OPSEC: what it is and how to apply it to protect your privacy

In 1966, the US Army set up a secret group called Purple Dragon with an unusual mission: work out why the enemy was able to anticipate every movement of American troops in Vietnam, even without intercepting encrypted communications. The conclusion was uncomfortable — the soldiers themselves were giving away critical information without realising it, through everyday habits, behavioural patterns and apparently trivial slips. The process that came out of that investigation was named OPSEC, and today it makes more sense for anyone with a smartphone than it does for a soldier in the jungle.

What is OPSEC?

OPSEC (Operational Security) is a systematic method for identifying which pieces of information about you can be used against you — and acting before that happens. The core logic is simple: think like an adversary to work out what they could collect just by watching you from the outside.

Unlike an antivirus or a firewall, OPSEC isn't software. It's a mental and behavioural process. An attacker rarely needs to break into your computer if you're already handing over the information they need for free: an airport check-in announcing that you're not home, a photo with GPS metadata revealing where you live, a password reused from an account that was breached three years ago.

The 5 steps of the OPSEC process

The original process defined by the US armed forces has five stages, and it adapts perfectly to civilian digital life:

1. Identify the critical information: what, if it leaked, would genuinely hurt you? Home address, daily routine, banking details, passwords, real-time location?
2. Analyse the threats: who might want that information? Scammers, stalkers, employers, ex-partners, advertising firms?
3. Analyse the vulnerabilities: where are you already exposed? Open social profiles, old email accounts, sign-ups on sites with a history of breaches?
4. Assess the risks: cross threat with vulnerability — which combination carries the highest probability and impact for your particular profile?
5. Apply countermeasures: concrete actions that reduce the exposure you've identified, without paralysing your life.

What are the most common everyday OPSEC mistakes?

Which OPSEC mistakes do most people make?

The three most frequent are: password reuse, live geolocation in social media posts, and metadata in shared photos. Those three together already give a motivated adversary enough to build a detailed profile — where you live, where you work, your routine, and access to your accounts if one of them shows up in a data breach.

In detail:

• Reused passwords: if you use the same password across several services, a single leak compromises all of them. A credential stuffing attack automates exactly that — testing leaked credentials at scale against hundreds of different services.
• Geolocation in posts: announcing "just got home!" or checking in live broadcasts your location to anyone who follows you — or to any public profile indexed by search engines.
• Metadata in photos: JPEG and PNG files can carry embedded GPS coordinates. Worse: AI systems can estimate your location from the architecture and lighting in a photo alone, even with no metadata — a case documented in March 2026 with the GeoSpy system.
• One email address for everything: using the same address on every sign-up makes cross-service tracking easy and amplifies the impact of a single leak.
• Cross-referenced details on social media: date of birth on Instagram, city on LinkedIn, phone number on Facebook — in isolation they look harmless; together they form a ready-made dossier.

How to apply OPSEC in practice

OPSEC doesn't mean deleting every social account and using nothing but Tor. The idea is proportionality: protect what has real value against real threats. For most people, a basic baseline already removes 80% of the risk.

Passwords and authentication

• Use a password manager — Bitwarden is free and open source; there goes that excuse for putting it off.
• A unique, randomly generated password per service. The manager remembers them for you.
• Enable MFA everywhere that supports it — but prefer a TOTP app (Authy, Google Authenticator) over SMS, which is vulnerable to SIM swap. Push notifications through an app can also be exploited via MFA fatigue — approving without thinking is the vector.

Social media and geolocation

• Turn off location sharing in posts and stories — both in the app and at the operating system level.
• Close your profile to people you don't know: Facebook and Instagram both have granular settings per content type.
• Don't announce that you're away from home in real time. Post the airport photo when you get back.
• Before publishing photos, strip the EXIF metadata. On Windows: right-click → Properties → Details → "Remove Properties and Personal Information". On Linux: exiftool -all= photo.jpg.

Email and digital identity

• Use separate email addresses for different purposes: personal, work, shop and app sign-ups.
• Email alias services (SimpleLogin, addy.io) let you create disposable addresses without opening a new account — the spam goes to the alias, not to your real inbox.
• Encrypted DNS through NextDNS blocks trackers and malicious domains at the network layer, before any connection ever reaches the browser.

What you don't need to do

Unless you're a journalist covering authoritarian governments, a lawyer working sensitive cases or an activist at genuine risk: you don't need Tor for everyday browsing, you don't need to swap your smartphone for a burner, and you don't need to run Tails Linux off a USB stick. Those measures carry a high usability cost and are unnecessary against most common threats.

OPSEC starts with mindset, not with tools

The Purple Dragon lesson from 1966 still holds: your adversary doesn't need to break into anything if you're already handing over what they need. OPSEC is the habit of questioning before you share — who can see this? What could they do with this information? That questioning, applied for 30 seconds before every post, every sign-up and every click, is more effective than any single security product.

If you want to go deeper on secure authentication, see how passkeys with FIDO2/WebAuthn work — the standard that removes passwords from the login process entirely and closes several of the vectors that exploit poor OPSEC habits.