Practical Privacy: Tools, Tradeoffs, and Real Threat Models

Most discussions of crypto privacy collapse a wide range of distinct concerns into a single fuzzy slogan: "be private." That is not actually a goal. A goal is something concrete enough to evaluate. Without a threat model, you cannot tell whether a tool is helping you, hurting you, or simply a placebo. A **threat model** is a structured answer to two questions: what are you trying to protect, and from whom? In cryptography it is a habit of mind. The same wallet practice that defeats your nosy neighbor will not defeat a nation-state intelligence service, and the techniques that protect a journalist's sources are completely different from the ones that protect a small business's payroll. The right tool depends on the right threat. Consider a typical user landscape: A **retail investor** in a stable democracy who buys $200 of ETH on Coinbase faces almost no privacy threat from the state and meaningful threat only from blockchain-analysis-driven phishing, address poisoning, and casual neighbors who stumble across an ENS name. Her threat model is dominated by **information leakage to peers** and to **automated scammer pipelines**. A **freelancer paid in stablecoins** by international clients has a different model. He needs to not reveal his salary to competitors, but he is fully prepared to disclose income to his tax authority. His threat is **commercial intelligence**, not the state. A **small business** paying suppliers and contractors faces threats both from competitors (who can map the supply chain) and from large customers (who can deduce margins). Privacy here is operational hygiene, comparable to not publishing your accounts payable on your homepage. A **journalist** working with whistleblowers needs to receive payments from sources without those sources being unmasked. Her threat model includes **state-level adversaries**, **forensic blockchain analysis**, and **physical surveillance** correlated with on-chain timing. A **dissident or political organizer** in an authoritarian regime is in the most demanding category. The adversary is the state, the consequences of failure are imprisonment or worse, and the available margin for error is near zero. For this user, even strong tools like Monero may not be enough without disciplined operational security around them. An **abuse survivor** trying to leave a controlling partner needs to receive funds, accumulate savings, and send payments without those flows being visible to the abuser. The threat model is **insider access** — the abuser already knows the victim's name, possibly her devices, and may have malware on her phone. Pure on-chain privacy does little if the abuser controls the device that displays the wallet. Different users, different adversaries, different defenses. The first step in any serious privacy practice is to write down — on paper, for yourself — what you are trying to protect, who you think might want to see it, and what the realistic worst-case consequences are if they do. Everything else flows from that.