opsec

opsec 是不泄漏的纪律 - 判断对手要识别你需要哪些信息,并确保这些信息永不离开你的电脑。

opsec (operations security) started as military methodology: identify what critical information an enemy needs, figure out how it could leak, and plug those channels. transferred to this scene, the "critical information" is whatever chain links your real identity to your activity - and the leak channels are usually mundane.

the uncomfortable truth is that technical anonymity tools fail socially more often than cryptographically. tor holds, pgp holds - and then someone reuses a username from a clearnet forum, posts a photo with a reflection of their street, or mentions a local holiday in a support ticket. individually harmless details compound into identification.

working opsec habits: separate identities completely (never cross-contaminate browsers or usernames), strip metadata before sharing images, keep personal timelines out of conversations, and assume anything written will eventually be read by your least favorite adversary. paranoia is not required; consistency is.

start with our buyer opsec foundations note for the checklist version, and remember the hierarchy: device security and behavior discipline come before fancy tooling, because no tool compensates for voluntarily handing over the missing puzzle pieces.