PRIVACY PRACTICES & OPSEC
Essentials
- Tor Browser hardened, JS disabled for high-risk sessions
- Unique passwords + hardware-key 2FA
- Signal / PGP for comms, VeraCrypt for storage
- Tails or Qubes for isolation
Anti-Phishing
Bookmark one verified source — community reference — verify checksums/PGP, never trust DMs.
Threat Modeling for Researchers
Start with a written threat model before you open Tor: what data must never leak (identity, location, credentials), who you defend against (trackers, phishers, network observers), and what failure costs. The EFF Surveillance Self-Defense framework recommends ranking risks first, then picking tools — not the reverse.
- Compartmentation: separate browser profile / OS (Tails or Qubes) for research only.
- Least privilege: no personal logins, no reused nicknames or PGP keys across contexts.
- Verifiability: bookmark official sources (Tor Project) and check PGP signatures before trusting any mirror list.
Researcher Checklist
- Update OS, browser and GnuPG; enable automatic updates.
- Use a password manager + hardware-key 2FA for every account.
- Set Tor Browser to Safest, keep JavaScript off for high-risk sessions.
- Store notes in a VeraCrypt volume; sanitize file metadata before sharing.
- Cross-check any marketplace claim against at least two independent sources, e.g. our independent market review methodology.
FAQ
Is reading about darknet markets legal?
Learning about Tor, encryption and OpSec is legal in most jurisdictions. Illegal acts remain illegal regardless of network. This site is education-only.
Do I need a VPN with Tor?
Not always. Tor already routes traffic through three relays. A VPN adds a permanent third party that sees you use Tor — useful only for specific threat models such as hiding Tor usage from a local network. See EFF baselines before deciding.
Verified tools → · Pillar guide · Hub Home
Sources
- EFF Surveillance Self-Defense — OpSec baselines.
- Tor Project — browser hardening.