WeTheNorth Market OpSec Guide: Safe Access & PGP Verification

The OpSec Chain: Why No Single Tool Guarantees Safety

Darknet operational security works like a chain, and no single setting keeps you safe. A hardened browser on Windows still leaks hardware telemetry to the operating system. An isolated system that opens an unverified mirror still hands your deposit to a phishing clone. PGP does nothing once your private key is compromised. What protects you is compartmentalization, layer by layer.

So drop the idea that a VPN plus Tor makes you anonymous. Your ISP, your operating system, a forum link and a stolen password are four separate ways to get burned. In April 2021 a registrar-level social-engineering attack hijacked major directory domains, and every link on both turned into a phishing clone. Even trusted sources fall, so verify every address yourself, and keep your darknet identity and your real life in separate compartments. Verified addresses live in the signed mirror catalog on the home page.

Step 1: Hardening Tor Browser (Safest Mode and Its Limit)

Download Tor Browser only from torproject.org and set the Security Level to Safest. That disables JavaScript and blocks risky features such as canvas extraction. Keep the window at its default size, because resizing exposes your screen resolution. Tor Browser still cannot hide Tor use from your ISP or stop your host OS from logging to disk.

1. Get it from the source

   Type the address yourself and check the signature or SHA-256 checksum the Tor Project publishes. A fake installer is the cheapest way into your machine.

2. Set the slider to Safest, every launch

   Open Settings, then Privacy & Security, then Security Level. On Tails the slider resets to Standard at every reboot, even with Persistent Storage. If a site demands JavaScript, leave. Use New Identity between sessions.

3. Leave the window alone

   Tor Browser letterboxes the window so every user looks alike. Maximize it and your monitor resolution becomes a fingerprint, trivial to match across visits.

Never open onion links through web gateways like Tor2web. Your login crosses the open internet in plaintext, and the gateway operator can read it.

Safest mode has limits. Your ISP still sees Tor traffic, and your Windows or macOS install keeps writing temp files, cache and swap to disk. No browser setting changes that. Step 2 does.

Step 2: Clean System Isolation (Tails OS, Whonix, ISP Shielding and Mobile Warnings)

Windows and macOS send telemetry, write to your SSD through swap, registry and thumbnails, and attract infostealers. If the device is ever compromised or inspected, the host OS retains residual disk artifacts, swap logs and telemetry regardless of Tor Browser settings. Tails and Whonix exist to prevent that.

Tails OS and Whonix

Tails boots from a USB stick, runs in RAM and erases itself at shutdown. It forces every connection through Tor, resolves DNS inside Tor and spoofs your MAC address. A few habits keep it that way:

• Download it from tails.net and verify the image. A pre-flashed stick can be modified to send your passwords home.
• Update as soon as it asks. Every release fixes security holes you are otherwise exposed to.
• Shut down when you leave for ten minutes or more, and wait for power-off before pulling the stick.
• Don't run it in a virtual machine. If your Mac refuses it, buy a cheap used laptop.

Persistent Storage uses LUKS full disk encryption. Set a passphrase of five or more words and reboot once to confirm your data survives. Lose the passphrase and every key inside is gone.

Whonix runs two virtual machines: a Gateway that handles Tor and a Workstation that reaches the network only through it, so a compromised app can't read your real IP. Host it on Debian or Mint with full disk encryption, never on Windows or macOS. Pick Whonix for a permanent desk and Tails for everything else. Qubes with Whonix is the advanced tier, and a misconfigured one is worse than plain Tails.

Your ISP can't read Tor traffic, but it can see it. On your own network that is usually fine. If Tor use itself is a risk where you live, enable obfs4 bridges on the Tails greeting screen ("connection is censored, filtered or proxied"). The Tails project says a VPN is normally unnecessary, and one in front of Tor adds a logging company to your chain. Public WiFi swaps one risk for cameras and shoulder-surfers. Platform history and node status are in the platform overview.

Mobile: Android for reading, never for money

Mobile is the weakest rung of OpSec. Every iPhone browser runs Apple's WebKit engine, so Tor Browser's protections can't apply in full. Don't use iOS. On Android, GrapheneOS on a Pixel with Orbot or Tor Browser for Android is acceptable for reading the catalog. Cellular service ties the phone to your location, so use a Faraday bag. Don't verify signatures, handle private keys or pay from a phone.

A clean system and a hidden Tor connection still won't save you if you log in to a fake site. That is Step 3.

Step 3: Darknet Phishing Mechanics and Lookalike Domain Spoofing

A phishing clone copies the layout, icons and catalog of the real market down to the last pixel. Version 3 onion addresses are 56 characters long, and nobody reads the middle. Attackers grind out domains that match the first and last characters, then seed them on forums. This is domain squatting, and it works because your eyes check the edges.

The clone's login form captures your password, its fake anti-DDoS captcha screen collects the same data, and at checkout it swaps the wallet address for its own. In the 2021 hijack, buyers with 2FA enabled still lost coins.

Never accept a link from a forum post, a direct message or a "hidden wiki" list. Staff don't message you first. How a page looks proves nothing; a valid signature from the master key does.

