Telegram and Signal are considered safe in of themselves
One thing about the way that is worded.
It makes it sound like there some
equivalence. Unfortunately many users of Telegram
think all their chats are E2EE (when in fact they are not). Even for secret chats, the cryptographic protocols have
not been audited by external cryptographers and are non-standard when compared with battle tested methods such as
Double Ratchet.
Signal does still
require a phone number, and so does Telegram (unless you use their cryptocurrency bullshit thing). A lot are not smart enough to purchase an anonymous VOIP number with crypto. Best to just stay on Matrix (like beast.chat), particularly as invite codes are only given to members of the forum with some post history.
Another Matrix server may provide increased anonymity, as you can de-associate that from previous activity by regularly rotating identities, having said that though, gaining people's trust may be more difficult if you do that. I would avoid Matrix.org's default server as they have been known to be particularly anal on moderation, (and not the kind we like) particularly when people complain. Fortunately with something like the Matrix protocol, anyone can set up a server (like beast.chat), and it can communicate with other servers in a
federated manner, like email providers, not everyone has to be on the same server. There will however be servers (and I think matrix.org may be one of them) which won't support federation to servers like beast.chat.
For VPNs I would stick to those which have had external public audits such as those
recommended by Privacy Guides. The reason for this is because the VPN industry spends a lot of money on marketing, astroturfing (getting mouthpieces to pretend to be independent) rather than gaining trust through providing quality and transparency. Typically you can determine this based on if a site has an affiliate program. Tom Scott has a
great video on that.
We know that all of Privacy Guide's financial donations go through
their OpenCollective org. Any additions to the site go through multiple levels of filtering. Content is generally discussed publicly, drafted, then approved by team members all within public either on their forums or GitHub. They have
no affiliate program and seem to pride themselves on that.
I've seen NordVPN mentioned a few times around here, personally I would
not use them. They've had a couple of issues in the past, one was an
enumeration of accounts, pretty basic mistake that should not have been possible. There were
security issues from a RAT. There
seems to be a pattern. There is the distinct feeling they spend a lot less money on infrastructure, validation and auditing than they do on marketing. Seem to recall them having television adverts in like 60 countries, yet they cannot afford to validate these things do not happen. They spend a
HUGE amount of money trying to game search engine results too.
Brave browser's privacy window, or the built in TOR browser.
There is no substitute for the Tor Browser in regard to fingerprinting, so I would stick to that. There is
a warning on Privacy Guides about that, and in fact the Brave website
as well.
Just a general note on the Linux recommendations. It's important to have a
suitable threat model. Simply using Linux is no better than Windows, unless you're using it for specific reasons. Specific distributions like
TAILS have amnesic properties, meaning that no data (recent files etc) is forensically able to be recovered. When you open files in programs they often have "cache" files which may lead an adversary with physical access directly to the content you've been viewing.
Distributions such as
Qubes-OS may provide further compartmentalization between activities with disposable virtual machines. Tor support is available through the use of
Whonix virtual machines. The way that Qubes-OS and Whonix differ from TAILS is that they contain one virtual machine that is configured to send all traffic through a separate virtual machine running Tor, whereas TAILS uses a firewall and special rules to "pipe" everything into Tor. Qubes, and Whonix can provide increased security against a local threat, such as malware, which is not uncommon in de-anonymization operations these days.
As for "separate laptops", my suggestion is to have a bootable and
removable volume that can be
entirely removed from the system you use and placed in a hidden place in another room. Obviously using strong encryption like
LUKS is a must, but there is no substitute for complete deniability.
Performance can be very good with portable NVMes. The USB 4.0 standard allows for 40Gbit throughput, which you're never going to reach using a web browser.