OPSEC Complete Guide
Operational security determines whether your activity on the Tor network remains private. This guide covers threat modeling, essential tools, behavioral patterns that create risk, and red flags to monitor.
Why Operational Security Matters
The majority of successful law enforcement operations against darknet users are not the result of breaking cryptography. They succeed through operational security failures — leaked metadata, behavioral patterns, reused identifiers, and the gap between what users believe is private and what actually is.
Tor provides network-layer anonymity by routing traffic through three relays, hiding your IP address from the destination server. But Tor does not make you anonymous if you log into a Google account in the same browser session, use the same username across platforms, ship to your home address, or discuss your activities on clearnet forums. Each of these actions creates a linkage that exists entirely outside Tor's protection scope.
Operational security is the practice of systematically identifying what information you need to protect, who wants to collect it, what their capabilities are, and what changes in behavior or tools reduce your exposure. It is a continuous discipline, not a one-time setup.
High-profile darknet arrests have overwhelmingly involved errors like: shipping to home addresses, using the same email across platforms, withdrawing cryptocurrency to KYC-linked accounts, posting personal photos, and using identifiable writing styles. Cryptographic protections were intact in most cases — human behavior was the failure point.
- 01. Reusing usernames or PGP keys across platforms
- 02. Shipping to personal addresses or workplaces
- 03. Using clearnet platforms to discuss activities
- 04. KYC-linked cryptocurrency purchase or withdrawal
- 05. Accessing markets from home IP or work network
- 06. Using shared or previously used hardware
- 07. Consistent writing style identifiable across platforms
- 08. Exposing metadata in photos (EXIF GPS data)
Building Your Threat Model
Before choosing OPSEC tools, define your threat model. Different adversaries have different capabilities and require different defensive responses. A single tool cannot address all threats simultaneously — resource allocation requires prioritization.
ISP / Network Observer
Your ISP can see which addresses you connect to, how much data you transfer, and when. A Tor-only setup (no VPN) hides destination but reveals Tor usage. Tor bridges or a VPN before Tor hides Tor usage from your ISP.
Platform-Level Adversary
A compromised or malicious server operator can see your deposit addresses, order details (if not PGP-encrypted), and behavioral patterns like login times. PGP-encrypting all sensitive data before submission limits this exposure.
Law Enforcement
Law enforcement can subpoena exchange records, request ISP connection logs, conduct physical surveillance, and execute search warrants. The combination of strong network anonymity, non-KYC cryptocurrency, and compartmentalized device use reduces each of these attack surfaces.
Passive Global Surveillance
Nation-state adversaries with access to traffic data across multiple Tor relays can attempt traffic correlation attacks. Using Tor bridges, avoiding predictable patterns, and minimizing session length reduces correlation risk. This threat model requires the strongest defensive posture.
Essential OPSEC Tools
Tor Browser
The foundation of darknet anonymity. Routes traffic through three relays — Guard, Middle, and Exit — hiding your IP from the destination. Download only from torproject.org. Set Security Level to Safest. Never install extensions. Use only one window at a time.
Tails OS
A live operating system that boots from USB and leaves no trace on the host machine. All traffic routes through Tor automatically. Files written to RAM are wiped on shutdown. Persistent encrypted storage available for keys and wallets. Download from tails.boum.org.
Whonix
VM-based isolation using two virtual machines: a Gateway that routes all traffic through Tor, and a Workstation with no direct internet access. Even if the Workstation is compromised, the real IP cannot be leaked. Download from whonix.org.
GnuPG (GPG)
Open-source implementation of the OpenPGP standard for asymmetric encryption and digital signatures. Generates RSA or Ed25519 keypairs. Required for encrypting market messages, verifying signed announcements, and PGP-based 2FA. Available at gnupg.org.
Monero (XMR)
Privacy-native cryptocurrency with protocol-level transaction anonymity. Ring signatures, stealth addresses, and RingCT make every transaction unlinkable and untraceable. The strongest financial privacy tool available to darknet users. Wallets: Feather, Monerujo, CLI.
Tor Bridges
Unlisted Tor relays that conceal Tor usage from network observers. Three types: obfs4 (most common), Snowflake (WebRTC-based, hard to block), and Meek (CDN-based). Obtain bridges from bridges.torproject.org or via email to [email protected].