Compare the address character by character with the registry on the WTN Hub mirror index. Read the middle too. A clone usually matches the first and last characters and differs somewhere in between.

Step 4: Cryptographic Mirror Verification with Kleopatra and GnuPG

To verify a WeTheNorth mirror, import the market's public key, compare its 40-character fingerprint with the official canary, then verify the signed mirrors.txt.asc in Kleopatra or with gpg --verify. A "Not enough trust" warning is normal. If the fingerprint matches and the signature is good, the registry is authentic.

1. Import the public key from two independent sources

   The mirror's /pgp.txt or this hub is one. A second channel you already trust is the other. A forum post isn't independent, because phishers seed forums first.

2. Compare the fingerprint character by character

   Ten groups of four hex characters, checked against the market's public key: 4A7E 91C3 B508 … 1F9A C472 — example only; this is what the key should look like. Close doesn't count as a match.

3. Verify the signed registry

   Run the check below on the registry file. The first pass takes minutes. After a few repeats it takes ten seconds.

4. Match the address you are on

   A good signature proves only that the list is genuine. The address in your Tor Browser bar must appear in it. Clones post lookalikes that differ by a few characters.

Kleopatra (Gpg4win, preinstalled on Tails)

1. Open the verify dialog

   Choose File, then Decrypt/Verify Files, and select mirrors.txt.asc. For a signed text block, paste it into Notepad and click Decrypt/Verify.

2. Read the text, not the color

   Green means the signature is valid. It does not prove you imported the right key.

3. Open the signer details

   Check the primary fingerprint against the market's public key, group by group.

Terminal (Tails and Linux)

$ gpg --verify mirrors.txt.asc mirrors.txt
gpg: Signature made Thu 08 Oct 2026 14:20:00 UTC
gpg:                using RSA key 4A7E91C3B5082D6F83A17C49E20B56D81F9AC472  — example only; this is what the key should look like
gpg: Good signature from "WTN Official Release Signing Key" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4A7E 91C3 B508 2D6F 83A1  7C49 E20B 56D8 1F9A C472  — example only; this is what the key should look like

The warning looks alarming and is expected. It describes the web of trust: you haven't personally certified this key. It says nothing about the signature. A "BAD signature" is different. It means the file was altered, so close the page.

Last, open /canary.txt. The signed status statement should carry a current date and the hash of a recent Bitcoin or Monero block — a cryptographic freshness proof that confirms key continuity and active operator control over the signing infrastructure. An old date or missing hash means you wait.

Step 5: Account Security with KeePassXC and an Offline Mnemonic Seed

Register and log in only on a mirror you have just verified. Then set the account up so that a single leak can't take it over.

1. Generate the password, never invent it

   KeePassXC creates 25+ random characters and keeps logins, seeds and key passphrases in one encrypted file. Save it to Persistent Storage, or it vanishes at reboot. Memorize only the master passphrase: five or more random words tied into a story.

2. Pick a username that exists nowhere else

   Reusing a forum nickname links your accounts in seconds. Never reuse a username, password or PGP key across two sites, and keep birth years out of handles.

3. Write the mnemonic phrase on paper

   Use a pen. A screenshot syncs to the cloud, a photo carries metadata, and a messenger keeps copies on servers. Whoever holds the recovery phrase owns the account, so store the sheet like cash.

Step 6: Mandatory PGP 2FA: Stolen Passwords Stop Working

PGP 2FA protects the account by encrypting a one-time token to your public key at every login. You decrypt it locally and submit the code. If a phishing mirror steals your password, the attacker still cannot pass the challenge without your private key.

1. Add a dedicated public key

   In Kleopatra choose File, New Keypair, and name it after the account, never after you. Pick 4096 bit, leave email empty and set a strong passphrase. Delete the "Version:" line from the exported public key, since it names your software.

2. Receive the challenge

   On each login the server encrypts a random token to your key.

3. Decrypt it offline and enter the code

   Paste the token into Kleopatra Notepad, click Decrypt/Verify, then type the result into the form.

Use a fresh key pair per account and delete the private key when the account closes. Encrypt sensitive messages yourself, because a market's built-in encryption is processed in plaintext on its server. And 2FA does not replace Step 4: a live relay clone can forward a challenge to you in real time. Verify the mirror first, then let the second factor cover the password.

Read the 2-of-3 multisig escrow guide and Monero payment rules before you fund your wallet, not after.

Common Mistakes: 5 Critical OpSec Errors to Avoid

Asking someone to move the conversation off-platform breaks a marketplace rule, and the account is terminated with no appeal. The 14 platform rules and vendor sanctions are short. Read them before you message anyone.

Troubleshooting & Procedural FAQ

Pre-login checklist

• Tails or Whonix is running and up to date, Tor Browser is on Safest, and the window is untouched.
• mirrors.txt.asc shows Good signature, and your address is in the signed list.
• The fingerprint matches the market's public key, group by group.
• Your password lives in KeePassXC and PGP 2FA is on.
• The mnemonic is on paper, not on a device.

Sources: Tails, Tor Project and GnuPG documentation, and community OpSec documentation.