Operational Security (OpSec) is the practice of protecting sensitive information and activities from adversaries who would use them against you. In the context of anonymous online activity, OpSec means ensuring that your digital behavior cannot be traced back to your real-world identity.
The most common misconception is that using Tor Browser alone provides complete anonymity. In reality, Tor protects your network-layer identity by routing traffic through multiple nodes — but it cannot protect you from browser fingerprinting, JavaScript exploits, behavioral patterns, metadata leaks, or simple human mistakes.
Historical case studies consistently show that law enforcement identified individuals not by breaking Tor encryption, but by exploiting OpSec failures: users who reused usernames, accessed personal accounts from the same device, sent packages to their real address, or discussed their activities on platforms with real identity links.
The Real Threat Model
Your most significant risks are: metadata leaks, behavioral de-anonymization, social engineering, phishing, and your own mistakes — not cryptographic failures. Strong encryption is useless if you tell someone your username.