﻿KeinInternet - security concept
===============================

SECRETS (API keys, your own push channel, additional recipients)
  - NEVER stored in plain text and NEVER in config\benutzer.json.
  - Location: sicherheit\tresor\*.ki-geheim, encrypted with Windows DPAPI (scope
    "current user") plus an application key. Only YOUR Windows account on THIS PC can
    open them - a copy (backup, USB stick, stolen file) is worthless.
  - Enter/change:   SCHLUESSEL-EINTRAGEN.bat   (input stays hidden; you are only asked
                    for keys that are useful in your region)
  - Overview:       GEHEIMNISSE-VERWALTEN.bat  (shows only "present"/"missing", never values)
  - Push channel:   benachrichtigung\PUSH-EINRICHTEN.bat (creates your own long random
                    topic for the ntfy app)
  - Rule: NEVER send keys or the push topic via chat, e-mail or photo, and never write them
    into a file - only enter them with these tools.
  - Do NOT pass on the folders sicherheit\tresor and config.

NEW PC / NEW WINDOWS ACCOUNT / RESTORE
  The encrypted files intentionally CANNOT be opened on another PC or account.
  Simply:
    1. Run SCHLUESSEL-EINTRAGEN.bat again (request new free keys if necessary).
    2. Run benachrichtigung\PUSH-EINRICHTEN.bat (create a new topic and subscribe to it again in the ntfy app).
    3. Add other recipients again with benachrichtigung\EMPFAENGER-HINZUFUEGEN.bat.

IF A KEY HAS BEEN DISCLOSED (e.g. accidentally mentioned in a chat)
  Create a new key with the provider, delete/revoke the old one and enter the new one with
  SCHLUESSEL-EINTRAGEN.bat. A disclosed push topic: PUSH-EINRICHTEN.bat -> create a new topic,
  delete the old topic in the app.

THIS PC
  - Links from news feeds are only accepted as http/https.
  - The pages do not load third-party scripts; external texts are displayed defused.
  - SICHERHEIT-HAERTEN.bat (right-click -> "Run as administrator"):
    restricts firewall rules for Kiwix, Python, Node and Ollama to your home network and
    protects the autostart folder against changes by other accounts.

RECOMMENDATION (general)
  - Turn on drive encryption (Windows: BitLocker or "Device encryption"; Windows search
    "Manage BitLocker"). PRINT the recovery key and keep it safe - not only in your online account.
  - Regularly back up the KeinInternet folder to an external drive
    (the secrets in it can only be read on this PC anyway).
