Chapter 5 · Attacks & Defenses· Beginner· ~11 min

Privacy, Tracking, Tor

Security keeps secrets safe. Privacy decides who gets to know they exist. They overlap, but they aren't the same thing.

You will learn

  • The difference between security, privacy, and anonymity
  • The main ways you're tracked online today, and which ones VPNs fix
  • What Tor does, and what it doesn't
  • A short list of practical, non-paranoid privacy moves

Three different things

  • Security, the technical control of who can read or change what.
  • Privacy, who has the right to know it exists or to use it, separate from whether they can technically access it.
  • Anonymity, the ability to act without your identity being linked to the action.

You can have one without the others. An encrypted message to a service you trust is secure but not anonymous, the service knows it's you. Tor traffic is anonymized but not private from the destination if you log in once.

How tracking actually works

It is rarely one big thing. It is many small ones combined.

  • Cookies, especially third-party ones, link visits across sites. Browsers are slowly killing third-party cookies, with mixed success.
  • Logins are the loudest signal of all. The moment you sign in, every privacy trick from before that point is undone.
  • Browser fingerprinting. Your fonts, screen resolution, time zone, GPU, and a few dozen other things combine into a near-unique signature, even with cookies off.
  • IP address. Coarse but persistent. The same one on your home network for months.
  • Email-as-identifier. Newsletters, receipts, and account recoveries glue your identity together across companies.
  • Real-world signals. Loyalty cards, payment methods, mobile location, device IDs.

What VPNs actually change

Briefly: a VPN swaps which network sees your traffic and which IP the destination sees. That helps with:

  • Hiding what you do from the local network (ISP, coffee shop).
  • Avoiding region-blocking based on IP.

It does not:

  • Stop fingerprinting.
  • Hide your identity from any site where you're logged in.
  • Make you anonymous to the VPN provider itself.

Tor, in plain terms

Tor is a network of volunteer-run relays that routes your traffic through three of them before it reaches the destination. Each relay peels off one layer of encryption (hence the name "onion routing").

The effect:

  • The first relay ("guard") knows your IP but not where you're going.
  • The middle relay knows neither end.
  • The exit relay knows where you're going but not who you are.

Used with the Tor Browser, this gives strong network-level anonymity. The Tor Browser also normalizes every user's fingerprint so the page can't single you out by it.

Tor doesn't cancel logins

If you sign into any site while on Tor, that site knows it's you and can connect that visit to everything else you do there. Tor is anonymity from the network, not from the destination you authenticate to.

Practical, non-paranoid moves

  1. Use a browser with sensible defaults (Firefox with Enhanced Tracking Protection, or Safari).
  2. Block third-party cookies. It's a near-free win.
  3. A reputable content blocker (e.g. uBlock Origin) cuts most ad-tech tracking and improves load times.
  4. Use email aliases (Hide-My-Email, SimpleLogin) for low-trust signups. Limits the "everything is keyed by your email" problem.
  5. Be deliberate about logins. Logged in is loud; logged out is much quieter.
  6. If you have a specific threat (journalist, activist, abuse victim), get specific advice, not generic VPN ads. Tor Browser plus operational discipline is the serious answer.

Privacy is not all-or-nothing

You don't need to disappear to be meaningfully more private. The biggest gains come from a handful of habits, not from running a hardened OS on a burner laptop.

Take the quiz