Security & OpSec Guide

Operational security begins with absolute separation between your real-life identity (clearnet) and your deep web persona. A single point of crossover compromises the entire structure.

• Never mix identities: Do not use names, handles, or avatars associated with your clearnet accounts.
• No credential reuse: Never reuse passwords or usernames from any other website.
• Information discipline: Never divulge personal contact information, location details, or demographic data to vendors or other users. Assume all communication is logged.

Man-in-the-Middle (MITM) attacks are the primary vector for credential theft. Attackers clone market interfaces and intercept data between you and the destination server.

Always manually check the signature of any URL provided against the verified public key of the market before entering credentials.

The Tor Browser provides anonymity out-of-the-box, but advanced network defense requires manual hardening to prevent exploitation via malicious scripts or interface fingerprinting.

• Security Level: Always set the Tor security slider to "Safer" or "Safest". This disables risky web features.
• JavaScript Control: Disable JavaScript entirely (via NoScript) where possible. Only allow it temporarily if absolutely necessary for cryptographic challenges.
• Anti-Fingerprinting: Never resize the Tor Browser window. Retaining the default window size protects against screen resolution fingerprinting.

Blockchain analysis allows tracking of fund movements. Poor financial hygiene breaks anonymity instantly.

• Always use a personal, non-custodial intermediary wallet (e.g., Electrum for BTC, Monero GUI for XMR).
• Recommended: Utilize Monero (XMR) over Bitcoin (BTC). XMR provides protocol-level privacy, obscuring sender, receiver, and transaction amounts.

"If you don't encrypt, you don't care."

All sensitive data transmitted over the network must be encrypted manually by the user before transmission.

• Client-Side Only: All shipping addresses or sensitive messages must be encrypted client-side (on your own local machine using software like Kleopatra or Gpg4win) before pasting into any site.
• Avoid Auto-Encrypt: Never rely on the "Auto-Encrypt" checkbox provided by marketplace websites. Server-side encryption requires you to hand over plaintext data to the server, neutralizing the security benefits of PGP.
• Always enforce 2FA (Two-Factor Authentication) via PGP on your account to prevent unauthorized access even if your password is compromised.