section.

v1.0 — 2026-08-03

Initial public release. 8 chapters, full source code, verified VPN logging incident citations. Tor-to-ISP proxy chain architecture with kernel-level nftables enforcement module and Kasm browser fingerprint isolation workflow.