# Tor OPSEC Checklist

## Common Deanonymization Mistakes

1. **Browser fingerprinting** -- Resize Tor Browser window (breaks standard viewport)
2. **Logging into personal accounts** over Tor (links identity to circuit)
3. **Downloading and opening files** outside Tor Browser (may phone home)
4. **Running Tor alongside clearnet** on same machine without isolation
5. **Timezone/locale leaks** -- System timezone differs from Tor exit
6. **DNS leaks** -- Not routing DNS through Tor (use proxy_dns in proxychains)
7. **WebRTC leaks** -- Exposes real IP even through proxy
8. **JavaScript execution** -- Can fingerprint, leak IP, run exploits
9. **Using personal writing style** -- Stylometry can identify authors
10. **Same username/email** across services (obvious)
11. **Uploading photos with EXIF data** intact
12. **Not checking for Tor circuit** before assuming anonymity

## Pre-Session Checklist

- [ ] Tor service running: `systemctl status tor`
- [ ] Check Tor IP: `proxychains4 curl -s ifconfig.me`
- [ ] Verify DNS resolution through Tor: `proxychains4 dig +short example.com`
- [ ] Check for DNS leaks: visit dnsleaktest.com through Tor Browser
- [ ] WebRTC disabled in browser
- [ ] JavaScript disabled (or NoScript active)
- [ ] No personal accounts logged in
- [ ] Timezone set to UTC if using CLI tools
- [ ] MAC address randomized if on WiFi

## Network Isolation (Advanced)

For maximum isolation, use separate network namespaces:
```sh
# Create isolated namespace
ip netns add torns
# Route all traffic through Tor in that namespace
# Use transparent proxy or iptables rules
```

Or use Whonix/Tails for full OS-level isolation.