1. Identity Isolation
The foundation of operational security is absolute compartmentalization. You must never mix your real-life identity (clearnet) with your Tor identity. A single crossover event permanently compromises the anonymous persona.
- No Reuse: Do not reuse usernames, passwords, or variations of credentials that you have used on clearnet sites.
- No Contact Info: Never give out personal email addresses, phone numbers, or social media handles.
- Hardware Integrity: Maintain dedicated operating environments (like Tails OS) for deep web navigation.
2. Connection Defense & Verification
Adversaries continually deploy Man-in-the-Middle (MitM) attacks to intercept credentials and divert financial deposits. Trusting unverified routing paths is the leading cause of compromised sessions.
MANDATORY: Verifying the PGP signature of the onion link is the ONLY way to be sure you are connected to the genuine infrastructure.
Do not trust links sourced from random wikis, public forums, or Reddit threads. Always cross-reference the routing signature against the public key blocks provided by authoritative archival systems.
3. Tor Browser Hardening
The standard Tor Browser configuration is designed for general accessibility, not high-tier security. You must harden the configuration to prevent tracking scripts and environmental fingerprinting.
Security Level
Set the Tor Browser security slider to "Safer" or "Safest" immediately upon launch.
Disable Scripts
Ensure JavaScript is completely disabled via NoScript where possible to prevent execution exploits.
Window Dimensional Fingerprinting
Never resize the Tor browser window. Maxmizing or dragging the window dimensions allows specific pixel-mapping trackers to fingerprint your unique monitor resolution.
4. Financial Hygiene
Blockchain ledgers are public, permanent, and actively analyzed by highly funded chain-analysis firms. Poor financial routing will inevitably link your clearnet identity to decentralized transactions.
- CRITICAL ERROR: Never send cryptocurrency directly from an exchange (e.g., Coinbase, Binance, Kraken) to a decentralized market wallet. This triggers automated compliance bans and establishes a direct paper trail.
- Intermediary Buffers: Always route funds through an intermediary personal wallet (such as Electrum for BTC or specific Monero GUI wallets) that you control locally.
- Asset Selection: The recommended protocol is the exclusive use of Monero (XMR) over Bitcoin (BTC). Monero utilizes ring signatures and stealth addresses to obscure the sender, receiver, and amount.
5. PGP Encryption (The Golden Rule)
"If you don't encrypt, you don't care."
Pretty Good Privacy (PGP) is the non-negotiable standard for secure communication. You must assume that any server you interact with will eventually be seized or compromised. The only defense is client-side encryption.
Client-Side Only: All sensitive data (such as shipping addresses or personal notes) must be encrypted locally on your own computer before pasting it into any web form.
Never Auto-Encrypt: Never use a checkbox that says "Auto-Encrypt for Vendor" on a marketplace website. Relying on server-side encryption implies trusting the server with your plaintext data, completely negating the purpose of encryption.