Initial commit

2025-12-31 19:44:07 -07:00 · 2025-12-31 19:44:07 -07:00 · 319efece5f
commit 319efece5f
26 changed files with 3594 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,25 @@
+# Temp files
+*.tmp
+*.log
+*.swp
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor files
+.vscode/
+.idea/
+*.sublime-*
+
+# Test downloads
+downloads/
+*.deb
+*.rpm
+*.tar.gz
+*.zip
+
+# Local testing
+test-*
+scratch/
--- a/APT-TOOLS-VERSIONS.md
+++ b/APT-TOOLS-VERSIONS.md
@ -0,0 +1,127 @@
+# APT-Based Privacy Tools - Version Info
+
+## ✅ Current Versions (Debian Trixie)
+
+Based on check: 2025-11-12
+
+### OnionShare
+- **Debian Version**: 2.6.3-1 ✅
+- **Latest Upstream**: v2.6.3 (2025-02-25)
+- **Status**: **UP TO DATE** 🎉
+- **Recommendation**: Use apt version
+
+### Tor
+- **Debian Version**: 0.4.8.16-1
+- **Latest Stable**: 0.4.8.x series
+- **Status**: Current stable release
+- **Recommendation**: Debian apt is fine for most users
+- **Advanced**: Use Tor Project's repo for absolute latest
+
+### torsocks
+- **Debian Version**: 2.5.0-1
+- **Status**: Stable, mature project (slow release cycle)
+- **Recommendation**: apt version is fine
+
+### Other Tools
+
+| Tool | Debian Version | Notes |
+|------|---------------|-------|
+| keepassxc | Latest in Trixie | Well-maintained in Debian |
+| mat2 | Current | Part of Tails, actively maintained |
+| exiftool | Latest | Perl module, stable |
+| bleachbit | Current | Regular Debian updates |
+| firejail | Latest stable | Security-focused, backported updates |
+| age | Current | Simple tool, infrequent updates needed |
+| sherlock | Packaged | Python tool |
+
+## 🎯 Recommendations
+
+### Use APT for:
+✅ OnionShare (currently up to date!)
+✅ tor (unless you need bleeding edge)
+✅ torsocks
+✅ All other privacy tools listed
+✅ Automatic security updates via apt
+
+### Consider Upstream for:
+⚠️ Tor Browser - Use Tor Project's official package
+⚠️ Signal Desktop - Use official Signal .deb repo
+⚠️ Tools requiring latest features
+
+## 📦 Installation
+
+**Simple one-liner for all APT tools:**
+```bash
+cd ~/github/privacy-toolkit
+./install-apt-tools.sh
+```
+
+**Or manual:**
+```bash
+sudo apt install \
+  keepassxc age mat2 exiftool shred bleachbit \
+  tor torsocks onionshare onionshare-cli \
+  firejail sherlock
+```
+
+## 🔄 Update Strategy
+
+**For APT-managed tools:**
+```bash
+# Regular updates
+sudo apt update && sudo apt upgrade
+
+# Check for security updates
+sudo apt update && sudo apt list --upgradable
+```
+
+**Checking versions:**
+```bash
+# OnionShare
+onionshare-cli --version
+
+# Tor
+tor --version
+
+# mat2
+mat2 --version
+
+# KeePassXC
+keepassxc --version
+```
+
+## 🌐 Tor Project Repository (Optional)
+
+If you want the absolute latest Tor (usually not necessary):
+
+```bash
+# Add Tor Project repository
+sudo apt install -y apt-transport-https
+
+# Add GPG key
+wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
+
+# Add repo
+echo "deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/tor.list
+
+# Install
+sudo apt update
+sudo apt install tor torbrowser-launcher
+```
+
+## 📊 Summary
+
+**12+ privacy tools available via apt**
+- **Encryption**: keepassxc, age
+- **Metadata**: mat2, exiftool  
+- **Anonymity**: tor, torsocks, onionshare
+- **Security**: firejail, bleachbit
+- **OSINT**: sherlock
+
+**Benefit**: Single update command, dependency management, security patches
+
+---
+
+**Last Updated**: 2025-11-12
+**Debian Version**: Trixie (testing)
+**OnionShare**: ✅ Up to date!
--- a/README.md
+++ b/README.md
@ -0,0 +1,134 @@
+# 🛡️ Privacy Toolkit
+
+**A curated collection of privacy-focused tools with automated installation scripts**
+
+## 🎯 Mission
+
+Provide easy-to-install, well-documented privacy tools that protect against common threats:
+- Surveillance and tracking
+- Data breaches and leaks
+- Malicious documents and files
+- Metadata exposure
+- Network monitoring
+
+## 🚀 Quick Start
+
+```bash
+# Clone the repository
+git clone https://github.com/YOUR_USERNAME/privacy-toolkit.git
+cd privacy-toolkit
+
+# Install a specific tool
+./tools/dangerzone/install.sh
+
+# Or use the master installer (coming soon)
+./install.sh
+```
+
+## 📦 Available Tools
+
+### 🎯 Priority Tools (Install First)
+1. **[Dangerzone](tools/dangerzone/)** - Document sanitization ✅
+2. **[LibreWolf](tools/librewolf/)** - Privacy-focused Firefox fork ✅
+3. **mat2** - Metadata removal (via apt-tools)
+4. **Signal Desktop** - Secure messaging (coming soon)
+5. **Tor Browser** - Anonymous browsing (coming soon)
+6. **BleachBit** - Secure deletion (via apt-tools)
+7. **firejail** - App sandboxing (via apt-tools)
+
+See [TOOLS-LIST.md](TOOLS-LIST.md) for the complete list of planned tools.
+
+## 🗂️ Categories
+
+- **Document Sanitization**: Remove malware and tracking from files
+- **Encryption & Storage**: Protect data at rest
+- **Secure Communication**: Private messaging and calls
+- **Anonymity & Network**: Browse and communicate anonymously
+- **Metadata Removal**: Strip identifying information
+- **Secure Deletion**: Permanently erase sensitive data
+- **Password Management**: Secure credential storage
+- **Email Privacy**: Encrypted email communication
+- **System Hardening**: Lock down your system
+- **DNS Privacy**: Prevent DNS surveillance
+
+## 🔧 Installation Script Features
+
+Each tool installation script includes:
+- ✅ Distro detection (Debian/Ubuntu/Fedora/Arch)
+- ✅ GPG key verification
+- ✅ Dependency checking
+- ✅ Post-install verification
+- ✅ Usage examples
+- ✅ Security best practices
+
+## 📖 Documentation
+
+Each tool includes:
+- **README.md**: What it does and why you need it
+- **install.sh**: Automated installation
+- **Threat model**: What attacks it protects against
+- **Usage examples**: How to use it effectively
+
+## 🤝 Contributing
+
+Privacy tools to suggest? Found a bug? Contributions welcome!
+
+1. Fork the repository
+2. Create a feature branch
+3. Follow the tool template structure
+4. Submit a pull request
+
+## 🔒 Security Principles
+
+- **FOSS First**: Open source tools are auditable
+- **Official Sources**: Install from official repositories when possible
+- **Signature Verification**: Always verify GPG signatures
+- **Minimal Trust**: Reduce trust in third parties
+- **Defense in Depth**: Layer multiple tools for comprehensive protection
+
+## 📚 Learning Resources
+
+- [Threat Modeling Guide](docs/threat-modeling.md) (coming soon)
+- [Privacy Best Practices](docs/best-practices.md) (coming soon)
+- [Tool Verification Guide](docs/verification.md) (coming soon)
+
+## ⚖️ License
+
+MIT License - See [LICENSE](LICENSE) for details
+
+## 🙏 Acknowledgments
+
+- Freedom of the Press Foundation (Dangerzone)
+- The Tor Project
+- Signal Foundation
+- All FOSS privacy tool developers
+
+---
+
+**Status**: 🚧 Work in Progress
+**Tools Completed**: 8/30+
+**Last Updated**: 2025-12-21
+
+💡 **Remember**: Privacy is a process, not a product. These tools help, but conscious behavior matters more.
+
+## 🔐 Security Best Practices
+
+### Always Verify Signatures and Checksums!
+
+Before installing ANY security software:
+
+1. **Download signature files** (.asc, .sig)
+2. **Import developer's GPG key**
+3. **Verify fingerprint** against official website
+4. **Check SHA256 checksum**
+5. **Verify GPG signature**
+
+Example verification workflow documented in tool directories (see `tools/cryptomator/VERIFICATION.md`).
+
+**Red flags - DO NOT INSTALL:**
+- ❌ No signature file available
+- ❌ Fingerprint mismatch
+- ❌ "BAD signature" from GPG
+- ❌ Checksum mismatch
+- ❌ Download from unofficial source
+
--- a/SESSION-NOTES.md
+++ b/SESSION-NOTES.md
@ -0,0 +1,135 @@
+# Privacy Toolkit - Session Notes
+
+## 2025-11-12 - Initial Repository Setup
+
+### 🎯 What We Built
+
+Created a modular privacy toolkit with automated installation scripts for security-focused tools.
+
+### ✅ Completed Tools (5)
+
+1. **Dangerzone** - Document sanitization (Freedom of Press Foundation)
+   - Container-based PDF/Office sanitization
+   - Includes GPG keyring permission fix
+   - Full threat model documentation
+
+2. **croc** - Secure P2P file transfer
+   - PAKE-based encryption
+   - Simple curl | bash installation
+
+3. **age** - Modern file encryption
+   - Simpler than GPG
+   - Installed via apt
+
+4. **VeraCrypt** - Full disk encryption
+   - Encrypted containers and full disk encryption
+   - Launchpad .deb download
+   - Version 1.26.7
+
+5. **Cryptomator** - Cloud storage encryption
+   - Client-side encryption for cloud files
+   - Interactive .deb vs AppImage choice
+   - **Includes full verification guide** (GPG + SHA256)
+
+### 📁 Repository Structure
+
+```
+privacy-toolkit/
+├── README.md                      # Main documentation
+├── TOOLS-LIST.md                  # Progress checklist
+├── TOOLS-REFERENCE.md             # Detailed tool descriptions
+├── SESSION-NOTES.md               # This file
+└── tools/
+    ├── age/
+    │   └── install.sh
+    ├── croc/
+    │   └── install.sh
+    ├── cryptomator/
+    │   ├── install.sh
+    │   └── VERIFICATION.md        # GPG verification guide
+    ├── dangerzone/
+    │   ├── install.sh
+    │   └── README.md
+    └── veracrypt/
+        └── install.sh
+```
+
+### 🔐 Key Features
+
+- **Modular Design**: Each tool is self-contained
+- **Security-First**: GPG verification, checksums, official sources
+- **Educational**: Threat models explain WHY you need each tool
+- **Consistent**: Same script structure across all tools
+- **Practical**: Real-world verification example for Cryptomator
+
+### 🎓 Security Practices Documented
+
+Example verification workflow (Cryptomator):
+1. Download .deb + .asc signature
+2. Import GPG key
+3. Verify fingerprint: `5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235`
+4. Check SHA256 checksum
+5. Verify GPG signature
+6. Install if all checks pass
+
+### 📊 Status
+
+- **Tools Completed**: 5/30+
+- **Priority Tools**: 1/6 (Dangerzone)
+- **Documentation**: Comprehensive for completed tools
+- **Git**: Not yet initialized (ready to be)
+
+### 🎯 Next Steps
+
+Potential additions:
+- mat2 (metadata removal)
+- Signal Desktop
+- Tor Browser
+- BleachBit
+- firejail
+- OnionShare
+- ExifTool
+
+### 💡 Design Decisions
+
+1. **Cryptomator: .deb vs AppImage**
+   - Script offers choice
+   - Recommendation: .deb for better system integration
+   - AppImage for portability
+
+2. **VeraCrypt: Version locking**
+   - Hardcoded 1.26.7 for stability
+   - Manual update recommended over auto-latest
+
+3. **Dangerzone: GPG keyring fix**
+   - Includes chmod 644 fix for /etc/apt/keyrings/
+   - Solves permission denied error
+
+### 🔗 Resources
+
+- Official Cryptomator releases: https://github.com/cryptomator/cryptomator/releases
+- Dangerzone: https://dangerzone.rocks/
+- VeraCrypt: https://veracrypt.fr/
+- Age: https://github.com/FiloSottile/age
+- Croc: https://github.com/schollz/croc
+
+---
+
+**Created**: 2025-11-12
+**Tools**: 5 complete, 25+ planned
+**Focus**: Security, privacy, encryption, sanitization
+
+## SimpleX Installation Discovery
+
+**Issue**: SimpleX .deb packages have library compatibility issues across multiple distros.
+
+**Confirmed broken:**
+- Debian Trixie: Crashes with `SIGSEGV in libHSzstd`
+- Pop!_OS: Required AppImage
+
+**Solution**: Always use AppImage for SimpleX
+- Script: `tools/simplex/install-appimage.sh`
+- Location: `~/.local/bin/SimpleX.AppImage`
+- Works universally across distros
+
+**Lesson**: For complex cross-platform apps with many dependencies, prefer AppImage over distro-specific packages.
--- a/TOOLS-LIST.md
+++ b/TOOLS-LIST.md
@ -0,0 +1,92 @@
+# Privacy Toolkit - Tool Candidates
+
+This is our working list of privacy tools to include in the toolkit.
