Security & OpSec

Total compartmentalization is the foundation of operational security. Never allow your real-life identity (clearnet) to intersect with your tor-based identity. This includes usernames, passwords, and stylistic communication habits.

• Do not reuse credentials: Never use a username or password that you have utilized on surface web services, forums, or social media.
• Avoid cross-contamination: Do not access your darknet identities from networks or hardware strictly associated with your personal life without proper virtualization (e.g., Tails OS, Whonix).
• Communication discipline: Never disseminate personal contact information, clearnet email addresses, or identifying regional dialects within marketplace communication channels.

Man-in-the-Middle (MITM) attacks are deployed globally across the tor network to intercept credentials and rewrite cryptocurrency addresses on the fly. You are solely responsible for cryptographic verification of your connection points.

The only absolute method to ensure infrastructure authenticity is to verify the PGP signature of the provided onion address against the known, trusted public key of the administrators.

"If you don't encrypt, you don't care."

Relying on marketplace server-side encryption is a critical vulnerability. If the database is seized or heavily monitored, server-side unencrypted data is instantly readable by unauthorized third parties.

• Client-Side Encryption Only: All sensitive communication, addressing, and specific coordinates must be encrypted locally on your own hardware using software like Kleopatra or GnuPG.
• Never Use Auto-Encrypt: Ignore any "Auto-Encrypt" toggles provided by the web interface. You must manually encrypt the text blockade and paste the resulting PGP armor into the text field.
• Key Management: Backup your private key safely. If you lose access to your private key on a passwordless marketplace, your account cannot be recovered.