Privacy and Tor: OpSec Basics

OpSec

OpSec (operational security) describes the actions you take, or don’t take, to protect information about yourself and your activities online.

1. Behaviour online

Behaviour online is one of the most important aspects to take care of if you are serious about privacy. The Internet can remember what you say and post. Before sharing something, think about whether it could identify you or someone else.

Potentially identifying information includes your name, past surnames, nicknames used on other services, address, age, family details, location, current time, photographs, and details about offline activities. Small details can become more revealing when combined.

Every time you are about to post something, read carefully through what you are about to share. Avoid posting personal information that you do not intend to make public. Respect other people’s privacy as well.

2. Usernames & passwords

Do not use weak or predictable passwords. Make sure they do not contain personally identifying information. Use a password manager to generate a unique, long password for each account, and enable multifactor authentication where available.

2.1. Reusing identities

Do not reuse the same username and password across services. A reused name, profile photo, or personal detail can link accounts together. Changing only a username does not guarantee that separate activities cannot be connected.

3. Trust

Be careful about what you share with people you meet online. Verify claims independently, especially when a person or site asks for personal information, files, credentials, or money. You can be courteous while keeping sensible boundaries.

TechSec

Technical settings support good habits; they do not replace them.

4. The right OS

Is there a perfect operating system for private browsing? No. Different tools have different purposes and limitations. Whonix ↗, Qubes OS ↗, and Tails ↗ are worth learning about. Read each project’s documentation and warnings before choosing one.

Tails routes its supported Internet connections through Tor and provides optional encrypted Persistent Storage. This does not make every action anonymous: accounts, files, browser behaviour, and personal details can still reveal information. Follow the official installation guide ↗ and warnings ↗.

5. Encryption

Encryption is important for protecting data stored on devices and drives. Use strong, unique passphrases, keep software updated, and maintain backups you can actually restore. Encryption protects stored content when configured correctly; it does not hide everything you do online.

VeraCrypt ↗ can create encrypted volumes for supported systems. Tails Persistent Storage is encrypted separately; use the Tails instructions ↗ to set it up. Do not assume that an external drive is encrypted just because you are using Tails.

6. Tor setup

Tor Browser’s shield menu provides Standard, Safer, and Safest security levels. If you need stronger protection against risky web features, consider Safer or Safest; some sites may stop working properly. Safest disables JavaScript by default. Use the built-in security settings rather than changing advanced about:config preferences from an old tutorial. See the Tor Browser Manual ↗.

Keep Tor Browser updated. Do not assume that using Tor or Tails prevents malicious files, unsafe downloads, account tracking, or other ways of revealing your identity.

7. PGP

OpenPGP can encrypt and sign messages when you and your correspondent manage keys correctly. It does not make a message anonymous, and it does not protect information outside the encrypted content. Check out GnuPG ↗ and its current documentation ↗. Follow current Tails documentation for the tools included in your installed version.

8. Managing your online footprint

Review old accounts and posts you no longer need. Use each service’s account deletion or privacy controls, and check what information may remain in backups or public archives. Delete sensitive files from devices you own using the device maker’s current guidance before recycling or donating hardware. If you are dealing with a legal matter, seek qualified legal advice before deleting records.