+
+## 🎯 Priority 1 (Core Privacy Tools)
+- [x] **Dangerzone** - Document sanitization ✅
+- [ ] **mat2** - Metadata removal
+- [ ] **Signal Desktop** - Secure messaging
+- [ ] **Tor Browser** - Anonymous browsing
+- [ ] **BleachBit** - Secure deletion
+- [ ] **firejail** - App sandboxing
+
+## 🛡️ Document Sanitization
+- [x] **Dangerzone** - PDF/Office document sanitizer using container isolation ✅
+- [ ] **ExifCleaner** - Metadata removal from images/PDFs/videos
+- [ ] **mat2** - Metadata Anonymization Toolkit
+
+## 🔐 Encryption & Secure Storage
+- [x] **VeraCrypt** - Full disk encryption and encrypted containers ✅
+- [x] **age** - Modern file encryption ✅
+- [x] **Cryptomator** - Client-side cloud storage encryption ✅
+
+## 📂 Secure File Transfer
+- [x] **croc** - Secure, fast P2P file transfer ✅
+
+## 📡 Secure Communication
+- [ ] **Signal Desktop** - E2E encrypted messaging
+- [ ] **SimpleX** - E2E encrypted messaging without identifiers (documented in PAI)
+- [ ] **Jami** - P2P encrypted video/audio calls
+
+## 🌐 Anonymity & Network Privacy
+- [ ] **Tor Browser** - Anonymous web browsing
+- [ ] **ProtonVPN** - Privacy-focused VPN (already installed)
+- [ ] **OnionShare** - Anonymous file sharing over Tor
+
+## 🔍 Metadata & Privacy Analysis
+- [ ] **ExifTool** - View/edit metadata in files
+- [ ] **Sherlock** - Username enumeration across platforms
+
+## 🗑️ Secure Deletion
+- [ ] **BleachBit** - Secure file deletion and system cleaning
+- [ ] **shred** - Overwrite files securely (already installed)
+
+## 🔒 Password & Secret Management
+- [ ] **KeePassXC** - Offline password manager (already in use)
+- [ ] **Bitwarden** - Open source password manager (self-hostable)
+
+## 📧 Email Privacy
+- [ ] **Thunderbird + Enigmail** - PGP email encryption
+- [ ] **ProtonMail Bridge** - Use ProtonMail with desktop clients
+
+## 🛡️ System Hardening
+- [ ] **firejail** - Application sandboxing
+- [ ] **AppArmor** - Mandatory Access Control (built into Debian)
+
+## 🌐 DNS Privacy
+- [ ] **dnscrypt-proxy** - Encrypted DNS queries
+- [ ] **Unbound** - Validating DNS resolver
+
+## 📱 Mobile Companion Tools
+- [ ] **scrcpy** - Control Android via ADB
+
+---
+
+**Last Updated:** 2025-11-12
+**Tools Completed:** 5/30+ (Dangerzone, croc, age, VeraCrypt, Cryptomator)
+**Priority Tools:** 1/6
+
+---
+
+## 📦 APT-Based Tools (Quick Install)
+
+Many privacy tools are available directly via apt! Run:
+```bash
+./install-apt-tools.sh
+```
+
+**APT Tools Included:**
+- [x] **keepassxc** - Password manager ✅
+- [x] **age** - File encryption ✅  
+- [x] **mat2** - Metadata removal ✅
+- [x] **exiftool** - EXIF metadata viewer/editor ✅
+- [x] **bleachbit** - Secure deletion ✅
+- [x] **firejail** - App sandboxing ✅
+- [x] **tor** - Anonymity network ✅
+- [x] **torsocks** - Torify applications ✅
+- [x] **onionshare** - Anonymous file sharing ✅
+- [x] **sherlock** - Username enumeration ✅
+
+**Note**: OnionShare 2.6.3 in Debian is **up to date** with latest release! 🎉
+
+See [APT-TOOLS-VERSIONS.md](APT-TOOLS-VERSIONS.md) for version details.
--- a/TOOLS-REFERENCE.md
+++ b/TOOLS-REFERENCE.md
@ -0,0 +1,189 @@
+# Privacy Toolkit - Tool Candidates
+
+## 🛡️ Document Sanitization
+- **Dangerzone** - PDF/Office document sanitizer using container isolation
+  - Threat: Malicious documents with embedded exploits
+  - Status: Installation script ready (needs chmod fix for GPG key)
+  - Source: Freedom of the Press Foundation
+  - Platform: Linux (Debian/Ubuntu/Fedora)
+
+- **ExifCleaner** - Metadata removal from images/PDFs/videos
+  - Threat: EXIF data leaking location, camera info, timestamps
+  - Source: https://github.com/szTheory/exifcleaner
+  - Platform: Cross-platform (AppImage for Linux)
+
+- **mat2** (Metadata Anonymization Toolkit)
+  - Threat: Document metadata revealing identity/system info
+  - Source: apt package, part of Tails
+  - Platform: Linux
+
+## 🔐 Encryption & Secure Storage
+- **VeraCrypt** - Full disk encryption and encrypted containers
+  - Threat: Physical device seizure, data theft
+  - Status: Already in use
+  - Source: https://veracrypt.fr
+  - Platform: Cross-platform
+
+- **age** - Modern file encryption (simpler than GPG)
+  - Threat: Sensitive files at rest
+  - Source: https://github.com/FiloSottile/age
+  - Platform: Cross-platform, Go binary
+
+- **Cryptomator** - Client-side cloud storage encryption
+  - Threat: Cloud provider access to files
+  - Source: https://cryptomator.org
+  - Platform: Cross-platform
+
+## 📡 Secure Communication
+- **Signal Desktop** - E2E encrypted messaging
+  - Threat: Message interception, surveillance
+  - Source: https://signal.org
+  - Platform: Linux (official .deb)
+
+- **SimpleX** - E2E encrypted messaging without identifiers
+  - Threat: Metadata correlation, phone number linking
+  - Status: Already documented in PAI
+  - Source: https://simplex.chat
+  - Platform: Cross-platform
+
+- **Jami** - P2P encrypted video/audio calls
+  - Threat: Centralized communication surveillance
+  - Source: https://jami.net
+  - Platform: Cross-platform
+
+## 🌐 Anonymity & Network Privacy
+- **Tor Browser** - Anonymous web browsing
+  - Threat: IP tracking, browser fingerprinting
+  - Source: https://torproject.org
+  - Platform: Cross-platform
+
+- **ProtonVPN** - Privacy-focused VPN
+  - Status: Already installed
+  - Source: https://protonvpn.com
+  - Platform: Cross-platform
+
+- **OnionShare** - Anonymous file sharing over Tor
+  - Threat: File transfer metadata, IP exposure
+  - Source: https://onionshare.org
+  - Platform: Cross-platform
+
+## 🔍 Metadata & Privacy Analysis
+- **ExifTool** - View/edit metadata in files
+  - Threat: Understanding what metadata you're leaking
+  - Source: apt package
+  - Platform: Cross-platform
+
+- **Sherlock** - Username enumeration across platforms
+  - Threat: Understanding your digital footprint
+  - Source: https://github.com/sherlock-project/sherlock
+  - Platform: Python tool
+
+## 🗑️ Secure Deletion
+- **BleachBit** - Secure file deletion and system cleaning
+  - Threat: Forensic recovery of deleted files
+  - Source: apt package
+  - Platform: Linux/Windows
+
+- **shred** - Overwrite files securely
+  - Threat: File recovery after deletion
+  - Source: GNU coreutils (already installed)
+  - Platform: Linux
+
+## 🔒 Password & Secret Management
+- **KeePassXC** - Offline password manager
+  - Status: Already in use
+  - Source: https://keepassxc.org
+  - Platform: Cross-platform
+
+- **Bitwarden** - Open source password manager (self-hostable)
+  - Threat: Password reuse, weak passwords
+  - Source: https://bitwarden.com
+  - Platform: Cross-platform + self-hosted
+
+## 📧 Email Privacy
+- **Thunderbird + Enigmail** - PGP email encryption
+  - Threat: Email content surveillance
+  - Source: apt package
+  - Platform: Cross-platform
+
+- **ProtonMail Bridge** - Use ProtonMail with desktop clients
+  - Threat: Email metadata, provider access
+  - Source: https://proton.me
+  - Platform: Cross-platform
+
+## 🛡️ System Hardening
+- **firejail** - Application sandboxing
+  - Threat: Application exploits compromising system
+  - Source: apt package
+  - Platform: Linux
+
+- **AppArmor** - Mandatory Access Control
+  - Threat: Privilege escalation
+  - Source: Built into Debian
+  - Platform: Linux
+
+## 🌐 DNS Privacy
+- **dnscrypt-proxy** - Encrypted DNS queries
+  - Threat: DNS surveillance, ISP tracking
+  - Source: https://github.com/DNSCrypt/dnscrypt-proxy
+  - Platform: Cross-platform
+
+- **Unbound** - Validating DNS resolver
+  - Threat: DNS spoofing, MITM
+  - Source: apt package
+  - Platform: Linux
+
+## 📱 Mobile Companion Tools
+- **scrcpy** - Control Android via ADB (for testing privacy apps)
+  - Source: apt package
+  - Platform: Linux/Windows/macOS
+
+## 🎯 Priority Tools (Install First)
+1. Dangerzone - Document sanitization
+2. mat2 - Metadata removal
+3. Signal Desktop - Secure messaging
+4. Tor Browser - Anonymous browsing
+5. BleachBit - Secure deletion
+6. firejail - App sandboxing
+
+## 📁 Repository Structure Proposal
+```
+privacy-toolkit/
+├── README.md                          # Overview, threat model intro
+├── install.sh                         # Master handler script
+├── tools/
+│   ├── dangerzone/
+│   │   ├── install.sh                # Individual install script
+│   │   ├── README.md                 # What it does, why you need it
+│   │   └── verify.sh                 # Post-install verification
+│   ├── mat2/
+│   │   ├── install.sh
+│   │   ├── README.md
+│   │   └── examples/                 # Usage examples
+│   ├── signal-desktop/
+│   └── tor-browser/
+├── categories.md                      # Tools organized by threat model
+├── threat-models.md                   # Common threat scenarios
+└── docs/
+    ├── installation-guide.md
+    ├── verification-guide.md          # How to verify tools work
+    └── threat-modeling.md             # Help users choose tools
+```
+
+## 🔧 Installation Script Template
+Each tool should have:
+- Distro detection (Debian/Ubuntu/Fedora/Arch)
+- GPG key verification (with chmod fix for keyrings!)
+- Dependency checking
+- Version verification
+- Post-install testing
+- Cleanup on failure
+- Usage examples
+
+## 📝 Notes
+- Focus on FOSS tools (auditability)
+- Prefer official repositories
+- Include threat model for each tool
+- Provide usage examples
+- Link to official documentation
+- Security-focused: verify signatures, check hashes
--- a/install-apt-tools.sh
+++ b/install-apt-tools.sh
@ -0,0 +1,201 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Privacy Toolkit - APT-based Tools Installation
+# ==============================================================================
+# Installs all privacy tools available via apt repositories
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly BLUE='\033[0;34m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+section() { echo -e "${BLUE}=== $* ===${NC}"; }
+
+# APT-based privacy tools organized by category
+declare -A TOOLS=(
+    # Encryption & Password Management
+    ["keepassxc"]="Offline password manager"
+    ["age"]="Modern file encryption"
+    
+    # Metadata & Privacy
+    ["mat2"]="Metadata Anonymization Toolkit"
+    ["exiftool"]="EXIF metadata editor"
+    
+    # Secure Deletion
+    ["shred"]="Secure file overwriting (from coreutils)"
+    ["bleachbit"]="System cleaning and secure deletion"
+    
+    # Network Privacy & Anonymity
+    ["tor"]="Tor anonymity network daemon"
+    ["torsocks"]="Torify applications"
+    ["onionshare"]="Anonymous file sharing over Tor (GUI)"
+    ["onionshare-cli"]="Anonymous file sharing over Tor (CLI)"
+    
+    # System Hardening
+    ["firejail"]="Application sandboxing"
+    
+    # OSINT & Privacy Analysis
+    ["sherlock"]="Username enumeration tool"
+)
+
+section "Privacy Toolkit - APT Tools Installation"
+echo ""
+
+log "Updating package lists..."
+sudo apt update
+
+echo ""
+section "Available Privacy Tools"
+echo ""
+
+# Show tools
+for tool in "${!TOOLS[@]}"; do
+    echo "  • $tool - ${TOOLS[$tool]}"
+done
+
+echo ""
+read -p "Install all tools? [Y/n] " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ -n $REPLY ]]; then
+    log "Installation cancelled"
+    exit 0
+fi
+
+echo ""
+section "Installing Tools"
+echo ""
+
+# Track installation results
+installed=()
+already_installed=()
+failed=()
+
+for tool in "${!TOOLS[@]}"; do
+    if dpkg -l | grep -q "^ii  $tool "; then
+        log "✓ $tool already installed"
+        already_installed+=("$tool")
+    else
+        log "Installing $tool..."
+        if sudo apt install -y "$tool" 2>&1 | grep -q "Unable to locate package"; then
+            warn "⚠ $tool not available in repositories"
+            failed+=("$tool")
+        else
+            log "✅ $tool installed"
+            installed+=("$tool")
+        fi
+    fi
+done
+
+echo ""
+section "Installation Summary"
+echo ""
+
+if [ ${#installed[@]} -gt 0 ]; then
+    echo "✅ Newly installed (${#installed[@]}):"
+    for tool in "${installed[@]}"; do
+        echo "   • $tool"
+    done
+    echo ""
+fi
+
+if [ ${#already_installed[@]} -gt 0 ]; then
+    echo "✓ Already installed (${#already_installed[@]}):"
+    for tool in "${already_installed[@]}"; do
+        echo "   • $tool"
+    done
+    echo ""
+fi
+
+if [ ${#failed[@]} -gt 0 ]; then
+    echo "⚠ Failed/Not available (${#failed[@]}):"
+    for tool in "${failed[@]}"; do
+        echo "   • $tool"
+    done
+    echo ""
+fi
+
+section "Versions"
+echo ""
+
+# Show versions for key tools
+echo "OnionShare: $(apt-cache policy onionshare | grep Candidate | awk '{print $2}')"
+echo "Tor: $(apt-cache policy tor | grep Candidate | awk '{print $2}')"
+echo "mat2: $(dpkg -l | grep "^ii  mat2 " | awk '{print $3}' || echo 'not installed')"
+echo "KeePassXC: $(dpkg -l | grep "^ii  keepassxc " | awk '{print $3}' || echo 'not installed')"
+
+echo ""
+section "Quick Usage Examples"
+echo ""
+
+cat << 'USAGE'
+OnionShare:
+  # Share a file anonymously
+  onionshare-cli /path/to/file
+  
+  # Receive files anonymously
+  onionshare-cli --receive
+
+mat2:
+  # Remove metadata from file
+  mat2 document.pdf
+  
+  # Clean entire directory
+  mat2 --inplace *.jpg
+
+Tor + torsocks:
+  # Run command through Tor
+  torsocks curl https://check.torproject.org/
+  
+  # Torify an application
+  torsocks firefox
+
+firejail:
+  # Sandbox an application
+  firejail firefox
+  
+  # Sandbox with no network
+  firejail --net=none risky-app
+
+ExifTool:
+  # View metadata
+  exiftool image.jpg
+  
+  # Strip all metadata
+  exiftool -all= image.jpg
+
+KeePassXC:
+  # Launch GUI
+  keepassxc
+  
+  # CLI (if available)
+  keepassxc-cli
+
+age:
+  # Generate key
+  age-keygen -o key.txt
+  
+  # Encrypt file
+  age -e -r <public-key> file.txt > file.txt.age
+  
+  # Decrypt file
+  age -d -i key.txt file.txt.age > file.txt
+
+USAGE
+
+echo ""
+section "Installation Complete!"
