People still talk about anonymity like it is one tool. Tor, Signal, a VPN, whatever. That is not how it breaks now.
The weak spots are usually the small edges around the tool.
Your phone number is an account handle. Your recovery email is an account handle. Push notifications leak timing and sometimes metadata. App install lists are fingerprints. Browser extensions are fingerprints. Fonts, canvas, timezone, screen size, WebGL, all of that still adds up. Even if the IP is hidden, the pattern can still be loud.
Passkeys are good for phishing resistance, but they do not make you anonymous. They can tie a device, an account, and a cloud sync setup together. Same with big login providers. Convenient does not mean private.
For real separation, the plain rule is still the best one: separate devices or at least separate OS users/VMs, separate browsers, separate email, separate phone number if one is required, and do not cross-log-in. Do not open the same personal inbox from the same setup. Do not reuse avatars, writing quirks, filenames, EXIF, usernames, or payment trails.
Use Signal if you need good private messaging. Use SimpleX or Session if phone-number linkage is the problem. Use Tor Browser when the browser fingerprint matters, and do not customize it to death. A VPN can hide traffic from the coffee shop or ISP, but it also becomes one more company that sees your traffic.
The hard part is not installing tools. The hard part is not accidentally connecting two lives together at 1:30 in the morning because you were tired and clicked the wrong account.
Anonymity is less cloak-and-dagger than people think. It is mostly compartment discipline.
Lucas // still waiting for the future to finish booting