KeePassXC
Open-source, offline password manager. Stores credentials, PGP passphrases, and account seeds in an AES-256 encrypted database. Never store credentials in a cloud-synced manager — offline-only is mandatory for high-risk accounts. Available at keepassxc.org.
Kleopatra
GUI frontend for GnuPG on Windows and macOS. Simplifies PGP key generation, import, and message encryption/decryption for users unfamiliar with command-line GPG. Part of the Gpg4win package on Windows. Functional alternative to CLI GPG for routine operations.
MAT2 (Metadata Cleaner)
Removes metadata from files before sharing. EXIF data in photos can include GPS coordinates, device model, and timestamp. Documents contain author names, revision history, and software fingerprints. MAT2 strips this metadata from images, PDFs, Office documents, and audio files.
Red Flags and What to Avoid
The following behaviors create identifiable linkages between your anonymous activity and your real-world identity. Avoid all of them.
Account and Identity Red Flags
- Reusing any username, handle, or identifier from clearnet accounts on darknet platforms — even if the clearnet account appears unlinked
- Using the same PGP keypair across multiple platforms over extended periods — generate fresh keys periodically and after any suspected compromise
- Profile photos, avatar descriptions, or writing samples that are distinctive and consistent with clearnet presence
- Using your native language's distinctive grammar patterns — stylometric analysis can link writing samples across platforms with high accuracy
Network and Device Red Flags
- Accessing darknet resources from home Wi-Fi, work networks, or any network associated with your identity
- Using the same device for darknet and personal use — browser fingerprinting data, cached files, and OS telemetry create cross-contamination risk
- Connecting via cellular data from a SIM registered to your name without additional obfuscation
- Logging into personal accounts (email, social media, streaming) in the same Tor Browser session as market access
- Allowing browser notifications, location access, or camera access in any darknet session
Financial Red Flags
- Withdrawing darknet cryptocurrency to KYC-linked exchange accounts — the most common financial linkage error
- Purchasing cryptocurrency via bank transfer or credit card without subsequent privacy-enhancing steps
- Conducting large, round-number deposits that are statistically correlatable with known purchase events
- Using Lightning Network without understanding its privacy implications for Bitcoin (payment channel metadata)
- Allowing blockchain dust (small UTXOs from unknown sources) to remain in wallets used for market transactions
Operational Red Flags
- Shipping to your home address, workplace, or any location associated with your identity
- Discussing pending or completed orders on any clearnet platform including social media, forums, or messaging apps
- Taking screenshots that include identifiable metadata or background information
- Sharing EXIF-containing photos in darknet communications — strip metadata with MAT2 before sharing any image file
Step-By-Step OPSEC Setup
Phase 1 — Dedicated Hardware
Obtain a dedicated device used exclusively for privacy-sensitive activities. A used laptop purchased with cash carries no purchase record linked to your identity. Factory reset the device. Do not create any accounts on it that link to your real identity. Consider installing a privacy-focused OS (Tails or Whonix) rather than using the preinstalled operating system.
Phase 2 — Operating System
For the highest privacy, boot Tails OS from a USB drive. Tails routes all traffic through Tor automatically, leaves no trace on the host machine, and wipes RAM on shutdown. Alternatively, install Whonix in VirtualBox — the Gateway VM handles Tor routing while the Workstation VM provides a working environment. Never use Windows without Whonix for high-risk activities.
Phase 3 — PGP Key Generation
Generate a fresh keypair using GnuPG: gpg --full-gen-key. Choose RSA 4096-bit or Ed25519. Use a strong, unique passphrase stored only in KeePassXC (offline). Export your public key and upload it to the market profile. Use this key exclusively for market communications — never for clearnet identity or email.
Phase 4 — Cryptocurrency Setup
Install Feather Wallet for XMR on your dedicated device. Obtain XMR through Haveno DEX or a peer-to-peer method without KYC. Connect Feather Wallet to Tor for all network operations. Generate fresh subaddresses for each market deposit. Never reuse deposit addresses or send from addresses linked to KYC sources.
Phase 5 — Session Discipline
Keep sessions short and focused. Close Tor Browser after each session. Never multitask between market sessions and personal browsing. Do not save login sessions — re-authenticate each time. Log out before closing the browser. On Tails, everything is wiped on shutdown automatically. On other setups, manually clear browser data after each session.