1. Identity Isolation
The foundation of operational security requires absolute compartmentalization. You must never mix your real-life identity (clearnet) with your Tor identity.
- >> Username Segregation: Do not reuse usernames, monikers, or variations of handles that you have previously utilized on clearnet sites, gaming forums, or social media.
- >> Password Uniqueness: Passwords must be cryptographically secure and entirely unique. A password manager operating offline (such as KeePassXC) is strictly recommended.
- >> Information Blackout: Under no circumstance should you provide personal contact info, real names, or clearnet email addresses to any vendor or user.
2. MitM Defense & Verification
Man-in-the-Middle (MitM) attacks occur when an adversary intercepts your connection by providing a deceptive routing node. If you authenticate on a compromised node, your credentials and funds will be intercepted.
MANDATORY PROTOCOL:
Verifying the PGP signature of the onion link against the known public key is the ONLY cryptographic method to guarantee you are connected to the authentic infrastructure.
Do not trust URLs posted on random wikis, social media platforms, or unverified forums. Always cross-reference against signed PGP messages provided directly by the platform administration.
3. Tor Browser Hardening
The standard installation of the Tor Browser contains vulnerabilities if not configured to maximum security parameters. You must harden the browser environment prior to network entry.
Security Slider
Navigate to settings and elevate the security slider strictly to "Safer" or "Safest". This disables advanced rendering features utilized by exploits.
NoScript Configuration
Disable JavaScript entirely via the NoScript extension where possible. Active scripts circumvent proxy configurations and leak true IP addresses.
Warning: Window Sizing
Never resize the Tor browser window from its default state. Altering the dimensions allows adversaries to track you via window-size fingerprinting across multiple sessions.
4. Financial Hygiene
Blockchain ledgers are public and immutable. Tracing un-obfuscated transactions from centralized exchanges directly links your real-world identity to network activities.
- >> No Direct Transfers: Never send Bitcoin directly from an exchange (e.g., Coinbase, Binance, Kraken) to market infrastructure. Likewise, never withdraw directly to an exchange.
- >> Intermediary Wallets: Always route funds through a personal, non-custodial intermediary wallet. Electrum is recommended for Bitcoin, and the official Monero GUI for XMR.
Cryptocurrency Preference
The recommended protocol mandates the use of Monero (XMR) over Bitcoin (BTC). Monero implements protocol-level ring signatures, stealth addresses, and confidential transactions, ensuring baseline financial privacy.
5. PGP Encryption (The Golden Rule)
"If you don't encrypt, you don't care."
Pretty Good Privacy (PGP) is non-negotiable. It is the only mathematical guarantee that intercepted communications cannot be decoded by hostile network observers or compromised servers.
Client-Side Only:
All sensitive communications and physical shipping addresses must be encrypted client-side (on your own local machine utilizing software like Kleopatra or GPG4Win) before pasting the ciphertext into the web interface.
Version: GnuPG v2
hQEMA6Bf3QyBwvD/AQf+M9y+R8C1wXyK...
-----END PGP MESSAGE-----
CRITICAL RULE
Never use the "Auto-Encrypt" box provided on any marketplace website. Server-side encryption requires you to transmit plaintext over the network, rendering the fundamental purpose of encryption entirely void.