Tails can be configured perfectly and still fail you in one careless minute. Almost every real-world privacy failure in Tails is a behaviour failure, not a software failure. These are the mistakes that matter - including the one built into Tails itself, the Unsafe Browser.
The Tails documentation is admirably blunt about this: the system protects you only while you work the way it was designed to be worked. Step outside the design - log into the wrong account, browse in the wrong window, carry files the wrong way - and the protection quietly evaporates while the interface still looks reassuringly private. Learn these failure patterns now, while they are still hypothetical.
Tails includes a tool with a warning in its name: the Unsafe Browser. It exists for exactly one job - signing into captive portals, the login pages on hotel, airport and café Wi-Fi, so that Tor can connect afterwards. To do that job it deliberately connects outside Tor, in the clear.
Its window is styled unmistakably - a red theme and clear warnings - and still, people browse in it because it feels faster. Anything done in the Unsafe Browser is ordinary clearnet activity from your real IP address, simply wearing a Tails costume. Rule: portal login only, close it, then do everything else in Tor Browser.
Anonymity ends where identification begins. The moment you sign into your personal email, your bank, or your social media account inside Tails, you have told that service exactly who is behind this Tor connection - and services keep logs. Worse, using the same account or username in both your private and everyday life welds the two together permanently.
The discipline is separation. Identities used in Tails stay in Tails: created there, used only there, never cross-posted, never checked once from your phone just to peek. One peek is a link, and links are what investigators - and advertisers - are made of.
Tails assumes the hardware is honest. A computer fitted with a hardware keylogger, or one whose firmware is compromised, can record everything before Tails' protections even start. This is why the project itself advises against doing sensitive work on machines you have no reason to trust - a public terminal is convenient and unauditable in equal measure.
Your own machine, kept updated and physically secure, is the intended host. Tails protects the session from the network and from the disk. It cannot protect you from the keyboard you are typing on.
See the Unsafe Browser and Tor Browser side by side in the review video - the visual difference is the warning you must never ignore.
▶️ Watch Full VideoOnly for logging into captive portals - the sign-in pages on public Wi-Fi - so your Tor connection can start working. It does not use Tor and is not private. Everything else belongs in Tor Browser.
Checking it is exactly the uncareful act. The mail provider logs the login, and the account is tied to your real identity, so that session is anonymous to nobody who matters. Keep personal accounts on your personal system.
Tor Browser includes letterboxing specifically to resist screen-size fingerprinting, and it warns you about maximising for this reason. Follow its built-in guidance - the defaults are set the way they are for protection, not decoration.