opsec

opsec is the discipline of not leaking - deciding what an adversary would need to identify you and making sure that information never leaves your machine.

opsec (operations security) started as military methodology: identify what critical information an enemy needs, figure out how it could leak, and plug those channels. transferred to this scene, the "critical information" is whatever chain links your real identity to your activity - and the leak channels are usually mundane.

the uncomfortable truth is that technical anonymity tools fail socially more often than cryptographically. tor holds, pgp holds - and then someone reuses a username from a clearnet forum, posts a photo with a reflection of their street, or mentions a local holiday in a support ticket. individually harmless details compound into identification.

working opsec habits: separate identities completely (never cross-contaminate browsers or usernames), strip metadata before sharing images, keep personal timelines out of conversations, and assume anything written will eventually be read by your least favorite adversary. paranoia is not required; consistency is.

start with our buyer opsec foundations note for the checklist version, and remember the hierarchy: device security and behavior discipline come before fancy tooling, because no tool compensates for voluntarily handing over the missing puzzle pieces.