I hate this excuse because it’s so incredibly easy to keep records without keeping the account itself active. I work in healthcare and we have to do shit like this all the time with archiving patients records into an offline storage and then destroying their “hot” accounts to comply with two different incompatible laws.

unique screens have unique canvas fingerprinting.

Exactly what I just said? Don’t use unique screens and you are less identifiable. The most anonymous browser is a freshly wiped two year old Apple device running safari or chrome from a university campus or coffee shop. A million other laptops have the same base canvas fingerprint.

Fewer people use Linux. Fewer people use specialized browsers. Fewer people have external displays. All those things make you easier to fingerprint than a vanilla machine.

Is it possible you misread what I typed?

The least unique setup is not to keep doing more special shit. You underestimate how many people run a vanilla safari or chrome browser on a MacBook with no external displays.

Linux, external monitor, special browser? That all makes you more unique

I was suggesting to do neither and run the container directly. Putting k8s on top of lxc is still completely stupid. Just run k8s bare metal to operate your containers.

Run docker within lxc within proxmox. This gave me an aneurism. You’ve lost the whole point of not actually virtualizing with containers by putting in two layers deep in virtualization. At this point your shit is so convoluted why don’t you just run kubernetes

VPN is inherently not zero trust. You really should be moving to ZTN based tools

Seconding the other comment, lots of orgs picked .lan and then over the last few years have moved things into the cloud and .lan has become a meaningless soup since half the shit isn’t even on local network. Now it just means “needs a vpn or ztn to talk to”

Luckily my last three orgs finally bought a second domain for private dns. It’s quickly becoming a pattern that myorg.com owns myorg.tech or whatever for private traffic. Domains are cheap as fuck compared to everything else a business spends money on, it’s really silly how many people are using hacks for this

When we wrote malware in labs in college one of the first places we looked was unemptied trash. This is almost certainly a pattern that’s going to leave your crap in trash in plaintext and even the dumbest script kiddie will find it the very first time you slip and something gets in your system.