+echo ""
+
+log "📚 For detailed usage, see:"
+log "  - OnionShare: https://docs.onionshare.org/"
+log "  - Tor: https://tb-manual.torproject.org/"
+log "  - mat2: https://0xacab.org/jvoisin/mat2"
+log "  - KeePassXC: https://keepassxc.org/docs/"
+
+echo ""
--- a/tools/age/install.sh
+++ b/tools/age/install.sh
@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Age Installation Script
+# ==============================================================================
+# Installs age - Modern, simple file encryption
+# 
+# Threat Model:
+#   - Files at rest without encryption (laptop theft, cloud breaches)
+#   - GPG complexity leading to misconfiguration
+#   - Key management nightmares
+#
+# Why Age over GPG:
+#   - Simple: One algorithm, no configuration options
+#   - Modern: ChaCha20-Poly1305 encryption
+#   - Small: Tiny keys and ciphertext overhead
+#   - Fast: Optimized for modern processors
+#
+# Source: https://github.com/FiloSottile/age
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+
+echo "=== Age Installation ==="
+echo ""
+
+log "Installing age from Debian repository..."
+sudo apt update
+sudo apt install -y age
+
+echo ""
+log "Verifying installation..."
+age --version
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Quick Start:"
+echo ""
+echo "  Generate a key pair:"
+echo "    age-keygen -o key.txt"
+echo "    # Save this file securely! It's your private key"
+echo ""
+echo "  Encrypt a file:"
+echo "    age -e -r \$(cat key.txt | grep 'public key' | cut -d: -f2) file.txt > file.txt.age"
+echo ""
+echo "  Or use recipient's public key:"
+echo "    age -e -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p file.txt > file.txt.age"
+echo ""
+echo "  Decrypt a file:"
+echo "    age -d -i key.txt file.txt.age > file.txt"
+echo ""
+echo "  Password-based encryption (no keys needed):"
+echo "    age -p file.txt > file.txt.age"
+echo "    age -d file.txt.age > file.txt"
+echo ""
+echo "📖 Documentation: https://github.com/FiloSottile/age"
--- a/tools/cloudflare-warp/install.sh
+++ b/tools/cloudflare-warp/install.sh
@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+
+#################################################################################
+# Cloudflare WARP Installation Script
+#
+# Installs Cloudflare WARP client for encrypted DNS and private routing
+#
+# Features:
+# - Encrypted DNS (1.1.1.1 with WARP)
+# - Optional VPN-like routing through Cloudflare network
+# - Prevents ISP DNS snooping
+#
+# Usage modes:
+# - warp-cli connect        # Connect to WARP
+# - warp-cli disconnect     # Disconnect
+# - warp-cli status         # Check status
+# - warp-cli set-mode warp  # Full WARP (VPN-like)
+# - warp-cli set-mode doh   # DNS-over-HTTPS only
+#
+# Note: Free tier available, paid WARP+ for faster speeds
+#################################################################################
+
+set -euo pipefail
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${CYAN}  Cloudflare WARP Installation${NC}"
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+
+# Check if already installed
+if command -v warp-cli &>/dev/null; then
+    echo -e "${YELLOW}Cloudflare WARP is already installed${NC}"
+    warp-cli --version
+    echo ""
+    read -p "Reinstall? [y/N] " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo -e "${GREEN}Skipping installation${NC}"
+        exit 0
+    fi
+fi
+
+# Detect distro
+if [[ -f /etc/os-release ]]; then
+    . /etc/os-release
+    DISTRO_ID="${ID:-unknown}"
+    DISTRO_CODENAME="${VERSION_CODENAME:-$(lsb_release -cs 2>/dev/null || echo 'unknown')}"
+else
+    echo -e "${RED}Cannot detect distribution${NC}"
+    exit 1
+fi
+
+echo -e "${GREEN}Detected:${NC} $DISTRO_ID ($DISTRO_CODENAME)"
+echo ""
+
+# Handle Debian trixie/sid -> use bookworm packages
+case "$DISTRO_CODENAME" in
+    trixie|sid|testing)
+        echo -e "${YELLOW}Note: Using bookworm packages for $DISTRO_CODENAME${NC}"
+        DISTRO_CODENAME="bookworm"
+        ;;
+esac
+
+# Add Cloudflare GPG key
+echo -e "${GREEN}[1/4]${NC} Adding Cloudflare GPG key..."
+curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
+
+# Fix permissions (must be world-readable for apt)
+sudo chmod 644 /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
+
+# Add repository
+echo -e "${GREEN}[2/4]${NC} Adding Cloudflare repository..."
+echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${DISTRO_CODENAME} main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list > /dev/null
+
+# Update and install
+echo -e "${GREEN}[3/4]${NC} Updating package lists..."
+sudo apt-get update
+
+echo -e "${GREEN}[4/4]${NC} Installing cloudflare-warp..."
+sudo apt-get install -y cloudflare-warp
+
+echo ""
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}✓${NC} Cloudflare WARP installed successfully"
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+echo -e "${YELLOW}First-time setup:${NC}"
+echo -e "  ${CYAN}warp-cli registration new${NC}  # Register device (one-time)"
+echo -e "  ${CYAN}warp-cli connect${NC}           # Connect to WARP"
+echo ""
+echo -e "${YELLOW}Common commands:${NC}"
+echo -e "  ${CYAN}warp-cli status${NC}            # Check connection status"
+echo -e "  ${CYAN}warp-cli disconnect${NC}        # Disconnect"
+echo -e "  ${CYAN}warp-cli set-mode doh${NC}      # DNS-over-HTTPS only (no VPN)"
+echo -e "  ${CYAN}warp-cli set-mode warp${NC}     # Full WARP routing"
+echo ""
--- a/tools/croc/install.sh
+++ b/tools/croc/install.sh
@ -0,0 +1,67 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Croc Installation Script
+# ==============================================================================
+# Installs croc - Secure, fast file transfer tool
+# 
+# Threat Model:
+#   - Insecure file transfer methods (email, Dropbox, USB drives)
+#   - Cloud storage snooping and data breaches
+#   - Man-in-the-middle attacks during file transfer
+#   - Metadata exposure in file sharing
+#
+# How Croc Protects:
+#   - End-to-end encryption using PAKE (Password Authenticated Key Exchange)
+#   - No account or login required
+#   - Direct peer-to-peer transfer (optional relay for NAT traversal)
+#   - Automatic compression
+#   - Resume capability for interrupted transfers
+#
+# Source: https://github.com/schollz/croc
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+
+echo "=== Croc Installation ==="
+echo ""
+
+log "Downloading and installing croc..."
+curl https://getcroc.schollz.com | bash
+
+echo ""
+log "Verifying installation..."
+if command -v croc >/dev/null 2>&1; then
+    log "✅ Croc installed successfully!"
+    croc --version
+else
+    warn "Croc not found in PATH - may need to add ~/.local/bin to PATH"
+    exit 1
+fi
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Usage Examples:"
+echo ""
+echo "  Send a file:"
+echo "    croc send myfile.pdf"
+echo "    # Share the code phrase with recipient"
+echo ""
+echo "  Receive a file:"
+echo "    croc 1234-code-word-phrase"
+echo ""
+echo "  Send entire directory:"
+echo "    croc send /path/to/folder"
+echo ""
+echo "  Custom code phrase:"
+echo "    croc send --code my-secret-phrase file.txt"
+echo ""
+echo "📖 Documentation: https://github.com/schollz/croc"
--- a/tools/cryptomator/VERIFICATION.md
+++ b/tools/cryptomator/VERIFICATION.md
@ -0,0 +1,112 @@
+# Cryptomator Installation Verification Guide
+
+## 🔐 Verify Before Installing
+
+**ALWAYS verify cryptographic signatures and checksums before installing security software!**
+
+### Step 1: Download Files
+
+Download both the .deb package AND the .asc signature file from:
+https://github.com/cryptomator/cryptomator/releases
+
+Example for version 1.18.0:
+```bash
+wget https://github.com/cryptomator/cryptomator/releases/download/1.18.0/cryptomator_1.18.0-0ppa1_amd64.deb
+wget https://github.com/cryptomator/cryptomator/releases/download/1.18.0/cryptomator_1.18.0-0ppa1_amd64.deb.asc
+```
+
+### Step 2: Import Cryptomator GPG Key
+
+```bash
+# Import the official Cryptomator release key
+gpg --keyserver keyserver.ubuntu.com --recv-keys 615D449FE6E6A235
+
+# Verify the fingerprint matches official:
+gpg --fingerprint 58117AFA1F85B3EEC154677D615D449FE6E6A235
+```
+
+**Expected fingerprint:**
+```
+5811 7AFA 1F85 B3EE C154  677D 615D 449F E6E6 A235
+```
+
+**If the fingerprint doesn't match, DO NOT INSTALL!**
+
+### Step 3: Verify SHA256 Checksum
+
+Get the SHA256 from the GitHub release page, then verify:
+
+```bash
+sha256sum -c <<< "9fcb87e21ef563820930fdc42daff6d0c9c1b1d7b8b6e8ab6d47c8d7fdee625d cryptomator_1.18.0-0ppa1_amd64.deb"
+```
+
+Expected output:
+```
+cryptomator_1.18.0-0ppa1_amd64.deb: OK
+```
+
+### Step 4: Verify GPG Signature
+
+```bash
+gpg --verify cryptomator_1.18.0-0ppa1_amd64.deb.asc cryptomator_1.18.0-0ppa1_amd64.deb
+```
+
+Expected output:
+```
+gpg: Good signature from "Cryptobot <releases@cryptomator.org>" [unknown]
+```
+
+**The "unknown" trust is fine** - it just means you haven't personally signed their key. The important parts:
+- ✅ "Good signature"
+- ✅ Fingerprint matches official
+- ✅ Signature date is reasonable (not from years ago)
+
+### Step 5: Install
+
+```bash
+sudo dpkg -i cryptomator_1.18.0-0ppa1_amd64.deb
+```
+
+## 🚨 Red Flags (DO NOT INSTALL if you see these)
+
+- ❌ Fingerprint mismatch
+- ❌ "BAD signature"
+- ❌ "No public key" (key import failed)
+- ❌ Checksum mismatch
+- ❌ Can't download .asc file (unsigned package)
+
+## 📖 Official Resources
+
+- Release Downloads: https://github.com/cryptomator/cryptomator/releases
+- GPG Key Info: https://github.com/cryptomator/cryptomator/blob/develop/GPG-KEY.md
+- Security Advisory: https://cryptomator.org/security/
+
+## ✅ Verification Example (Real Output)
+
+```
+❯ sha256sum -c <<< "9fcb87e21ef563820930fdc42daff6d0c9c1b1d7b8b6e8ab6d47c8d7fdee625d cryptomator_1.18.0-0ppa1_amd64.deb"
+cryptomator_1.18.0-0ppa1_amd64.deb: OK
+
+❯ gpg --fingerprint 58117AFA1F85B3EEC154677D615D449FE6E6A235
+pub   rsa4096 2020-08-18 [SC] [expires: 2031-01-01]
+      5811 7AFA 1F85 B3EE C154  677D 615D 449F E6E6 A235
+uid           [ unknown] Cryptobot <releases@cryptomator.org>
+
+❯ gpg --verify cryptomator_1.18.0-0ppa1_amd64.deb.asc cryptomator_1.18.0-0ppa1_amd64.deb
+gpg: Signature made Wed 12 Nov 2025 09:29:25 AM MST
+gpg:                using RSA key 58117AFA1F85B3EEC154677D615D449FE6E6A235
+gpg: Good signature from "Cryptobot <releases@cryptomator.org>" [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg:          There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 5811 7AFA 1F85 B3EE C154  677D 615D 449F E6E6 A235
+```
+
+✅ All checks passed - safe to install!
+
+---
+
+**Remember**: This verification process protects you from:
+- Corrupted downloads
+- Man-in-the-middle attacks
+- Compromised mirrors
+- Trojanized packages
--- a/tools/cryptomator/install.sh
+++ b/tools/cryptomator/install.sh
@ -0,0 +1,125 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Cryptomator Installation Script
+# ==============================================================================
+# Installs Cryptomator - Client-side cloud storage encryption
+# 
+# Threat Model:
+#   - Cloud provider snooping (Dropbox, Google Drive, etc.)
+#   - Data breaches exposing cloud files
+#   - Government data requests to cloud providers
+#   - Cloud employee access to files
+#
+# How Cryptomator Protects:
+#   - Client-side encryption before files leave your computer
+#   - Zero-knowledge: Cloud provider can't decrypt files
+#   - Encrypts filenames and directory structure
+#   - Works with any cloud provider (Dropbox, GDrive, OneDrive, etc.)
+#
+# Source: https://cryptomator.org/
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly RED='\033[0;31m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+echo "=== Cryptomator Installation ==="
+echo ""
+echo "Choose installation method:"
+echo "  1) .deb package (recommended - better system integration)"
+echo "  2) AppImage (portable, works across distros)"
+echo ""
+read -p "Enter choice [1-2]: " choice
+
+case $choice in
+    1)
+        log "Installing Cryptomator .deb package..."
+        
+        # Get latest release
+        log "Fetching latest release..."
+        LATEST_URL=$(curl -s https://api.github.com/repos/cryptomator/cryptomator/releases/latest \
+            | grep "browser_download_url.*amd64.deb" \
+            | cut -d '"' -f 4)
+        
+        if [ -z "$LATEST_URL" ]; then
+            error "Could not find latest .deb package"
+        fi
+        
+        log "Downloading from: $LATEST_URL"
+        cd /tmp
+        wget -O cryptomator.deb "$LATEST_URL"
+        
+        log "Installing .deb package..."
+        sudo apt install -y ./cryptomator.deb
+        
+        rm cryptomator.deb
+        log "✅ Cryptomator .deb installed"
+        ;;
+        
+    2)
+        log "Installing Cryptomator AppImage..."
+        
+        # Get latest AppImage
+        log "Fetching latest release..."
+        LATEST_URL=$(curl -s https://api.github.com/repos/cryptomator/cryptomator/releases/latest \
+            | grep "browser_download_url.*x86_64.AppImage\"" \
+            | cut -d '"' -f 4)
+        
+        if [ -z "$LATEST_URL" ]; then
+            error "Could not find latest AppImage"
+        fi
+        
+        log "Downloading from: $LATEST_URL"
+        mkdir -p ~/.local/bin
+        cd ~/.local/bin
+        wget -O Cryptomator.AppImage "$LATEST_URL"
+        chmod +x Cryptomator.AppImage
+        
+        # Create desktop entry
+        log "Creating desktop entry..."
+        mkdir -p ~/.local/share/applications
+        cat > ~/.local/share/applications/cryptomator.desktop << 'DESKTOP'
+[Desktop Entry]
+Name=Cryptomator
+Exec=$HOME/.local/bin/Cryptomator.AppImage
+Icon=cryptomator
+Type=Application
+Categories=Utility;Security;
+DESKTOP
+        
+        log "✅ Cryptomator AppImage installed to ~/.local/bin/Cryptomator.AppImage"
+        ;;
+        
+    *)
+        error "Invalid choice"
+        ;;
+esac
+
+echo ""
+log "Verifying installation..."
