This public safety guide can be used in either a sequential or modular way for TailsOS, PGP (Pretty Good Privacy), XMR (Monero), DNM
(DarkNetMarket) and general OpSec (Operational Security) improvements,
and the guide doesn't need to be applied fully, yet going sequentially,
step by step, is highly recommended. Following the full guide would be a
one-time investement of about an hour and will continue to pay off in
safety and time saved, every time you use it. I've added an extreme
short-form version of the guide in this preface, and the long form after
the Table of Contents.

This guide is a hommage to the ⚠️DNM Buyer's Bible⚠️.
⚠️AnonymousPlanet⚠️ And of course the /d/OpSec & /d/Tails community on Dread.

The complete guide to use DNM: TailsOS, OpSec, PGP and XMR.

You might think, "Why should I do this when I can just use the Tor Browser already?" Here's why:

Tails OS has a Tor-only connection, encrypted persistent storage, a password keeper (KeepassXC), and has a PGP tool (Kleopatra) installed.
These are all the tools you need to be on the DNM, and it will organize
and separate your normal life from your Dark Web life.
You've made it this far to the DNM, but you're just human, and you will fuck up in ways you don't even understand until it's too late.

The guide is meant for DarkWeb (DW) users who do any of the following:

Use Tor with Windows. And don't separate their normal activity from their DW activity.
Save their unsafe passwords and PGP information in a notepad on their Windows environment.
Have little understanding of OpSec tech and subsequent nomenclature.
Don't know how to get or use XMR.
Don't even know how to use PGP and send their private data as an non-encrypted cleartext to their vendor.

For you, this will be your reference guide.
For IT professionals and extreme theat models, look elsewhere: ⚠️ Qubes+Whonix⚠️
Don't worry about Qubes/Whonix ''being better''. OpSec is a
relative-to-the-circumstances matter. OpSec is about balance, to do what
is necessary for your threat model. There's often a sacrifice of
convienience for security, and Tails will be more than enough for most
cases. If you want perfect digital OpSec, get rid of all your digital
devices.

With this guide I want to find a balance between preventing bad OpSec
practises people use (often based on ignorance and false hope), and
helping people to educate themselves in a reasonably simple & safe
matter, without having an information overload.
I'll give you the extreme short-form now, and long-form will come after the Table of Contents:

Get 2x USB 3.0 with 16GB minimum. For Tails + backup.
Download Tails OS and follow their instructions step by step: https://tails.net/install/index.en.html
This one too: https://tails.net/doc/persistent_storage/create/index.en.html
MAKE STRONG PASS TAILS
Save your user/passwords in KeePassXC, and let KeePassXC make your passwords.
Connect to Tor through a default bridge.
Use a PGP you fuck: ⚠️DNM Bible PGP Guide⚠️
Pay your respects to /u/HugBunter & /u/Paris. And buy your drugs here: https://daunt.link/
Oh, I forgot, get some drugmoney first. Download your empty wallet (you /d/Beggars) at: ⚠️Feather Wallet⚠️
Figure (???>XMR>Feather wallet>Market) out yourself here: ⚠️kycnot.me⚠️
If you can't. Just get Litecoin (use MimbleWimble in your ⚠️Cake Wallet⚠️ ) and exchange it for XMR at one of the kycnot.me shops and fill up your empty feather wallet. Or test out the new ⚠️OpenMonero⚠️, ⚠️Retoswap⚠️, etc. for direct XMR.

tl;dr "Tails is good OpSec, use it."

This guide will remain in development. I want to thank the community and /u/headjanitor, I've looked into every comment to improve this guide. Always freel free to let me know if you have critique or ideas.

This guide is updated with the comments left on the old guide:
/post/2f789f4651342ef4db02 (This is where OpSec veteran /u/Headjanitor commented his critique and recommendations)
/post/db378b0baeb95f37431c
/post/eb988b47d6fe6f88fb88

Thank you.

Table of Contents

1. Introduction to Tails & requirements
1.1 Requirements
2. Hardware & Software Setup
2.1. Downloading Tails OS
2.2. Password keeping, PGP & Encryption
3. Network Configuration
4. Financial Obfuscation
5. Final Considerations

1. Introduction to Tails

Hiya,

Using Tails is the minimum requirement when accessing the DNM as a
buyer. It comes with simple instructions and provides an easy, mostly
retard-proof way of accessing the DNM on a convenient and secret USB.

