Security & OpSec Guide

Complete segregation between your real life (clearnet presence) and your Tor identity is non-negotiable. Operational security fails the moment crossover occurs.

• > 
  Zero Overlap: Never mix real-life identity markers with your Tor identity. Do not browse personal social media on the same network environment.
• > 
  Unique Credentials: Do not reuse usernames, handles, or passwords from clearnet sites. A username tied to an external gaming forum or Reddit account compromises your entire alias.
• > 
  Absolute Silence: Never give out personal contact info, email addresses, or alternate messaging handles (Jabber/Session) that trace back to your real identity.

The Tor network is saturated with "Man-in-the-Middle" (MitM) attacks. Malicious actors clone infrastructure entirely to intercept credentials and cryptocurrency deposits.

• > 
  Source Trust: Do not trust links from random wikis, unverified forums, or Reddit threads. They are highly likely to be malicious clones.
• > 
  2FA Requirement: Always enable PGP 2-Factor Authentication. A MitM attack cannot replicate a signed PGP challenge unless they hold your private key.

Out-of-the-box Tor requires manual configuration changes to achieve maximum defensive posture against deanonymization vectors.

• > 
  Security Level: Always set the Tor Browser security slider to "Safer" or "Safest". This preemptively blocks executable scripts that could contain zero-day exploits.
• > 
  Disable JavaScript: Utilize NoScript to aggressively block JavaScript. DarkMatter infrastructure is designed to function entirely without JS.
• > 
  Window Sizing: Never resize the Tor browser window from its default state. Altering the dimensions allows adversaries to track you via window fingerprinting across different sessions.

Blockchain analysis tools deploy advanced heuristics to trace capital flows. Without strict compartmentation of your funds, chain-analysis will connect your real identity to darknet transactions.

• > 
  No Direct Transfers: Never send cryptocurrency directly from an exchange (Coinbase, Binance, Kraken) to DarkMatter Market or any darknet service.
• > 
  Wallet Intermediary: Use an intermediary personal wallet (such as Electrum for BTC or official Monero GUI desktop wallet) as an airlock between the exchange and your final destination.
• > 
  Monero (XMR) Superiority: The research group strongly emphasizes the use of Monero (XMR) over Bitcoin (BTC). Monero's protocol-level ring signatures and stealth addresses provide default financial privacy.

"If you don't encrypt, you don't care."

Pretty Good Privacy (PGP) is the final layer of defense. In the event of an infrastructure seizure or database breach, encrypted data remains inaccessible to hostile entities.

• > 
  Client-Side Only: All sensitive text (including shipping addresses or private communications) must be encrypted client-side (on your own computer/device) using Kleopatra or Gpg4win BEFORE pasting it into any website input field.
• > 
  NO Auto-Encrypt: Never use the "Auto-Encrypt" checkbox provided by a marketplace UI. Server-side encryption requires you to hand over plaintext data to the server, which completely negates the purpose of PGP.