The Golden Rule: Client-Side PGP
Pretty Good Privacy (PGP) is not optional. It is the only barrier between your data and interception. All sensitive information—especially shipping addresses and communication—must be encrypted on your local machine before it is ever pasted into a browser.
Protocol:
- Obtain the vendor's Public PGP Key from their profile.
- Import the key into your local keyring (Kleopatra, GPG Keychain, or similar).
- Draft your message in a text editor (Notepad, TextEdit).
- Encrypt the message locally using the vendor's public key.
- Copy the resulting ASCII armored block (starting with
-----BEGIN PGP MESSAGE-----) into the website.
Link Verification & Anti-MITM
Man-in-the-Middle (MITM) attacks occur when a malicious actor intercepts traffic between you and the destination, often by presenting a fake version of the site. The only way to mathematically prove you are on the correct server is by verifying the cryptographically signed message from the server.
Verification Process
- Locate the market's signed PGP message (usually found at /verify or on the login page).
- Copy the signed message and signature block.
- Use the market's official Public Key to verify the signature in your PGP software.
- Confirm the timestamp and URL within the signed message match your current session.
Sources to Avoid
- Hidden Wikis (often outdated or malicious).
- Unverified Reddit posts.
- YouTube video descriptions.
- Clear-web search engines.
Identity Isolation
Your Tor identity must be completely air-gapped from your clear-web identity. Cross-contamination of data is the primary cause of de-anonymization.
-
1
Username Hygiene
Never use a username that you have used on Reddit, Steam, Discord, or any clear-web forum. Stylometric analysis can link writing styles across platforms.
-
2
Contact Information
Never provide email addresses, phone numbers, or social media handles in private messages or support tickets. Maintain strict compartmentalization.
Tor Browser Hardening
Security Level
Set Tor Browser Security Level to "Safer" or "Safest". This disables non-essential features like WebGL.
JavaScript
Disable JavaScript completely via NoScript if the site functionality permits. JS can be used for fingerprinting.
Window Size
Do not resize the Tor Browser window. Keep it at default size to blend in with other users (prevent resolution fingerprinting).
Financial Hygiene
Blockchain analysis has advanced significantly. Bitcoin (BTC) is a transparent ledger; every transaction is permanent and public.
Recommended: Monero (XMR)
Monero uses ring signatures, stealth addresses, and RingCT to obfuscate the sender, receiver, and amount. It is currently the industry standard for financial privacy.