+if command -v cryptomator >/dev/null 2>&1 || [ -f ~/.local/bin/Cryptomator.AppImage ]; then
+    log "✅ Cryptomator installed successfully!"
+else
+    warn "Installation verification failed"
+fi
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Usage:"
+echo "  1. Launch Cryptomator from application menu"
+echo "  2. Create a new vault in your cloud storage folder"
+echo "  3. Set a strong password"
+echo "  4. Unlock vault and mount it"
+echo "  5. Copy files into mounted vault"
+echo "  6. Files are encrypted before sync to cloud!"
+echo ""
+echo "📖 Documentation: https://docs.cryptomator.org/"
--- a/tools/dangerzone/README.md
+++ b/tools/dangerzone/README.md
@ -0,0 +1,115 @@
+# Dangerzone - Document Sanitization
+
+**Convert potentially dangerous PDFs and Office documents into safe PDFs**
+
+## 🎯 Threat Model
+
+### What Problem Does This Solve?
+
+PDF and Office documents can contain:
+- Embedded malware and exploits
+- Tracking beacons that phone home when opened
+- Active content (JavaScript, macros) that can compromise your system
+- Hidden layers and metadata
+
+Opening untrusted documents is a **major attack vector**.
+
+### How Dangerzone Protects You
+
+1. **Container Isolation**: Opens document in a disposable container
+2. **Pixel Conversion**: Renders each page to pixels (destroying any code)
+3. **Safe Reconstruction**: Rebuilds a clean PDF from the pixels
+4. **Metadata Stripping**: Removes all potentially identifying metadata
+
+Result: A safe, pixel-perfect copy of the document without any embedded threats.
+
+## 🚀 Installation
+
+```bash
+cd ~/github/privacy-toolkit
+./tools/dangerzone/install.sh
+```
+
+Or run directly:
+```bash
+bash <(curl -s https://raw.githubusercontent.com/YOUR_USERNAME/privacy-toolkit/main/tools/dangerzone/install.sh)
+```
+
+## 📖 Usage
+
+### GUI Method
+1. Launch "Dangerzone" from your application menu
+2. Drag and drop a PDF or Office document
+3. Wait for sanitization (can take a few minutes for large docs)
+4. Get your safe PDF
+
+### Right-Click Method
+1. Right-click any PDF file
+2. Select "Open with Dangerzone"
+3. Sanitized PDF will be created in the same directory
+
+### Command Line
+```bash
+# Sanitize a PDF
+dangerzone document.pdf
+
+# Sanitize multiple files
+dangerzone file1.pdf file2.docx file3.xlsx
+
+# Specify output directory
+dangerzone -o /safe/directory document.pdf
+```
+
+## 🔍 When to Use Dangerzone
+
+**Always sanitize:**
+- ✅ Documents from email attachments
+- ✅ Downloads from the internet
+- ✅ Documents from USB drives
+- ✅ Any document from untrusted sources
+- ✅ Journalist source materials
+- ✅ Legal documents from unknown parties
+
+**Less critical:**
+- Documents you created yourself
+- Documents from verified, trusted colleagues (but still good practice!)
+
+## ⚠️ Limitations
+
+- **File Size**: Dangerzone creates larger files (pixel-based PDFs)
+- **Processing Time**: Can be slow for large documents (requires rendering)
+- **Text Selection**: Text becomes images (not searchable/selectable)
+- **Forms**: Interactive PDF forms become static
+
+**Trade-off**: Security vs. convenience. Dangerzone prioritizes security.
+
+## 🛠️ Technical Details
+
+**Architecture:**
+- Uses Podman or Docker for containerization
+- Runs untrusted code in isolated sandbox
+- Converts to pixels using LibreOffice/GraphicsMagick
+- Rebuilds PDF using safe rendering engine
+
+**Supported Formats:**
+- PDF
+- Microsoft Office: .docx, .xlsx, .pptx
+- LibreOffice: .odt, .ods, .odp
+
+## 🔗 Resources
+
+- Official Website: https://dangerzone.rocks/
+- Source Code: https://github.com/freedomofpress/dangerzone
+- Freedom of the Press Foundation: https://freedom.press/
+
+## 🤝 Related Tools
+
+- **mat2**: Metadata removal (keeps documents editable)
+- **ExifCleaner**: Quick metadata stripping
+- **Qubes OS**: Full system isolation for maximum security
+
+---
+
+**Maintained by**: Freedom of the Press Foundation
+**License**: AGPL-3.0
+**Last Updated**: 2025-11-12
--- a/tools/dangerzone/install.sh
+++ b/tools/dangerzone/install.sh
@ -0,0 +1,138 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Dangerzone Installation Script
+# ==============================================================================
+# Installs Dangerzone - PDF/Office document sanitizer using container isolation
+# 
+# Threat Model:
+#   - Malicious PDF/Office documents with embedded exploits
+#   - Opening untrusted documents can compromise your system
+#   - Dangerzone converts documents in isolated containers, then re-renders
+#     them safely, removing any potential malware
+#
+# Source: Freedom of the Press Foundation
+# Official Docs: https://dangerzone.rocks/
+# ==============================================================================
+
+# Colors
+readonly RED='\033[0;31m'
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+# Detect distro
+detect_distro() {
+    if [ -f /etc/os-release ]; then
+        . /etc/os-release
+        echo "$ID"
+    else
+        error "Cannot detect distribution"
+    fi
+}
+
+# Install for Debian/Ubuntu
+install_debian() {
+    log "Installing Dangerzone for Debian/Ubuntu..."
+    
+    # Install prerequisites
+    log "Installing prerequisites..."
+    sudo apt-get update
+    sudo apt-get install -y gpg ca-certificates
+    
+    # Create keyrings directory
+    sudo mkdir -p /etc/apt/keyrings
+    
+    # Download and add GPG key
+    log "Adding Freedom of the Press Foundation GPG key..."
+    sudo gpg --keyserver hkps://keys.openpgp.org \
+        --no-default-keyring --no-permission-warning --homedir $(mktemp -d) \
+        --keyring gnupg-ring:/etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg \
+        --recv-keys DE28AB241FA48260FAC9B8BAA7C9B38522604281
+    
+    # FIX: Make keyring world-readable so APT can verify signatures
+    log "Fixing keyring permissions..."
+    sudo chmod 644 /etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg
+    
+    # Add repository
+    log "Adding Dangerzone repository..."
+    . /etc/os-release
+    echo "deb [signed-by=/etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg] \
+        https://packages.freedom.press/apt-tools-prod ${VERSION_CODENAME?} main" \
+        | sudo tee /etc/apt/sources.list.d/fpf-apt-tools.list
+    
+    # Install Dangerzone
+    log "Installing Dangerzone..."
+    sudo apt update
+    sudo apt install -y dangerzone
+    
+    log "✅ Dangerzone installed successfully!"
+}
+
+# Install for Fedora
+install_fedora() {
+    warn "Fedora installation not yet implemented"
+    error "Please install manually: https://dangerzone.rocks/"
+}
+
+# Verify installation
+verify_installation() {
+    log "Verifying installation..."
+    
+    if command -v dangerzone >/dev/null 2>&1; then
+        log "✅ Dangerzone command found"
+        dangerzone --version || true
+    else
+        error "Dangerzone not found in PATH"
+    fi
+    
+    # Check if container runtime is available
+    if command -v podman >/dev/null 2>&1; then
+        log "✅ Podman available (container runtime)"
+    elif command -v docker >/dev/null 2>&1; then
+        log "✅ Docker available (container runtime)"
+    else
+        warn "No container runtime found - Dangerzone may not work"
+    fi
+}
+
+# Main
+main() {
+    echo "=== Dangerzone Installation ==="
+    echo ""
+    
+    DISTRO=$(detect_distro)
+    log "Detected distribution: $DISTRO"
+    
+    case "$DISTRO" in
+        debian|ubuntu)
+            install_debian
+            ;;
+        fedora)
+            install_fedora
+            ;;
+        *)
+            error "Unsupported distribution: $DISTRO"
+            ;;
+    esac
+    
+    echo ""
+    verify_installation
+    
+    echo ""
+    echo "=== Installation Complete ==="
+    echo ""
+    echo "Usage:"
+    echo "  1. Launch from application menu: 'Dangerzone'"
+    echo "  2. Or right-click any PDF → 'Open with Dangerzone'"
+    echo "  3. Or from terminal: dangerzone /path/to/document.pdf"
+    echo ""
+    echo "📖 Documentation: https://dangerzone.rocks/"
+}
+
+main "$@"
--- a/tools/frame/README.md
+++ b/tools/frame/README.md
@ -0,0 +1,85 @@
+# Frame Wallet
+
+Privacy-focused, system-wide web3 wallet for Linux.
+
+## What is Frame?
+
+Frame is a native OS-level wallet that provides:
+- Hardware wallet support (Ledger, Trezor, GridPlus Lattice)
+- Multi-chain support (Ethereum, Optimism, Arbitrum, Polygon, etc.)
+- System tray integration
+- No browser extension required
+- Open source and auditable
+
+## Why Frame?
+
+**Privacy Benefits:**
+- No tracking or analytics
+- Open source (MIT license)
+- No account required
+- Works offline for signing
+
+**Security Benefits:**
+- Hardware wallet isolation from browser
+- Native OS process (not a browser extension)
+- System-level permission model
+- No extension attack surface
+
+## Installation
+
+```bash
+./install.sh
+```
+
+This will:
+1. Install Frame from official sources
+2. Create X11-mode launcher at `~/bin/frame`
+3. Create desktop entry with proper Electron flags
+
+## Display Compatibility
+
+Frame is an Electron app. The install script forces X11 mode for stability:
+
+```bash
+--ozone-platform=x11  # Force X11 (Wayland has issues)
+```
+
+If you want to try Wayland, edit `~/bin/frame` and use:
+- Auto-detect: `--ozone-platform-hint=auto`
+- Pure Wayland: `--enable-features=UseOzonePlatform --ozone-platform=wayland`
+
+## Usage
+
+```bash
+frame                    # Launch Frame
+```
+
+Then:
+1. Click the Frame icon in system tray
+2. Add accounts (hot wallet or hardware)
+3. Connect to dapps via Frame's injected provider
+
+## Hardware Wallet Setup
+
+### Ledger
+1. Install Ledger Live and update firmware
+2. Install Ethereum app on Ledger
+3. Enable "Blind signing" in Ethereum app settings
+4. Connect Ledger and unlock
+5. Frame will detect it automatically
+
+### Trezor
+1. Update Trezor firmware via Trezor Suite
+2. Connect Trezor
+3. Frame will prompt for PIN
+
+### GridPlus Lattice
+1. Pair Lattice via Frame settings
+2. Frame connects over network
+
+## Resources
+
+- [Frame Website](https://frame.sh/)
+- [Documentation](https://docs.frame.sh/)
+- [GitHub](https://github.com/floating/frame)
+- [Discord](https://discord.gg/frame)
--- a/tools/frame/install.sh
+++ b/tools/frame/install.sh
@ -0,0 +1,176 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Frame Wallet Installation Script
+# ==============================================================================
+# Installs Frame - A privacy-focused, system-wide web3 wallet
+#
+# Features:
+#   - Hardware wallet support (Ledger, Trezor, GridPlus)
+#   - Multi-chain support (Ethereum, Optimism, Arbitrum, etc.)
+#   - Native OS integration (system tray, browser extension not required)
+#   - Privacy-focused (no tracking, open source)
+#
+# Threat Model:
+#   - Protects against browser extension attacks
+#   - Hardware wallet isolation from browser
+#   - No phone-home or analytics
+#   - Open source and auditable
+#
+# Source: https://frame.sh/
+# GitHub: https://github.com/floating/frame
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly RED='\033[0;31m'
+readonly BLUE='\033[0;34m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+header() { echo -e "${BLUE}=== $* ===${NC}"; }
+
+header "Frame Wallet Installation"
+echo ""
+echo "Frame is a privacy-focused system-wide web3 wallet"
+echo ""
+echo "This script will:"
+echo "  1. Install Frame from official .deb package"
+echo "  2. Create launcher with Wayland compatibility"
+echo "  3. Add desktop entry with proper Electron flags"
+echo ""
+read -p "Continue? [Y/n]: " confirm
+[[ "${confirm:-Y}" =~ ^[Nn] ]] && exit 0
+
+# ==============================================================================
+# Check if already installed
+# ==============================================================================
+if command -v frame &>/dev/null; then
+    log "Frame is already installed at $(which frame)"
+    echo ""
+    read -p "Reinstall/update? [y/N]: " reinstall
+    [[ ! "${reinstall:-N}" =~ ^[Yy] ]] && exit 0
+fi
+
+# ==============================================================================
+# Install Frame
+# ==============================================================================
+header "Installing Frame"
+
+# Method 1: Try apt repository first
+log "Checking for Frame in apt..."
+if apt-cache show frame &>/dev/null 2>&1; then
+    log "Installing from apt repository..."
+    sudo apt update
+    sudo apt install -y frame
+else
+    # Method 2: Download .deb from GitHub releases
+    log "Downloading from GitHub releases..."
+
+    LATEST_URL=$(curl -s https://api.github.com/repos/floating/frame/releases/latest \
+        | grep "browser_download_url.*amd64.deb" \
+        | cut -d '"' -f 4 \
+        | head -1)
+
+    if [ -z "$LATEST_URL" ]; then
+        error "Could not find latest Frame .deb release"
+    fi
+
+    log "Downloading from: $LATEST_URL"
+    cd /tmp
+    curl -L -o frame.deb "$LATEST_URL"
+
+    log "Installing .deb package..."
