Internet/data security - looking for basic advice

[Sherkel]

I'm starting to realize the importance of security on the internet and with my data in general. I'm looking for some advice on how to improve my rather vulnerable setup and also have a few questions.

I currently have basic knowledge of how to use Tor, though I rarely use it. Out of curiosity, I made a 30 GB TrueCrypt volume guarded with a fake password (leading to random shit) and a real password (64 characters and leads to my porn/journal/etc.) Currently, I'm thinking of making a ~300 GB volume just like that with a VM set up for Tor inside it. Keep in mind that I have no especially strong need for maximum security (I'm not going to spread a RAT to 10,000 comps and DDoS the US government's servers or anything like that,) but just want to feel reasonably safe behind this screen.

My questions:
How secure is the setup I described, provided ALL internet usage is done on the VM?
How do you set up a separate VM to act as a firewall?
I've downloaded tons of torrents on this computer. Is it worth it to wipe the entire HDD, or could I just remove all pirated content and download logs?
How should I conduct myself on forums in general to ensure optimal anonymity?

I'd prefer if answers were noob-friendly.

[Revalin]

It depends what you want to be secure against.  Using an encrypted volume for the VM makes it so that someone with physical access to your computer cannot see your data without the key - it provides local secrecy.  Using TOR makes it so the people you're connecting to cannot see your identity - it provides anonymity.  Neither of these inherently strengthens the other.

Actual security depends on other factors.  If the web browser in your VM has a security vulnerability, the site you connect to could exploit it to disclose your IP address and upload a copy of all the files in the VM.  If the VM has a vulnerability they may be able to view the rest of your computer as well.  To protect against this you need to run the latest versions of each.

One good option is to use Tails on a dedicated netbook with no hard drive, just a CD drive.  Tails at least makes sure that all internet traffic goes through TOR (it firewalls everything else off) and that no logs are kept after you shut down, and using a dedicated netbook prevents access to your data, but it still can't prevent disclosing your IP if there is a vulnerability in the included software.

[Sherkel]

Thanks for pointing that out. I suppose anonymity would be more practical than local secrecy, provided I'm careful about who sees my comp. Also, Tails looks amazing. I could run it off of a USB stick anywhere and only ever save stuff to my main computer, right?