Darknet OPSEC Threat Models and Compartments

Assets

Identity, location, account access, private keys, messages, transaction records and physical safety.

Adversaries

Phishers, account thieves, service operators, network observers, malware, counterparties and investigators have different capabilities.

Exposure window

A one-time research session and a long-lived pseudonym create different correlation risks.

Failure cost

Decide which failure is merely inconvenient and which one would be irreversible.

A control belongs in the plan only when it reduces a named path from adversary to asset. Complexity without a mapped purpose creates more opportunities for mistakes.

Separate activities so one compromised application or careless file does not expose every identity. Avoid shared clipboards, host-mounted folders, cloud synchronization and personal browser sessions inside the privacy compartment. Keep the host updated and treat firmware, extensions and document viewers as part of the attack surface.

Tails favors amnesic sessions from removable media. Whonix separates a Tor gateway from a workstation in virtual machines. Qubes OS uses security domains and can route selected qubes through sys-whonix. The correct choice depends on hardware, persistence needs and the adversary model.

Once Tor Browser itself is installed and verified, treat security level, bridges and any VPN decision as named controls in the threat model rather than default add-ons. The Tor Browser setup guide owns installer verification, security levels, bridges and Tor-versus-VPN trade-offs.

From an OPSEC view, the remaining jobs are simpler: keep personal browsers and synced accounts out of the privacy compartment, and do not invent a second network path that creates payment or account records the model never accounted for. The Tor Browser security-settings manual remains the primary reference for what Safer and Safest disable.

• Do not reuse usernames, writing signatures, profile images, recovery phrases, passwords or PGP keys across identities.
• Keep recovery material offline and separate from the working device.
• Assume counterparties preserve messages and timestamps.
• Do not discuss one compartment through another identity's email, chat or social account.
• Review account history for facts that can be correlated even when no real name appears.

The account-security guide turns these principles into a registration checklist without claiming a specific market's current form fields.

Documents and images may contain timestamps, author fields, software versions, device identifiers, location data or distinctive formatting. Inspect and sanitize them in the isolated compartment; do not upload an original merely because the visible pixels look harmless.

Encrypt sensitive message content to a verified recipient key, but remember that encryption does not hide every participant, timestamp, message length or compromised endpoint. The PGP guide explains key provenance and plaintext handling.

1. Confirm the intended device, OS compartment and network path.
2. Check updates and verify critical software sources.
3. Confirm no personal accounts, shared folders or synchronized services are present.
4. Compare complete onion addresses and verify signed statements locally where available.
5. Keep secrets and recovery data out of temporary notes, screenshots and clipboard history.
6. Close the session according to the persistence model and record any exception that could link compartments.

Continue with Tor Browser configuration and phishing protection.