And yes, you're probably a retard, and that's okay. Retards can live
long and happy lives; my cousin is a retard, and he was able to follow
this guide and stay safe because of it. I probably was a retard more
than once.

Ordering from a DNM without protection is like fucking a 5 dollar
undercover prostitute without a condom. It's an easy risk to take, or to
avoid. For most, it should be an easy choice.

Let's start.

1.1. Requirements

USB with 16GB memory, USB version 3.0 minimum. (Buy two and make a backup. Trust me, it's a good idea to do it now.)
(Anonymous) Internet connection for downloads (on an anonymous device)
A laptop/computer with a USB slot (A disposable laptop bought with cash if your threat model requires it. Most people don't need a
dedicated Dark Web laptop. Tails OS is amnesic, and its activity in RAM
is quickly overwritten during the shutdown procedure, leaving no traces
on the host computer.)
Optional (not recommended): Get a trusted VPN if you live in a country where using Tor is seen as suspicious or worse. Use a device
with an internet connection to put on the VPN and let the laptop with
Tails OS go through the phone or router.
Optional 2 (recommended): Get an additional USB for a backup. It's very easily done by using the 'Tails Cloner'.

Notes

Many phones do not route hotspot (tethered) traffic through their VPN by default, so your laptop’s IP may be exposed
even if your phone shows the VPN IP. If your phone’s VPN doesn’t cover
hotspot traffic, your ISP can still see your real IP or that you’re
using Tor/Tails before traffic enters Tor. Check your IP on both
devices.
This VPN step is not recommend and we'll talk about VPN's later on.

Tails/Tor is legal in most countries in the world. Unfortunately, data
is being harvested on you by your ISP, and government organisations have
been known to make lists of 'privacy orientated individuals' for a
while now.

In certain circumstances, u should download Tor in a public library or
internet cafe, which you rarely visit, through an anonymous device. As
increasing internet surveillance is becoming the norm, and everyone is
being socially profiled by increasingly technologically power hungry
entities - I am rightfully concerned about network observers.
Privacy tools like Tails/Tor can be scrutinized in contexts where
anonymity is seen as a threat to national security or law enforcement
efforts. As according to leaked documents from 2014: ''The NSA has
targeted Tails users, labeling it as "a comsec mechanism advocated by
extremists on extremist forums"''. Law enforcement agencies do
scrutinize people more who look into ''privacy online''.

These facts should be considered to minimize any continued profile build-up on you.

2. Hardware & Software Setup

Important Note on VPN

IT security professionals, darknet and /d/OpSec communities generally do not recommend using a VPN because it adds a
third party that can see your Tor connection, increasing risk. However, a
trusted, audited VPN can hide your traffic from ISPs and governments to
a limited extend.

Tor bridges help hide your use of Tor by routing traffic through private
relays, but Obfs4 bridges, while adding obfuscation to make traffic
look like regular internet data, can still be detected by advanced
methods like deep packet inspection (DPI). Unlisted bridges offer more
privacy but risk exposure if their details become public later.

If you still decide to use a VPN, look for:

Transparent zero-log policy verified by an independent audit.
No user or connection data stored.
Anonymous accounts & payment options (e.g., XMR).
Head office based in privacy-friendly country without data retention laws.
RAM-only servers.
Strong encryption (AES-256) with OpenVPN or WireGuard.
Both clearnet and .onion sites.
Built-in obfuscation (SOCKS5, Obfsproxy, SSL Tunnel).
Kill switch and DNS leak protection.
Good community reputation.

Mullvad is seen on daunt.link and tor.taxi. ProtonVPN and IVPN are also
solid choices. Always research independently and avoid biased “top 10”
lists.

For better privacy, you can download Tor or Tails OS from public places
to avoid linking downloads to your identity. Tails, Tor, Qubes, and
Whonix include built-in Obfs4 bridges to bypass censorship and some
detection. However, in high-risk environments, no tool—including VPNs or
obfuscation—can guarantee complete safety. Understanding your threat
model and taking layered precautions is essential.