+    sudo apt install -y ./frame.deb
+    rm frame.deb
+fi
+
+# ==============================================================================
+# Create X11 Launcher (Wayland has issues with Electron)
+# ==============================================================================
+header "Creating X11 Launcher"
+
+mkdir -p ~/bin
+
+cat > ~/bin/frame << 'EOF'
+#!/bin/bash
+# Frame launcher - Force X11 for stability (Wayland has issues with Electron)
+exec /opt/Frame/frame --ozone-platform=x11 "$@"
+EOF
+chmod +x ~/bin/frame
+
+log "Created ~/bin/frame launcher"
+
+# ==============================================================================
+# Create desktop entry
+# ==============================================================================
+header "Creating Desktop Entry"
+
+mkdir -p ~/.local/share/applications
+
+cat > ~/.local/share/applications/frame.desktop << 'EOF'
+[Desktop Entry]
+Name=Frame
+Comment=System-wide web3 wallet
+Exec=/home/e/bin/frame %U
+Terminal=false
+Type=Application
+Icon=frame
+StartupWMClass=Frame
+Categories=Utility;Finance;
+EOF
+
+# Update icon path
+sed -i "s|/home/e|$HOME|g" ~/.local/share/applications/frame.desktop
+
+log "Created desktop entry"
+
+# ==============================================================================
+# Verify Installation
+# ==============================================================================
+header "Verifying Installation"
+
+echo ""
+if [ -f /opt/Frame/frame ]; then
+    echo "  ✅ Frame binary installed at /opt/Frame/frame"
+else
+    echo "  ❌ Frame binary not found"
+fi
+
+if [ -f ~/bin/frame ]; then
+    echo "  ✅ Wayland launcher created at ~/bin/frame"
+else
+    echo "  ❌ Launcher not created"
+fi
+
+if [ -f ~/.local/share/applications/frame.desktop ]; then
+    echo "  ✅ Desktop entry created"
+else
+    echo "  ❌ Desktop entry not created"
+fi
+
+# ==============================================================================
+# Usage Instructions
+# ==============================================================================
+echo ""
+header "Installation Complete"
+echo ""
+echo "Usage:"
+echo "  frame              - Launch Frame wallet"
+echo ""
+echo "Features:"
+echo "  - Connect hardware wallets (Ledger, Trezor, GridPlus)"
+echo "  - Multi-chain support (ETH, OP, ARB, MATIC, etc.)"
+echo "  - System tray integration"
+echo "  - Privacy-focused (no tracking)"
+echo ""
+echo "Wayland Notes:"
+echo "  - Launcher uses --ozone-platform-hint=auto for auto-detection"
+echo "  - Edit ~/bin/frame if you need to force X11 or Wayland mode"
+echo ""
+echo "📖 Documentation: https://docs.frame.sh/"
+echo "🔗 GitHub: https://github.com/floating/frame"
--- a/tools/librewolf/install.sh
+++ b/tools/librewolf/install.sh
@ -0,0 +1,155 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# LibreWolf Browser Installation
+# ==============================================================================
+# Privacy-focused Firefox fork with enhanced security defaults
+# - No telemetry
+# - uBlock Origin pre-installed
+# - Enhanced tracking protection
+# - Privacy-respecting search defaults
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly BLUE='\033[0;34m'
+readonly RED='\033[0;31m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; }
+section() { echo -e "${BLUE}=== $* ===${NC}"; }
+
+section "LibreWolf Browser Installation"
+echo ""
+
+# Check if already installed
+if command -v librewolf &>/dev/null; then
+    log "LibreWolf already installed: $(librewolf --version 2>/dev/null | head -1 || echo 'version check failed')"
+    read -p "Reinstall/upgrade? [y/N] " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        log "Skipping installation"
+        exit 0
+    fi
+fi
+
+# Detect distro
+if [ -f /etc/os-release ]; then
+    . /etc/os-release
+    DISTRO="${ID:-unknown}"
+    DISTRO_VERSION="${VERSION_CODENAME:-${VERSION_ID:-unknown}}"
+else
+    error "Cannot detect distribution"
+    exit 1
+fi
+
+log "Detected: $DISTRO $DISTRO_VERSION"
+
+case "$DISTRO" in
+    debian|ubuntu|linuxmint|pop)
+        section "Installing via LibreWolf APT Repository"
+
+        # Install dependencies
+        log "Installing dependencies..."
+        sudo apt update
+        sudo apt install -y curl gnupg lsb-release apt-transport-https ca-certificates
+
+        # Add LibreWolf repo
+        log "Adding LibreWolf repository..."
+
+        # Get the distro codename (LibreWolf uses Debian/Ubuntu codenames)
+        if [[ "$DISTRO" == "debian" ]]; then
+            REPO_CODENAME="$DISTRO_VERSION"
+        elif [[ "$DISTRO" == "ubuntu" || "$DISTRO" == "linuxmint" || "$DISTRO" == "pop" ]]; then
+            # For Ubuntu derivatives, try to get the Ubuntu base codename
+            REPO_CODENAME="$DISTRO_VERSION"
+        else
+            REPO_CODENAME="bookworm"  # Fallback to Debian stable
+        fi
+
+        # Download and add the signing key
+        curl -fsSL https://deb.librewolf.net/keyring.gpg | sudo gpg --dearmor -o /usr/share/keyrings/librewolf.gpg
+
+        # Add the repository
+        echo "deb [arch=amd64 signed-by=/usr/share/keyrings/librewolf.gpg] https://deb.librewolf.net $REPO_CODENAME main" | \
+            sudo tee /etc/apt/sources.list.d/librewolf.list > /dev/null
+
+        # Update and install
+        log "Installing LibreWolf..."
+        sudo apt update
+        sudo apt install -y librewolf
+        ;;
+
+    fedora|rhel|centos)
+        section "Installing via LibreWolf RPM Repository"
+
+        # Add LibreWolf repo
+        log "Adding LibreWolf repository..."
+        sudo dnf config-manager --add-repo https://rpm.librewolf.net/librewolf-repo.repo
+
+        # Install
+        log "Installing LibreWolf..."
+        sudo dnf install -y librewolf
+        ;;
+
+    arch|manjaro|endeavouros)
+        section "Installing via AUR"
+
+        if command -v yay &>/dev/null; then
+            log "Installing via yay..."
+            yay -S --noconfirm librewolf-bin
+        elif command -v paru &>/dev/null; then
+            log "Installing via paru..."
+            paru -S --noconfirm librewolf-bin
+        else
+            warn "No AUR helper found (yay/paru)"
+            log "Installing librewolf-bin manually..."
+
+            cd /tmp
+            git clone https://aur.archlinux.org/librewolf-bin.git
+            cd librewolf-bin
+            makepkg -si --noconfirm
+            cd ..
+            rm -rf librewolf-bin
+        fi
+        ;;
+
+    *)
+        error "Unsupported distribution: $DISTRO"
+        log "Please install manually from: https://librewolf.net/installation/"
+        exit 1
+        ;;
+esac
+
+# Verify installation
+echo ""
+if command -v librewolf &>/dev/null; then
+    section "Installation Complete!"
+    log "LibreWolf installed successfully"
+    log "Version: $(librewolf --version 2>/dev/null | head -1 || echo 'check manually')"
+    echo ""
+    log "Launch with: librewolf"
+    log "Documentation: https://librewolf.net/"
+else
+    error "Installation may have failed - librewolf command not found"
+    exit 1
+fi
+
+echo ""
+section "Privacy Features Enabled by Default"
+echo ""
+cat << 'EOF'
+  - Telemetry completely disabled
+  - uBlock Origin pre-installed
+  - Enhanced Tracking Protection (Strict)
+  - First-party isolation enabled
+  - Fingerprinting protection enabled
+  - HTTPS-Only Mode enabled
+  - WebRTC leak prevention
+  - Privacy-respecting search (DuckDuckGo default)
+EOF
+echo ""
--- a/tools/meeting-record/README.md
+++ b/tools/meeting-record/README.md
@ -0,0 +1,140 @@
+# Meeting Record - Private Voice Recording & Transcription
+
+Local voice recording with live Whisper transcription. **All processing happens on your machine - no cloud APIs, no data leaves your computer.**
+
+## Why This Exists
+
+Most "AI voice recorders" (Plaud Note knockoffs, etc.) are just microphones that send your audio to cloud servers for processing. You're paying for hardware that:
+- Sends your private conversations to unknown servers
+- Requires monthly subscriptions after free tier
+- May store/analyze your data for training or other purposes
+- Stops working if the company shuts down
+
+**Meeting Record** does the same thing, but locally. Your audio never leaves your machine.
+
+## Features
+
+- **Continuous recording** - Full audio backup of entire meeting
+- **Live transcription** - See transcripts as you speak (10-second chunks)
+- **Final transcription** - High-quality full transcription when you stop
+- **100% local** - Uses whisper.cpp, no internet required
+- **No subscriptions** - Free forever, you own it
+
+## Installation
+
+```bash
+./install.sh
+```
+
+The installer will:
+1. Install system dependencies (ffmpeg, pulseaudio-utils, build tools)
+2. Clone and build whisper.cpp
+3. Download the Whisper model (base.en by default - fast & good)
+4. Install the `meeting-record` scripts to `~/bin/`
+
+### Custom Options
+
+```bash
+# Use different model (tiny, base, small, medium, large)
+WHISPER_MODEL=small.en ./install.sh
+
+# Custom install location
+WHISPER_CPP_DIR=/opt/whisper.cpp ./install.sh
+
+# Custom bin directory
+BIN_DIR=/usr/local/bin ./install.sh
+```
+
+## Usage
+
+```bash
+# Start recording (auto-named with timestamp)
+meeting-record
+
+# Named recording
+meeting-record "client-call-acme-corp"
+
+# 30-second test to verify setup
+meeting-record-test
+```
+
+Press **Ctrl+C** to stop recording. The script will:
+1. Stop audio capture
+2. Generate a high-quality final transcript
+3. Show you where all files are saved
+
+## Output Files
+
+After recording a meeting named "client-call", you'll find:
+
+```
+~/Recordings/meetings/client-call/
+├── full-audio.wav              # Complete recording (your backup)
+├── live-transcript.txt         # Real-time chunked transcription
+├── final-transcript.txt        # High-quality full transcription
+├── chunks/
+│   ├── chunk-0000.wav
+│   ├── chunk-0001.wav
+│   └── ...
+└── transcripts/
+    ├── chunk-0000.txt
+    ├── chunk-0001.txt
+    └── ...
+```
+
+## Requirements
+
+- Linux (Debian/Ubuntu/Fedora/Arch)
+- PulseAudio or PipeWire (for audio capture)
+- ~500MB disk space for whisper.cpp + model
+
+## Model Options
+
+| Model | Size | Speed | Quality | Best For |
+|-------|------|-------|---------|----------|
+| tiny.en | 75MB | Fastest | Basic | Quick notes |
+| base.en | 148MB | Fast | Good | **Recommended** |
+| small.en | 488MB | Medium | Better | Important meetings |
+| medium.en | 1.5GB | Slow | Great | Accuracy-critical |
+| large | 3GB | Slowest | Best | Maximum accuracy |
+
+Change model with: `WHISPER_MODEL=small.en ./install.sh`
+
+## Troubleshooting
+
+**"parecord not found"**
+```bash
+sudo apt install pulseaudio-utils  # Debian/Ubuntu
+sudo dnf install pulseaudio-utils  # Fedora
+```
+
+**"No audio being captured"**
+- Check your default audio source: `pactl list sources`
+- Make sure microphone is not muted
+
+**"whisper-cli not found"**
+- The installer should build this. If it failed, check cmake output
+- You can rebuild: `cd ~/opt/whisper.cpp/build && cmake --build .`
+
+**"meeting-record: command not found"**
+- Add ~/bin to PATH: `export PATH="$HOME/bin:$PATH"`
+- Add this to your `~/.bashrc` or `~/.zshrc`
+
+## Privacy Comparison
+
+| Feature | Cloud AI Recorders | Meeting Record |
+|---------|-------------------|----------------|
+| Audio processing | Remote servers | Local only |
+| Data storage | Their servers | Your disk |
+| Internet required | Yes | No |
+| Monthly fees | Usually | Never |
+| Works offline | No | Yes |
+| You control data | No | Yes |
+
+## License
+
+MIT - Do whatever you want with it.
+
+---
+
+*Part of the [Privacy Toolkit](../../README.md) - Tools for digital sovereignty.*
--- a/tools/meeting-record/install.sh
+++ b/tools/meeting-record/install.sh
@ -0,0 +1,485 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Meeting Record Installation Script
+# ==============================================================================
+# Installs meeting-record - Local voice recording with live Whisper transcription
+#
+# Privacy Model:
+#   - All audio processing happens locally on YOUR machine
+#   - Uses whisper.cpp for transcription - no cloud APIs
+#   - No data leaves your computer, ever
+#   - Alternative to cloud-based "AI recorders" that harvest your conversations
+#
+# Features:
+#   - Continuous audio recording (full backup)
+#   - Live chunked transcription every 10 seconds
+#   - Final high-quality transcription on stop
+#   - Simple CLI interface
+#
+# Source: PAI (Personal AI Infrastructure)
+# ==============================================================================
+
+# Colors
+readonly RED='\033[0;31m'
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly BLUE='\033[0;34m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+step() { echo -e "${BLUE}[STEP]${NC} $*"; }
+
+# Configuration
+WHISPER_CPP_DIR="${WHISPER_CPP_DIR:-$HOME/opt/whisper.cpp}"
+WHISPER_MODEL="${WHISPER_MODEL:-base.en}"
+BIN_DIR="${BIN_DIR:-$HOME/bin}"
+RECORDINGS_DIR="${RECORDINGS_DIR:-$HOME/Recordings/meetings}"
+
+# Detect distro
+detect_distro() {
+    if [ -f /etc/os-release ]; then
+        . /etc/os-release
+        echo "$ID"
+    else
+        error "Cannot detect distribution"
+    fi
+}
+
+# Install system dependencies
+install_dependencies() {
+    step "Installing system dependencies..."
+
+    DISTRO=$(detect_distro)
+
+    case "$DISTRO" in
+        debian|ubuntu|pop)
+            sudo apt-get update
+            sudo apt-get install -y \
+                ffmpeg \
+                pulseaudio-utils \
+                build-essential \
+                git \
+                cmake
+            ;;
+        fedora)
+            sudo dnf install -y \
+                ffmpeg \
+                pulseaudio-utils \
+                gcc-c++ \
+                git \
+                cmake
+            ;;
+        arch|manjaro)
+            sudo pacman -S --noconfirm \
+                ffmpeg \
+                pulseaudio \
+                base-devel \
+                git \
+                cmake
+            ;;
+        *)
+            warn "Unknown distro: $DISTRO"
+            warn "Please manually install: ffmpeg, pulseaudio-utils, build-essential, git, cmake"
+            ;;
+    esac
+
+    log "System dependencies installed"
+}
+
+# Build whisper.cpp
+install_whisper_cpp() {
+    step "Installing whisper.cpp..."
+
+    if [ -f "$WHISPER_CPP_DIR/build/bin/whisper-cli" ]; then
+        log "whisper.cpp already installed at $WHISPER_CPP_DIR"
+        return 0
+    fi
+
+    # Clone if not exists
+    if [ ! -d "$WHISPER_CPP_DIR" ]; then
+        log "Cloning whisper.cpp..."
+        mkdir -p "$(dirname "$WHISPER_CPP_DIR")"
+        git clone https://github.com/ggerganov/whisper.cpp.git "$WHISPER_CPP_DIR"
+    fi
+
+    cd "$WHISPER_CPP_DIR"
+
+    # Build
+    log "Building whisper.cpp..."
