Torzon Market OPSEC Tutorial: Hardening Your Setup, Keeping Privacy & PGP MechanicsA genuine onion address cannot protect you from a browser running scripts or a desktop saving sensitive data to disk. Deal with your side first. This tutorial starts with identity separation and Tor Browser settings, then moves to the operating system, password storage, and local PGP encryption.
Your regular browser and this session should not share a history.
Open an onion address from the browser you use for email and work, and you mix two sessions that should stay apart. Scripts and local files add more ways to leave a trace. Start with a separate browser session before worrying about what the site does on its end.
Keep bookmarks, history, and downloads out of your everyday browser. An address from a chat, video, or forum post needs independent verification. The three mirrors listed on Home are a starting point, not a substitute for checking the signature yourself. Set up Tor Browser before you open one.
Download Tor Browser from torproject.org. Check its security settings before opening a v3 onion address.
about:config, set javascript.enabled to false. On Tor Browser 14.0+, check whether privacy.resistFingerprinting.spoofOsInUserAgentHeader is available before changing it. Browser settings can change between releases.
Safest uses NoScript to restrict active content. Disabling JavaScript in about:config adds a separate control. If the site suddenly refuses to work without scripts, do not change the setting just to get through the page.
Web-to-onion gateways such as onion.ly and tor2web put someone else's server between you and the onion service. Avoid them. If a captcha keeps looping, restart Tor Browser, try New Circuit for this Site, or switch to another mirror after verifying it. If the problem persists, check the site's cookie settings in about:preferences#privacy and allow cookies for that session only.
Browser settings do not control what your operating system saves. Next, look at the device and password vault.
Keep account credentials in an encrypted offline vault and check where your operating system writes data.
Download Tails from its official site and verify the image before making a live USB. With a pre-made drive, you have no way to check what the seller installed. Running Tails in a virtual machine also leaves the host operating system in the picture. If your network blocks Tor, Tails offers obfs4 bridges on its welcome screen.
Store the KeePassXC database in encrypted Tails Persistent Storage. Use a different password of at least 20 characters for each account, and protect the database with a passphrase of five or more random words. Set the clipboard timeout and test it; do not assume a copied password will clear itself.
With browser settings and password storage sorted, move on to PGP keys and local encryption.
Learn which key to share, which one to keep private, and where encryption happens.
PGP lets you check a signature and encrypt a message for someone else. You can share your public key. Keep the matching private key on your own device. For a delivery note, you encrypt with the recipient's public key so the recipient can decrypt it with their private key.
Create a dedicated RSA 4096-bit keypair in Kleopatra. Use a handle unconnected to your everyday accounts and leave out your personal email. Check the exported public-key block for identifying headers. When you import someone else's key, compare its full fingerprint; an eight-character key ID is too easy to confuse with another key.
Import the recipient's public key into Kleopatra and check its fingerprint. Write the delivery note in Kleopatra's Notepad tab, encrypt it there, and paste the resulting BEGIN PGP MESSAGE block into the form. A burn-note website adds another service that can see any plaintext you give it.
The next job is checking the page that asks for your login.
Part 2 puts that keyring to use. You will compare a fingerprint, verify a signed mirror list, and check the login page for signs of a proxy clone. Do that before entering your account details.