You may often hear three words mentioned together—‘security, privacy, anonymity’. You may think they are about the same matter, but they are actually different things. Security is the protection of information, systems, and devices from unauthorised access, damage, or misuse; privacy is the right to control who can access your personal information and how it is collected or used, while anonymity is a different concept from both.

Many people only care about their security and privacy, but don’t care about their anonymity. Some of them think they don’t need it, while others may think it is far too difficult to achieve. However, in fact, it is much easier to achieve basic, everyday anonymity, which can help a lot depending on your threat model. In this article, I am going to explain anonymity based on my practical experience.

What is anonymity and why it matters

When you hear of anonymity, you may think of Edward Snowden, who created the pseudonym ‘Citizen Four’ and disclosed an unethical and unjust project by the US government, PRISM, which promotes mass surveillance globally, to a group of journalists including Glenn Greenwald, Laura Poitras, Barton Gellman, and Ewen MacAskill. His story was made into the film Citizenfour, which is named after the pseudonym used by him.

Anonymity is the state of carrying out an activity without your real identity being known or revealed. It indeed matters for people with particularly serious threat models, including activists, journalists, whistleblowers, lawyers, etc., to avoid persecution by governments or other organisations.

But this does not mean that anonymity does not matter for ordinary people. Actually, maintaining anonymity whenever possible can greatly help protect your privacy.

For example, none of these activities would be considered sensitive under most people’s threat models:

1. downloading a book about operating systems from Z-Library;
2. having dinner at Karl-Friedrich-Straße 26, 76133 Karlsruhe;
3. participating in a discussion about cryptography in an online forum.

But if these activities are linked to one identity by an observer, they can conclude that the person is very likely to be an undergraduate studying computer science at Karlsruhe Institute of Technology. If the observer also has the real IP address, they can make that inference stronger.

To avoid this, you only need to disconnect these activities from your real identity. And in over 80% of cases, this is very easy to achieve. This is how anonymity works.

The simplest way to achieve anonymity: using Tor Browser

To get started, you only need one tool—Tor Browser. Download it from the official website of the Tor Project, connect, and you are done.

The browser will route your traffic through three randomly chosen servers from the Tor network, making it very difficult for an observer (for example, your ISP) to infer your Internet activities. For different websites, different circuits are chosen, making correlating your activities across websites nearly impossible.

If you are in a heavily censored country, you can obtain bridges from the Tor Project, paste them into the browser, and you are ready to go.

Operational patterns that may compromise anonymity

Tor Browser provides anonymity, but it is not magic—it will help you only if you use it correctly. If your goal is anonymity, signing into accounts on websites while using Tor is a very poor practice, as the website will identify you through your account regardless of whether you are using Tor or not.

Additionally, there are many other fingerprinting factors that may make you stand out, such as browser extensions, window sizes, keyboard patterns, mouse movement patterns, etc. Therefore, here are some other tips for maintaining anonymity when using Tor Browser:

1. Don’t install extensions on Tor Browser.
2. While letterboxing is helpful for reducing fingerprintability, it is still preferable to avoid resizing or maximising your window.
3. Type text in your text editor, then cut and paste it into the text boxes on the pages.
4. Disabling JavaScript is helpful when you have a high-risk threat model.
5. Be cautious of files downloaded from the Internet, especially executables or other files that may connect to the Internet.

Anonymous live sessions with Tails

If you want to do things other than web browsing over Tor, having a Tor daemon running on your computer is very good. Just run sudo apt install tor && sudo systemctl enable tor && sudo systemctl start tor, set your SOCKS proxy to 127.0.0.1:9050, and you are done. However, a Tor daemon itself does not split the traffic as properly as you may want, and ensuring applications use Tor can be painful and troublesome. This is where Tails comes in.

It is a live operating system designed to be booted from a USB drive and built with anonymity in mind. Once it successfully connects to Tor, it will route Internet traffic from the programmes you use through Tor, separate traffic by process, and block traffic if routing is not possible at that time. And each time you boot Tails, it will start a completely fresh session; therefore, it will be difficult to identify you through factors like the operating system, the configurations, etc.

Services that are anonymity-friendly

Since big tech companies want your data and are unlikely to be comfortable with you remaining anonymous, most mainstream online services are highly aggressive towards Tor users, repeatedly triggering reCAPTCHA or Cloudflare Turnstile (Google Search), forcing you to sign in to an account (YouTube), or even refusing to work entirely (Grok). Therefore, it is important to learn about and use some anonymity-friendly services.

Here are some of my recommendations:

1. Duck.ai is a very good LLM service provided by DuckDuckGo. It does not require an account, routes traffic to LLM service providers to enable you to use GPT or other LLMs anonymously, and works very well over Tor.
2. Port87 and Atomic Mail are mail services that do not require KYC and support registration over Tor. You can use them to register disposable email addresses or long-term pseudonymous email addresses for registering accounts. However, they do not support IMAP/SMTP and may not allow you to send emails; if you want a fully functional email address that does not require KYC to register, you can head to cock.li.
3. Invidious is a privacy-friendly YouTube frontend that anonymises you by providing a proxy for fetching YouTube videos. An instance list is available here; many instances support Tor or even provide Tor Onion services!
4. SimpleX is the best choice when you care about anonymity, as it does not require any information about you to obtain a profile and you can throw it away any time when you no longer need a profile. XMPP is also a great choice since most instances are non-KYC and Tor-friendly.

Real-life anonymity recommendations

While you can preserve anonymity with Tor in your daily life online, you can also do so in the physical world with some different approaches.

First, pay in cash and avoid using credit cards when shopping; this will make it much more difficult for retailers and banks to track you. Avoid applying for memberships if you value anonymity more than member benefits. Use tickets instead of travel cards when using public transport.

Pseudonymity in a nutshell

Some people want to have long-term pseudonymity rather than short-term anonymity to preserve relationships and reputations, while still keeping their activities disconnected from their IRL identities. And many people still mistake ‘anonymity’ for pseudonymity.

Indeed, pseudonymity is far harder to achieve than anonymity, as:

1. maintaining a stable and long-term pseudonym will take a great deal of time and effort since you need to act as two or more personas;
2. stylometry and other patterns in your activities will give you away over time as your activities accumulate;
3. one OPSEC mistake may immediately connect your pseudonym to your IRL identity, rendering your efforts for months or even years in vain.

Since I have failed at maintaining pseudonymity myself, having just merged one pseudonym that I failed to maintain into my current identity, I cannot offer much advice. However, I can still share some tips:

1. Create a fake but complete persona that is different from your IRL identity;
2. Adjust your stylometry to make it look as though it came from a different person;
3. Regularly or irregularly retire and rotate your pseudonyms as time goes on;
4. Never tell anyone about the correlation between your IRL identity and your pseudonym, unless you have a specific threat model that allows it.

Conclusion

Security, privacy and anonymity are all fundamental digital rights that we should uphold by using related free software tools wisely, and one often helps or depends on another. Additionally, always consider your threat model; then you can make appropriate trade-offs on these issues.