+    mkdir -p build
+    cd build
+    cmake ..
+    cmake --build . --config Release -j$(nproc)
+
+    if [ ! -f "$WHISPER_CPP_DIR/build/bin/whisper-cli" ]; then
+        error "whisper.cpp build failed - whisper-cli not found"
+    fi
+
+    log "whisper.cpp built successfully"
+}
+
+# Download Whisper model
+download_model() {
+    step "Downloading Whisper model ($WHISPER_MODEL)..."
+
+    MODEL_FILE="$WHISPER_CPP_DIR/models/ggml-${WHISPER_MODEL}.bin"
+
+    if [ -f "$MODEL_FILE" ]; then
+        log "Model already exists: $MODEL_FILE"
+        return 0
+    fi
+
+    cd "$WHISPER_CPP_DIR"
+
+    # Use the download script
+    log "Downloading ggml-${WHISPER_MODEL}.bin..."
+    bash models/download-ggml-model.sh "$WHISPER_MODEL"
+
+    if [ ! -f "$MODEL_FILE" ]; then
+        error "Model download failed"
+    fi
+
+    log "Model downloaded: $MODEL_FILE"
+}
+
+# Install meeting-record scripts
+install_scripts() {
+    step "Installing meeting-record scripts..."
+
+    mkdir -p "$BIN_DIR"
+    mkdir -p "$RECORDINGS_DIR"
+
+    # Get the directory where this install script lives
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+    # Install meeting-record
+    cat > "$BIN_DIR/meeting-record" << 'SCRIPT'
+#!/usr/bin/env bash
+#
+# meeting-record - Live meeting recorder with chunked transcription
+#
+# Usage:
+#   meeting-record [meeting-name]
+#   meeting-record "client-call-acme"
+#
+# Features:
+#   - Continuous audio recording (full backup)
+#   - Live chunked transcription every 10 seconds
+#   - Uses local Whisper models (privacy-respecting)
+#   - Separates recording from transcription (robust)
+#
+# Controls:
+#   - Ctrl+C to stop recording
+#
+
+set -euo pipefail
+
+# Configuration - adjust paths as needed
+WHISPER_BIN="${WHISPER_BIN:-$HOME/opt/whisper.cpp/build/bin/whisper-cli}"
+WHISPER_MODEL="${WHISPER_MODEL:-$HOME/opt/whisper.cpp/models/ggml-base.en.bin}"
+CHUNK_DURATION=10  # seconds
+RECORDINGS_DIR="${RECORDINGS_DIR:-$HOME/Recordings/meetings}"
+
+# Validate dependencies
+command -v parecord >/dev/null 2>&1 || { echo "Error: parecord not found. Install pulseaudio-utils"; exit 1; }
+command -v ffmpeg >/dev/null 2>&1 || { echo "Error: ffmpeg not found"; exit 1; }
+[ -f "$WHISPER_BIN" ] || { echo "Error: whisper-cli not found at $WHISPER_BIN"; exit 1; }
+[ -f "$WHISPER_MODEL" ] || { echo "Error: Whisper model not found at $WHISPER_MODEL"; exit 1; }
+
+# Meeting name from argument or auto-generate
+MEETING_NAME="${1:-meeting-$(date +%Y%m%d-%H%M%S)}"
+MEETING_DIR="$RECORDINGS_DIR/$MEETING_NAME"
+
+# Create directory structure
+mkdir -p "$MEETING_DIR"/{chunks,transcripts}
+
+# File paths
+FULL_AUDIO="$MEETING_DIR/full-audio.wav"
+LIVE_TRANSCRIPT="$MEETING_DIR/live-transcript.txt"
+FINAL_TRANSCRIPT="$MEETING_DIR/final-transcript.txt"
+PID_FILE="$MEETING_DIR/.recording.pid"
+CHUNK_INDEX_FILE="$MEETING_DIR/.chunk_index"
+
+# Initialize chunk index
+echo "0" > "$CHUNK_INDEX_FILE"
+
+# Cleanup function
+cleanup() {
+    echo ""
+    echo "Stopping recording..."
+
+    # Kill all child processes
+    pkill -P $$ 2>/dev/null || true
+
+    # Kill from PID file
+    if [ -f "$PID_FILE" ]; then
+        while read -r PID; do
+            kill "$PID" 2>/dev/null || true
+        done < "$PID_FILE"
+        rm -f "$PID_FILE"
+    fi
+
+    echo "Generating final transcript..."
+    "$WHISPER_BIN" \
+        -m "$WHISPER_MODEL" \
+        -f "$FULL_AUDIO" \
+        -otxt \
+        -of "${FINAL_TRANSCRIPT%.txt}" \
+        --language en \
+        --threads 4 \
+        2>/dev/null || echo "Warning: Final transcription failed"
+
+    echo ""
+    echo "Recording complete!"
+    echo "Location: $MEETING_DIR"
+    echo "Audio: $FULL_AUDIO"
+    echo "Live transcript: $LIVE_TRANSCRIPT"
+    echo "Final transcript: $FINAL_TRANSCRIPT"
+
+    rm -f "$CHUNK_INDEX_FILE"
+    exit 0
+}
+
+trap cleanup INT TERM
+
+# Print header
+echo "Meeting Recorder - Live Transcription"
+echo "======================================"
+echo "Meeting: $MEETING_NAME"
+echo "Location: $MEETING_DIR"
+echo "Model: $(basename "$WHISPER_MODEL")"
+echo "Chunk size: ${CHUNK_DURATION}s"
+echo ""
+echo "Recording started - Press Ctrl+C to stop"
+echo "======================================"
+echo ""
+
+# Start continuous audio recording
+parecord \
+    --format=s16le \
+    --rate=16000 \
+    --channels=1 \
+    "$FULL_AUDIO" &
+
+RECORD_PID=$!
+echo "$RECORD_PID" > "$PID_FILE"
+
+# Give recording time to start
+sleep 1
+
+# Chunk recorder and transcriber loop
+while kill -0 $RECORD_PID 2>/dev/null; do
+    sleep "$CHUNK_DURATION"
+
+    CHUNK_NUM=$(cat "$CHUNK_INDEX_FILE")
+    CHUNK_FILE="$MEETING_DIR/chunks/chunk-$(printf '%04d' $CHUNK_NUM).wav"
+    TRANSCRIPT_FILE="$MEETING_DIR/transcripts/chunk-$(printf '%04d' $CHUNK_NUM).txt"
+
+    # Get duration of current recording
+    DURATION=$(ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "$FULL_AUDIO" 2>/dev/null || echo "0")
+
+    # Handle N/A or invalid duration
+    if [[ "$DURATION" == "N/A" ]] || [[ ! "$DURATION" =~ ^[0-9.]+$ ]]; then
+        DURATION="0"
+    fi
+
+    DURATION_INT=${DURATION%.*}
+
+    if [ "$DURATION_INT" -ge "$CHUNK_DURATION" ]; then
+        START_TIME=$((DURATION_INT - CHUNK_DURATION))
+
+        # Extract chunk
+        ffmpeg -ss $START_TIME -i "$FULL_AUDIO" -t $CHUNK_DURATION -c copy "$CHUNK_FILE" -y 2>/dev/null
+
+        # Transcribe chunk in background
+        (
+            "$WHISPER_BIN" \
+                -m "$WHISPER_MODEL" \
+                -f "$CHUNK_FILE" \
+                -otxt \
+                -of "$MEETING_DIR/transcripts/chunk-$(printf '%04d' $CHUNK_NUM)" \
+                --language en \
+                --threads 2 \
+                --no-timestamps \
+                2>/dev/null
+
+            if [ -f "$TRANSCRIPT_FILE" ]; then
+                TIMESTAMP=$(date '+%H:%M:%S')
+                echo "[$TIMESTAMP] $(cat "$TRANSCRIPT_FILE")" >> "$LIVE_TRANSCRIPT"
+                echo "[$(date '+%H:%M:%S')] Chunk $CHUNK_NUM transcribed"
+            fi
+        ) &
+
+        echo $((CHUNK_NUM + 1)) > "$CHUNK_INDEX_FILE"
+    fi
+done
+
+cleanup
+SCRIPT
+
+    chmod +x "$BIN_DIR/meeting-record"
+    log "Installed: $BIN_DIR/meeting-record"
+
+    # Install meeting-record-test
+    cat > "$BIN_DIR/meeting-record-test" << 'SCRIPT'
+#!/usr/bin/env bash
+#
+# meeting-record-test - Test the meeting recorder for 30 seconds
+#
+
+echo "Testing meeting recorder for 30 seconds..."
+echo "Please speak during this test so we can verify transcription."
+echo ""
+
+# Start recording in background
+meeting-record "test-$(date +%Y%m%d-%H%M%S)" &
+TEST_PID=$!
+
+# Wait 30 seconds
+sleep 30
+
+# Stop recording
+kill -INT $TEST_PID 2>/dev/null
+
+# Wait for cleanup
+wait $TEST_PID 2>/dev/null
+
+echo ""
+echo "Test complete! Check the output above for results."
+SCRIPT
+
+    chmod +x "$BIN_DIR/meeting-record-test"
+    log "Installed: $BIN_DIR/meeting-record-test"
+}
+
+# Update script to use correct paths
+update_paths() {
+    step "Configuring paths..."
+
+    # Update the installed script with correct whisper.cpp path
+    sed -i "s|\$HOME/opt/whisper.cpp|$WHISPER_CPP_DIR|g" "$BIN_DIR/meeting-record"
+
+    log "Paths configured"
+}
+
+# Verify installation
+verify_installation() {
+    step "Verifying installation..."
+
+    local errors=0
+
+    # Check whisper-cli
+    if [ -f "$WHISPER_CPP_DIR/build/bin/whisper-cli" ]; then
+        log "whisper-cli: OK"
+    else
+        warn "whisper-cli: NOT FOUND"
+        ((errors++))
+    fi
+
+    # Check model
+    if [ -f "$WHISPER_CPP_DIR/models/ggml-${WHISPER_MODEL}.bin" ]; then
+        log "Whisper model: OK"
+    else
+        warn "Whisper model: NOT FOUND"
+        ((errors++))
+    fi
+
+    # Check ffmpeg
+    if command -v ffmpeg >/dev/null 2>&1; then
+        log "ffmpeg: OK"
+    else
+        warn "ffmpeg: NOT FOUND"
+        ((errors++))
+    fi
+
+    # Check parecord
+    if command -v parecord >/dev/null 2>&1; then
+        log "parecord: OK"
+    else
+        warn "parecord: NOT FOUND"
+        ((errors++))
+    fi
+
+    # Check scripts
+    if [ -x "$BIN_DIR/meeting-record" ]; then
+        log "meeting-record script: OK"
+    else
+        warn "meeting-record script: NOT FOUND"
+        ((errors++))
+    fi
+
+    # Check PATH
+    if echo "$PATH" | grep -q "$BIN_DIR"; then
+        log "$BIN_DIR in PATH: OK"
+    else
+        warn "$BIN_DIR not in PATH - add to your shell config:"
+        warn "  export PATH=\"\$HOME/bin:\$PATH\""
+    fi
+
+    if [ $errors -eq 0 ]; then
+        log "All components verified!"
+        return 0
+    else
+        warn "$errors component(s) need attention"
+        return 1
+    fi
+}
+
+# Print usage
+print_usage() {
+    echo ""
+    echo "=== Installation Complete ==="
+    echo ""
+    echo "Usage:"
+    echo "  meeting-record                    # Auto-named recording"
+    echo "  meeting-record \"client-call\"      # Named recording"
+    echo "  meeting-record-test               # 30-second test"
+    echo ""
+    echo "Output files are saved to: $RECORDINGS_DIR/<meeting-name>/"
+    echo "  - full-audio.wav       Complete recording"
+    echo "  - live-transcript.txt  Real-time transcription"
+    echo "  - final-transcript.txt High-quality full transcription"
+    echo ""
+    echo "Privacy: All processing happens locally. No cloud APIs."
+    echo ""
+}
+
+# Main
+main() {
+    echo "=== Meeting Record Installation ==="
+    echo ""
+    echo "This will install:"
+    echo "  - whisper.cpp (local speech recognition)"
+    echo "  - Whisper model: $WHISPER_MODEL"
+    echo "  - meeting-record scripts"
+    echo ""
+    echo "Install location: $WHISPER_CPP_DIR"
+    echo "Scripts location: $BIN_DIR"
+    echo ""
+
+    read -p "Continue? [Y/n] " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]?$ ]]; then
+        echo "Aborted."
+        exit 0
+    fi
+
+    echo ""
+
+    install_dependencies
+    install_whisper_cpp
+    download_model
+    install_scripts
+    update_paths
+
+    echo ""
+    verify_installation || true
+
+    print_usage
+}
+
+main "$@"
--- a/tools/simplex/INSTALL-NOTES.md
+++ b/tools/simplex/INSTALL-NOTES.md
@ -0,0 +1,70 @@
+# SimpleX Installation Notes
+
+## ⚠️ Known Issues
+
+### .deb Package Compatibility Problems
+
+The official .deb packages (both Ubuntu 22.04 and 24.04) have library compatibility issues:
+
+**Confirmed broken on:**
+- ✗ Debian Trixie (crash: `SIGSEGV in libHSzstd`)
+- ✗ Pop!_OS (various library issues)
+
+**Root cause:**
+- Complex dependency chain (Java, Haskell runtime, zstd, VLC libraries)
+- Ubuntu-specific library versions
+- Native library linking issues
+
+## ✅ Recommended: AppImage
+
+**Use the AppImage for ALL installations:**
+
+```bash
+cd ~/github/privacy-toolkit/tools/simplex
+./install-appimage.sh
+```
+
+**Why AppImage works:**
+- ✅ Bundles all dependencies
+- ✅ No library conflicts
+- ✅ Works on all distros
+- ✅ Tested on Debian Trixie and Pop!_OS
+
+## 📦 File Locations
+
+After AppImage installation:
+- **Binary**: `~/.local/bin/SimpleX.AppImage`
+- **Desktop Entry**: `~/.local/share/applications/simplex.desktop`
+- **Data** (unchanged): `~/.local/share/simplex/`
+- **Config** (unchanged): `~/.config/simplex/`
+
+## 🔄 Migrating from .deb to AppImage
+
+If you tried the .deb first:
+
+```bash
+# Remove broken .deb
+sudo apt remove simplex
+sudo rm -rf /opt/simplex
+
+# Install AppImage
+./install-appimage.sh
+
+# Your data is preserved (lives in ~/.local/share/simplex/)
+```
+
+## 📝 Testing Notes
+
+| System | .deb Package | AppImage |
+|--------|-------------|----------|
+| Debian Trixie (glibc 2.41) | ✗ Crashes | ✅ Works |
+| Pop!_OS 22.04 | ✗ Issues | ✅ Works |
+| Ubuntu 24.04 native | ? Unknown | ✅ Works |
+
+**Conclusion**: Always use AppImage for SimpleX.
+
+---
+
+**Last Updated**: 2025-11-12
+**Tested On**: Debian Trixie, Pop!_OS
+**Recommendation**: AppImage only
--- a/tools/simplex/README.md
+++ b/tools/simplex/README.md
@ -0,0 +1,168 @@
+# SimpleX Chat - Private Messaging Without Identifiers
+
+**The most private messaging app - no phone number, email, or username required**
+
+## 🎯 Threat Model
+
+### What Problem Does This Solve?
+
+Most "encrypted" messaging apps still leak critical metadata:
+
+- **Phone/Email Linking**: Signal, WhatsApp, Telegram require phone numbers
+- **Username Tracking**: Session, Threema use permanent usernames
+- **Contact Graph**: Servers know who talks to whom
+- **Central Compromise**: Single point of failure if servers are seized
+
+### How SimpleX is Different
+
+**No User Identifiers**
+- No phone number
+- No email address  
+- No username
+- No blockchain address
+- **Nothing** that identifies you across connections
+
+**Each Contact is Isolated**
+- Every contact uses different message routing
+- Server can't build a social graph
+- Compromise of one contact doesn't expose others
+
+**Decentralized Infrastructure**
+- Run your own server or use defaults
+- Messages routed through different servers
+- Ephemeral message queues (deleted after delivery)
+
+## 🔐 Privacy Features
+
+- ✅ End-to-end encryption (Signal Double Ratchet + post-quantum)
+- ✅ Perfect forward secrecy
+- ✅ No metadata leakage to servers
+- ✅ Disappearing messages
+- ✅ Incognito mode (temporary identities)
+- ✅ Voice/video calls (also E2E encrypted)
+- ✅ Group chats (fully decentralized)
+- ✅ File sharing (encrypted)
+
+## 🚀 Installation
+
+### Debian Trixie (glibc 2.40+)
+```bash
+cd ~/github/privacy-toolkit
+./tools/simplex/install.sh
+```
+
+The script automatically selects:
+- **Ubuntu 24.04 package** for Debian Trixie
+- **Ubuntu 22.04 package** for older systems
+
+### Manual Installation
+
+Check your glibc version:
+```bash
+ldd --version | head -1
+```
+
+- If glibc ≥ 2.39: Download ubuntu-24-04 package
+- If glibc < 2.39: Download ubuntu-22-04 package
+
+Download from: https://github.com/simplex-chat/simplex-chat/releases/latest
+
+## 📖 Usage
+
+### First Launch
+1. Open SimpleX from application menu
+2. Choose "Create new profile"
+3. Set display name (not sent to servers!)
+4. Optionally set profile image
+
+### Adding Contacts
+1. Click "+" → "Add contact"
+2. Share your connection link OR
+3. Scan contact's QR code
+
+**Important**: Each contact gets a unique connection link. You can't be tracked across contacts.
+
+### Restoring from Backup
+
+If you have a backup (from `/tmp/restore-simplex.sh`):
+1. Launch SimpleX
+2. It will automatically detect restored data
+3. Verify your contacts appear
+4. Database files are at `~/.local/share/simplex/`
+
+## 🔒 Security Best Practices
+
+### Message Retention
+- Enable disappearing messages for sensitive conversations
+- Default: Messages stored locally forever
+- Recommendation: 1 week retention for most chats
+
+### Connection Security
+- **Delete old connection links** after contact accepts
+- Use **incognito mode** for temporary conversations
+- **Verify contact fingerprints** for high-security conversations
+
+### Server Trust
+- Default servers are run by SimpleX team (good reputation)
+- For maximum privacy: Run your own SimpleX server
+- Or use community servers you trust
+
+### Backup Your Data
+SimpleX stores everything locally:
+```bash
+~/.local/share/simplex/         # Databases
+~/.config/simplex/              # Settings
+```
+
+**Backup regularly!** If you lose this data, you lose all messages.
+
+## 🆚 Comparison with Other Apps
+
+| Feature | SimpleX | Signal | Session | Matrix |
+|---------|---------|--------|---------|--------|
+| No phone/email | ✅ | ❌ | ✅ | ✅ |
+| No username | ✅ | ❌ | ❌ | ❌ |
+| No user ID at all | ✅ | ❌ | ❌ | ❌ |
+| Decentralized routing | ✅ | ❌ | ✅ | ✅ |
+| Contact graph hidden | ✅ | ❌ | ❌ | Partial |
+| Post-quantum crypto | ✅ | Partial | ❌ | ❌ |
+| Metadata resistance | Excellent | Good | Good | Moderate |
+
+## 🛠️ Advanced: Run Your Own Server
+
+For maximum privacy, run your own SimpleX SMP server:
+
+```bash
+# Docker method
+docker run -d \
+  --name simplex-smp \
+  -p 5223:5223 \
+  simplexchat/smp-server
+
+# Configure SimpleX app to use your server
+```
+
+Instructions: https://github.com/simplex-chat/simplexmq#smp-server
+
+## 🔗 Resources
+
+- Official Website: https://simplex.chat/
+- Documentation: https://simplex.chat/docs/
+- GitHub: https://github.com/simplex-chat/simplex-chat
+- Security Audit: https://simplex.chat/blog/simplex-chat-v5.8-private-message-routing-chat-themes/
+- Whitepaper: https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md
+
+## ⚠️ Limitations
+
+- **No cloud sync**: Messages are device-local only
+- **Manual backups**: You must backup yourself
+- **Contact management**: Need to share new links for each contact
+- **Group limitations**: Decentralized groups have size limits
+
+**Trade-off**: Maximum privacy requires some inconvenience. SimpleX chooses privacy over convenience.
+
+---
+
+**Maintained by**: SimpleX Chat team
+**License**: AGPL-3.0
+**Last Updated**: 2025-11-12
--- a/tools/simplex/install-appimage.sh
+++ b/tools/simplex/install-appimage.sh
@ -0,0 +1,107 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# SimpleX AppImage Installation (Recommended for Debian Trixie)
+# ==============================================================================
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+echo "=== SimpleX AppImage Installation ==="
+echo ""
+
+log "Fetching latest release info..."
+LATEST_RELEASE=$(curl -s https://api.github.com/repos/simplex-chat/simplex-chat/releases/latest)
+
+# Get AppImage URL
+APPIMAGE_URL=$(echo "$LATEST_RELEASE" | jq -r '.assets[] | select(.name == "simplex-desktop-x86_64.AppImage") | .browser_download_url')
+
+# Get SHA256 checksum URL
+CHECKSUM_URL=$(echo "$LATEST_RELEASE" | jq -r '.assets[] | select(.name == "simplex-desktop-x86_64.AppImage.sha256sum") | .browser_download_url')
+
+if [ -z "$APPIMAGE_URL" ]; then
+    error "Could not find AppImage in latest release"
+fi
+
+VERSION=$(echo "$LATEST_RELEASE" | jq -r '.tag_name')
+log "Latest version: $VERSION"
+log "AppImage URL: $APPIMAGE_URL"
+
+# Download AppImage
+log "Downloading SimpleX AppImage..."
+mkdir -p ~/.local/bin
+cd /tmp
+wget --show-progress -O SimpleX.AppImage "$APPIMAGE_URL"
+
+# Download and verify checksum
+if [ -n "$CHECKSUM_URL" ]; then
+    log "Downloading checksum..."
+    wget -q -O SimpleX.AppImage.sha256sum "$CHECKSUM_URL"
+    
+    log "Verifying checksum..."
+    if sha256sum -c SimpleX.AppImage.sha256sum 2>&1 | grep -q "OK"; then
+        log "✅ Checksum verified"
+    else
+        error "Checksum verification failed! Download may be corrupted or compromised."
+    fi
+    
+    rm SimpleX.AppImage.sha256sum
+else
+    warn "⚠️  No checksum file found - skipping verification"
+    warn "This is less secure. Continue anyway? [y/N]"
+    read -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        log "Installation cancelled"
+        rm SimpleX.AppImage
+        exit 0
+    fi
+fi
+
+# Install to ~/.local/bin
+log "Installing to ~/.local/bin..."
+mv SimpleX.AppImage ~/.local/bin/
+chmod +x ~/.local/bin/SimpleX.AppImage
+
+# Create simplex symlink for easier CLI access
+log "Creating 'simplex' symlink..."
+ln -sf ~/.local/bin/SimpleX.AppImage ~/.local/bin/simplex
+
+# Create desktop entry
+log "Creating desktop entry..."
+mkdir -p ~/.local/share/applications
+cat > ~/.local/share/applications/simplex.desktop << DESKTOP
+[Desktop Entry]
+Name=SimpleX
+Comment=Private messaging without identifiers
+Exec=$HOME/.local/bin/SimpleX.AppImage
+Icon=simplex
+Type=Application
+Categories=Network;Chat;
+DESKTOP
+
+log "✅ SimpleX installed successfully!"
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Launch from:"
+echo "  • Application menu: 'SimpleX'"
+echo "  • Terminal: simplex"
+echo "  • Or: ~/.local/bin/SimpleX.AppImage"
+echo ""
+echo "Your restored data:"
+echo "  ~/.local/share/simplex/  (messages, contacts)"
+echo "  ~/.config/simplex/       (settings)"
+echo ""
+echo "First launch:"
+echo "  SimpleX should automatically detect your restored data"
+echo "  Verify your contacts and messages appear"
+echo ""
+echo "📖 Documentation: https://simplex.chat/docs/"
--- a/tools/simplex/install.sh
+++ b/tools/simplex/install.sh
@ -0,0 +1,107 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# SimpleX Installation Script
+# ==============================================================================
+# Installs SimpleX Chat - E2E encrypted messaging without identifiers
+# 
+# Threat Model:
+#   - Phone number linking (Signal, WhatsApp require phone)
+#   - Metadata correlation (most messengers link messages to identities)
+#   - Central server compromise (centralized messengers)
+#   - Contact graph analysis (who talks to whom)
+#
+# How SimpleX Protects:
+#   - No user identifiers (no phone, email, username)
+#   - Decentralized message routing
+#   - Ephemeral message queues
+#   - Perfect forward secrecy
+#   - No contact graph (each contact uses different routing)
+#
+# Source: https://simplex.chat/
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly BLUE='\033[0;34m'
+readonly RED='\033[0;31m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+echo "=== SimpleX Chat Installation ==="
+echo ""
+
+# Detect system
+log "Detecting system..."
+GLIBC_VERSION=$(ldd --version | head -1 | awk '{print $NF}')
+DEBIAN_VERSION=$(cat /etc/debian_version 2>/dev/null || echo "unknown")
+
+log "System info:"
+log "  Debian: $DEBIAN_VERSION"
+log "  glibc: $GLIBC_VERSION"
+echo ""
+
+# Determine which package to use
+if [[ "$DEBIAN_VERSION" == "13"* ]] || [[ "$GLIBC_VERSION" > "2.39" ]]; then
+    PACKAGE_VERSION="24-04"
+    log "✅ Debian Trixie detected - using Ubuntu 24.04 package"
+else
+    PACKAGE_VERSION="22-04"
+    warn "Older Debian/Ubuntu detected - using Ubuntu 22.04 package"
+fi
+
+echo ""
+log "Fetching latest SimpleX release..."
+LATEST_RELEASE=$(curl -s https://api.github.com/repos/simplex-chat/simplex-chat/releases/latest)
+VERSION=$(echo "$LATEST_RELEASE" | jq -r '.tag_name')
+
+if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
+    error "Could not fetch latest version"
+fi
+
+log "Latest version: $VERSION"
+
+# Construct download URL
+PACKAGE_NAME="simplex-desktop-x86_64-ubuntu-${PACKAGE_VERSION}.deb"
+DOWNLOAD_URL="https://github.com/simplex-chat/simplex-chat/releases/download/${VERSION}/${PACKAGE_NAME}"
+
+log "Download URL: $DOWNLOAD_URL"
+echo ""
+
+# Download
+log "Downloading SimpleX Desktop..."
+cd /tmp
+wget -O simplex-desktop.deb "$DOWNLOAD_URL"
+
+# Install
+log "Installing SimpleX Desktop..."
+sudo apt install -y ./simplex-desktop.deb
+
+# Cleanup
+rm simplex-desktop.deb
+
+log "✅ SimpleX installed successfully!"
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Usage:"
+echo "  1. Launch 'SimpleX' from application menu"
+echo "  2. Create new profile OR restore from backup"
+echo "  3. Share your connection link with contacts"
+echo "  4. No phone number, email, or username required!"
+echo ""
+echo "Key Features:"
+echo "  • No user identifiers - truly anonymous"
+echo "  • Each contact uses different routing"
+echo "  • Decentralized message queues"
+echo "  • Perfect forward secrecy"
+echo "  • Disappearing messages"
+echo ""
+echo "📖 Documentation: https://simplex.chat/docs/"
+echo "🔒 Security: https://simplex.chat/blog/simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm/"
--- a/tools/veracrypt/install.sh
+++ b/tools/veracrypt/install.sh
@ -0,0 +1,109 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# VeraCrypt Installation Script
+# ==============================================================================
+# Installs VeraCrypt - Full disk encryption and encrypted containers
+# 
+# Threat Model:
+#   - Physical device theft (laptop, USB drive)
+#   - Data at rest without protection
+#   - Border crossing device searches
+#   - Forensic analysis of seized devices
+#
+# How VeraCrypt Protects:
+#   - Full disk encryption (entire drive encrypted)
+#   - Encrypted containers (virtual encrypted disks)
+#   - Plausible deniability (hidden volumes)
+#   - Multiple encryption algorithms
+#   - Pre-boot authentication
+#
+# Source: https://veracrypt.fr/
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly RED='\033[0;31m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+echo "=== VeraCrypt Installation ==="
+echo ""
+
+# Detect architecture
+ARCH=$(uname -m)
+if [ "$ARCH" = "x86_64" ]; then
+    ARCH_SUFFIX="amd64"
+else
+    error "Unsupported architecture: $ARCH (only x86_64 supported)"
+fi
+
+log "Fetching latest VeraCrypt version..."
+
+# Get latest version from SourceForge (VeraCrypt's official host)
+# Note: This is simplified - you may want to hardcode a version for stability
+LATEST_VERSION="1.26.7"  # Update this manually for stability
+warn "Using VeraCrypt version $LATEST_VERSION"
+
+# Construct download URL
+BASE_URL="https://launchpad.net/veracrypt/trunk/${LATEST_VERSION}/+download"
+DEB_FILE="veracrypt-${LATEST_VERSION}-Debian-12-${ARCH_SUFFIX}.deb"
+DOWNLOAD_URL="${BASE_URL}/${DEB_FILE}"
+
+log "Download URL: $DOWNLOAD_URL"
+echo ""
+warn "⚠️  IMPORTANT: You should verify the PGP signature!"
+warn "Official instructions: https://veracrypt.fr/en/Digital%20Signatures.html"
+echo ""
+read -p "Continue with installation? [y/N] " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    log "Installation cancelled"
+    exit 0
+fi
+
+log "Downloading VeraCrypt..."
+cd /tmp
+wget -O veracrypt.deb "$DOWNLOAD_URL"
+
+log "Installing VeraCrypt..."
+sudo apt install -y ./veracrypt.deb
+
+rm veracrypt.deb
+
+log "✅ VeraCrypt installed successfully!"
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Usage:"
+echo ""
+echo "  GUI:"
+echo "    veracrypt"
+echo ""
+echo "  Create encrypted container:"
+echo "    1. Launch VeraCrypt"
+echo "    2. Click 'Create Volume'"
+echo "    3. Choose 'Create an encrypted file container'"
+echo "    4. Follow wizard"
+echo ""
+echo "  Mount existing container:"
+echo "    1. Launch VeraCrypt"
+echo "    2. Select slot (1-20)"
+echo "    3. Click 'Select File'"
+echo "    4. Choose your .vc file"
+echo "    5. Click 'Mount'"
+echo "    6. Enter password"
+echo ""
+echo "⚠️  Security Tips:"
+echo "  - Use strong passwords (20+ characters)"
+echo "  - Store backup of volume header"
+echo "  - Never forget your password (no recovery!)"
+echo "  - Unmount before shutdown/sleep"
+echo ""
+echo "📖 Documentation: https://veracrypt.fr/en/Documentation.html"
--- a/tools/yubico/README.md
+++ b/tools/yubico/README.md
@ -0,0 +1,129 @@
+# Yubico Tools Suite
+
+Hardware security key management and authentication tools for YubiKey.
+
+## What's Included
+
+| Tool | Purpose |
+|------|---------|
+| **YubiKey Manager** | GUI to configure YubiKey settings, FIDO2 PIN, OTP slots, PIV |
+| **Yubico Authenticator** | TOTP/HOTP authenticator using YubiKey hardware |
+| **yubico-piv-tool** | Command-line PIV/Smart Card operations |
+
+## Threat Model
+
+**Protects Against:**
+- Phishing attacks (FIDO2/WebAuthn is phishing-resistant)
+- TOTP code theft from compromised phone
+- Password-only authentication weaknesses
+- Remote key extraction (keys never leave hardware)
+
+**Use Cases:**
+- 2FA for online accounts (GitHub, Google, AWS, etc.)
+- Password-less authentication via FIDO2
+- SSH authentication with hardware keys
+- Code signing with PIV certificates
+
+## Installation
+
+```bash
+./install.sh
+```
+
+This will:
+1. Install system dependencies (pcscd, smart card libs)
+2. Download and install YubiKey Manager AppImage
+3. Download and extract Yubico Authenticator
+4. Download and extract yubico-piv-tool
+5. Create launch scripts in ~/bin/
+6. Create .desktop entries for app menu
+
+## Dependencies
+
+Installed automatically:
+- `pcscd` - PC/SC smart card daemon
+- `libpcsclite1` - Smart card library
+- `libccid` - CCID driver for smart cards
+- `libfuse2` - Required for AppImages
+- `libu2f-udev` - udev rules for U2F devices
+
+## Usage
+
+### YubiKey Manager
+```bash
+yubikey-manager
+# or
+~/opt/yubico/yubikey-manager.AppImage
+```
+
+Configure:
+- FIDO2 PIN
+- OTP slots (Yubico OTP, static password, HOTP, Challenge-Response)
+- PIV certificates and PINs
+- Reset YubiKey to factory settings
+
+### Yubico Authenticator
+```bash
+yubico-auth
+# or
+~/opt/yubico/authenticator/authenticator
+```
+
+Features:
+- Scan QR codes to add TOTP/HOTP accounts
+- Codes stored on YubiKey (not on computer)
+- Touch YubiKey to reveal codes
+- Works across devices (codes travel with YubiKey)
+
+### yubico-piv-tool
+```bash
+~/opt/yubico/piv-tool/bin/yubico-piv-tool --help
+
+# Generate key in slot 9a
+yubico-piv-tool -a generate -s 9a -A RSA2048
+
+# Import certificate
+yubico-piv-tool -a import-certificate -s 9a -i cert.pem
+```
+
+## Security Best Practices
+
+1. **Set a strong FIDO2 PIN** - Required for WebAuthn
+2. **Set PIV PINs** - Default is 123456, change immediately
+3. **Keep backup keys** - Have a second YubiKey registered
+4. **Store recovery codes** - For accounts using YubiKey 2FA
+5. **Use touch requirement** - Enable touch for TOTP generation
+
+## Troubleshooting
+
+### YubiKey not detected
+```bash
+# Check pcscd service
+sudo systemctl status pcscd
+
+# Restart pcscd
+sudo systemctl restart pcscd
+
+# Check USB
+lsusb | grep -i yubico
+```
+
+### Permission issues
+```bash
+# Add user to plugdev group
+sudo usermod -aG plugdev $USER
+# Log out and back in
+```
+
+### AppImage won't run
+```bash
+# Ensure libfuse2 is installed
+sudo apt install libfuse2
+```
+
+## Resources
+
+- [YubiKey Manager docs](https://docs.yubico.com/software/yubikey/tools/ykman/)
+- [Yubico Authenticator docs](https://docs.yubico.com/yesdk/users-manual/application-oath/authenticator.html)
+- [PIV Tool docs](https://developers.yubico.com/yubico-piv-tool/)
+- [YubiKey Setup Guide](https://support.yubico.com/hc/en-us/articles/360013714479)
--- a/tools/yubico/install.sh
+++ b/tools/yubico/install.sh
@ -0,0 +1,238 @@
+#!/bin/bash
+set -euo pipefail
+
+# ==============================================================================
+# Yubico Tools Installation Script
+# ==============================================================================
+# Installs the Yubico suite for YubiKey management and authentication
+#
+# Tools Installed:
+#   - YubiKey Manager (GUI) - Configure YubiKey settings, PINs, FIDO2, etc.
+#   - Yubico Authenticator - TOTP/HOTP authenticator using YubiKey
+#   - yubico-piv-tool - PIV (smart card) functionality
+#
+# Threat Model:
+#   - Phishing-resistant 2FA with hardware tokens
+#   - Password-less authentication via FIDO2/WebAuthn
+#   - Hardware-backed TOTP codes (can't be stolen from phone)
+#   - PIV/Smart card authentication for SSH, code signing
+#
+# Source: https://developers.yubico.com/
+# ==============================================================================
+
+# Colors
+readonly GREEN='\033[0;32m'
+readonly YELLOW='\033[1;33m'
+readonly RED='\033[0;31m'
+readonly BLUE='\033[0;34m'
+readonly NC='\033[0m'
+
+log() { echo -e "${GREEN}[INFO]${NC} $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+header() { echo -e "${BLUE}=== $* ===${NC}"; }
+
+INSTALL_DIR="${HOME}/opt/yubico"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+header "Yubico Tools Installation"
+echo ""
+echo "This script will install:"
+echo "  1. YubiKey Manager Qt (AppImage)"
+echo "  2. Yubico Authenticator (for TOTP/HOTP)"
+echo "  3. yubico-piv-tool (PIV/Smart Card support)"
+echo ""
+echo "Install location: $INSTALL_DIR"
+echo ""
+read -p "Continue? [Y/n]: " confirm
+[[ "${confirm:-Y}" =~ ^[Nn] ]] && exit 0
+
+# ==============================================================================
+# Install Dependencies
+# ==============================================================================
+header "Installing Dependencies"
+
+log "Installing system packages for smart card and YubiKey support..."
+sudo apt update
+sudo apt install -y \
+    pcscd \
+    libpcsclite1 \
+    libpcsclite-dev \
+    swig \
+    libccid \
+    libfuse2 \
+    libu2f-udev \
+    yubikey-personalization \
+    python3-pip \
+    python3-venv \
+    qtwayland5 \
+    libqt5waylandclient5
+
+# Start pcscd service
+log "Enabling pcscd service..."
+sudo systemctl enable pcscd
+sudo systemctl start pcscd
+
+# ==============================================================================
+# Create Install Directory
+# ==============================================================================
+mkdir -p "$INSTALL_DIR"
+cd "$INSTALL_DIR"
+
+# ==============================================================================
+# Install YubiKey Manager Qt (AppImage)
+# ==============================================================================
+header "Installing YubiKey Manager Qt"
+
+MANAGER_URL="https://developers.yubico.com/yubikey-manager-qt/Releases/yubikey-manager-qt-latest-linux.AppImage"
+log "Downloading from: $MANAGER_URL"
+
+curl -L -o yubikey-manager.AppImage "$MANAGER_URL"
+chmod +x yubikey-manager.AppImage
+
+# Create desktop entry
+log "Creating desktop entry..."
+mkdir -p ~/.local/share/applications
+cat > ~/.local/share/applications/yubikey-manager.desktop << EOF
+[Desktop Entry]
+Name=YubiKey Manager
+Comment=Configure your YubiKey
+Exec=env QT_QPA_PLATFORM=xcb ${INSTALL_DIR}/yubikey-manager.AppImage
+Icon=yubikey-manager
+Type=Application
+Categories=Utility;Security;
+Terminal=false
+EOF
+
+log "✅ YubiKey Manager installed"
+
+# ==============================================================================
+# Install Yubico Authenticator
+# ==============================================================================
+header "Installing Yubico Authenticator"
+
+AUTH_URL="https://developers.yubico.com/yubioath-flutter/Releases/yubico-authenticator-latest-linux.tar.gz"
+log "Downloading from: $AUTH_URL"
+
+curl -L -o yubico-authenticator.tar.gz "$AUTH_URL"
+tar -xzf yubico-authenticator.tar.gz
+rm yubico-authenticator.tar.gz
+
+# Find extracted directory (version varies)
+AUTH_DIR=$(find . -maxdepth 1 -type d -name "yubico-authenticator*" | head -1)
+if [ -n "$AUTH_DIR" ]; then
+    mv "$AUTH_DIR" authenticator
+
+    # Create desktop entry
+    cat > ~/.local/share/applications/yubico-authenticator.desktop << EOF
+[Desktop Entry]
+Name=Yubico Authenticator
+Comment=TOTP/HOTP authenticator for YubiKey
+Exec=${INSTALL_DIR}/authenticator/authenticator
+Icon=yubico-authenticator
+Type=Application
+Categories=Utility;Security;
+Terminal=false
+EOF
+
+    log "✅ Yubico Authenticator installed"
+else
+    warn "Could not find authenticator directory after extraction"
+fi
+
+# ==============================================================================
+# Install yubico-piv-tool
+# ==============================================================================
+header "Installing yubico-piv-tool"
+
+PIV_URL="https://developers.yubico.com/yubico-piv-tool/Releases/yubico-piv-tool-latest.tar.gz"
+log "Downloading from: $PIV_URL"
+
+curl -L -o yubico-piv-tool.tar.gz "$PIV_URL"
+tar -xzf yubico-piv-tool.tar.gz
+rm yubico-piv-tool.tar.gz
+
+# Find extracted directory
+PIV_DIR=$(find . -maxdepth 1 -type d -name "yubico-piv-tool*" | head -1)
+if [ -n "$PIV_DIR" ]; then
+    mv "$PIV_DIR" piv-tool
+
+    # Add to PATH hint
+    log "piv-tool binaries at: ${INSTALL_DIR}/piv-tool/bin/"
+    log "✅ yubico-piv-tool installed"
+else
+    warn "Could not find piv-tool directory after extraction"
+fi
+
+# ==============================================================================
+# Create launch scripts
+# ==============================================================================
+header "Creating Launch Scripts"
+
+mkdir -p ~/bin
+
+# YubiKey Manager launcher (use xcb backend for Wayland compatibility)
+cat > ~/bin/yubikey-manager << EOF
+#!/bin/bash
+# Use xcb (X11) backend - more reliable than Wayland for this AppImage
+export QT_QPA_PLATFORM=xcb
+exec ${INSTALL_DIR}/yubikey-manager.AppImage "\$@"
+EOF
+chmod +x ~/bin/yubikey-manager
+
+# Yubico Authenticator launcher
+cat > ~/bin/yubico-auth << EOF
+#!/bin/bash
+exec ${INSTALL_DIR}/authenticator/authenticator "\$@"
+EOF
+chmod +x ~/bin/yubico-auth
+
+log "✅ Launch scripts created in ~/bin/"
+
+# ==============================================================================
+# Verify Installation
+# ==============================================================================
+header "Verifying Installation"
+
+echo ""
+echo "Installed components:"
+[ -f "$INSTALL_DIR/yubikey-manager.AppImage" ] && echo "  ✅ YubiKey Manager AppImage" || echo "  ❌ YubiKey Manager"
+[ -d "$INSTALL_DIR/authenticator" ] && echo "  ✅ Yubico Authenticator" || echo "  ❌ Yubico Authenticator"
+[ -d "$INSTALL_DIR/piv-tool" ] && echo "  ✅ yubico-piv-tool" || echo "  ❌ yubico-piv-tool"
+systemctl is-active --quiet pcscd && echo "  ✅ pcscd service running" || echo "  ⚠️  pcscd service not running"
+
+# Check for YubiKey
+echo ""
+log "Checking for connected YubiKey..."
+if lsusb | grep -qi "yubico\|yubikey"; then
+    echo "  ✅ YubiKey detected!"
+    lsusb | grep -i "yubico\|yubikey"
+else
+    warn "No YubiKey detected. Plug one in to use the tools."
+fi
+
+# ==============================================================================
+# Usage Instructions
+# ==============================================================================
+echo ""
+header "Installation Complete"
+echo ""
+echo "Usage:"
+echo "  yubikey-manager    - Launch YubiKey Manager GUI"
+echo "  yubico-auth        - Launch Yubico Authenticator"
+echo ""
+echo "YubiKey Manager can:"
+echo "  - Reset and configure YubiKey"
+echo "  - Manage FIDO2 PIN"
+echo "  - Configure OTP slots"
+echo "  - Manage PIV certificates"
+echo ""
+echo "Yubico Authenticator:"
+echo "  - Store TOTP/HOTP codes on YubiKey"
+echo "  - Codes stored in hardware (phishing-resistant)"
+echo "  - Scan QR codes to add accounts"
+echo ""
+echo "PIV Tool (command line):"
+echo "  ${INSTALL_DIR}/piv-tool/bin/yubico-piv-tool --help"
+echo ""
+echo "📖 Documentation: https://developers.yubico.com/"