Source:
https://security.stackexchange.com/questions/125005/why-is-home-vpn-tor-worse-than-home-tor/125008#125008
https://www.whonix.org/wiki/Tunnels/Introduction
https://www.whonix.org/wiki/Whonix_versus_VPNs
https://www.whonix.org/wiki/Warning#Use_of_Tor_is_Obvious
https://www.whonix.org/wiki/Hide_Tor_from_your_Internet_Service_Provider
https://www.whonix.org/wiki/Bridges#Before_Configuring_a_Bridge

2.1. Downloading Tails OS

If your threat model has an oppressive/dangerous government, find a
public space to download Tails OS - Travel to a city where you never go
and download Tor/TailsOS at a café, library, hotel lobby, etc. Stay away
from cameras and wear some kind of disguising clothing to hide your
facial features. Use public computers paid in cash to download Tails OS.
If you've already been using Tor on your Windows computer, don't worry
about it; just download Tails OS normally.

Follow their instructions step by step: https://tails.net/install/index.en.html

Now, let's start Tails. We'll start by making an administrator password and creating/configuring the persistent storage: https://tails.net/doc/persistent_storage/create/index.en.html

Make sure to use a strong password that's difficult to crack. Write it down somewhere until you can remember it fully. Then
burn the paper when you fully remember.
Minimum 16 characters, such as:
SecurePassword123!@#
Rustic Screw Marshmellow Hunter

After the persistent storage is set up, you'll make your own PGP pair:

2.2. Password keeping, PGP & Encryption

First, if you've already connected to the internet with Tails, disable that connection. Generating a PGP pair should be done without an
internet connection.
Open KeepassXC, and make a new file. Use a password, for KeepassXC, that you can remember well, yet would be difficult to crack. You can use
the same password as the administrator password that you used for your
Tails login. Then click 'add a new entry' and let KeepassXC create a
password for the upcoming PGP pair creation.
Open Kleopatra. Then, when making the PGP key, make sure the PGP name is the same as your public username on that market (this is useful
to keep track of things). Don't fill in the email; only a username.
Protect the to-be-generated PGP pair with a passphrase. Fill in the
password you have created with KeepassXC, as written in the previous
step. Next, select the 'ECDSA/EdDSA' option. Uncheck 'valid until' and
check 'authentication'.
To export your public key, find your PGP username in 'certificates', right-click, click export, save the .asc file, open it with a 'text
editor/pad', and share the public PGP with the person/website.

Use the guide if I didn't explain it well enough: ⚠️PGP Guide⚠️

NEVER share your private key. ONLY share your public key. Also, don't re-use usernames/PGP across different
markets, you can never know when a market/vendor gets arrested, or how
good their OpSec was. Always make a new account and fitting PGP pair.
And this should go without saying: Don't use a username that you frequently use in real life. Make it random.

NEVER use the auto-encrypt function on the market. Remember when Incognito Market secretly kept all the address data with
their fake auto-encrypt and then tried to blackmail vendors/buyers to
delete personal data. And then it turned out LE (law enforcement) had
infiltrated the market for months, and everyone got compromised. I
remember. And you shouldn't forget that either.
This isn't the first or last time that LE infiltrated a market and let
it run for months to gather data. Assume all markets are compromised;
It's an assumption that will keep you safe.

Note

In KeepassXC, save a database backup after every change you make to your
KeepassXC data due to the risk of database corruption. It's
'Database'> Save database backup.
Re-clone your entire TailsOS to the backup USB after new important user/pass.

3. Network Configuration

Now, you're finally ready to make a Tor connection in Tails. Either
connect to your VPN device, a public Wi-Fi, or, if you're just a small
buyer, use your home Wi-Fi.

When in 'Tor connection', click 'Hide my connection'. If that doesn't
work, click 'make connection to Tor'. But make sure to check the 'use
bridge' and then select a 'default obfs4 bridge'.

Now, let's bookmark these websites in the Tor browser so you won't get phished:

Dread: http://g66ol3eb5ujdckzqqfmjsbpdjufmjd5nsgdipvxmsh7rckzlhywlzlqd.onion/
Dread 2: http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/
Darknet link directory for markets, etc.: https://daunt.link/ or https://tor.taxi/

When you start-up Tor, and you'll have to do this every new start of
Tor, go to settings (top right corner of the three little horizontal
lines). Click Privacy & Security, find the security level, and
select the safest. This will disable JavaScript, which is an OpSec risk.
You'll also have to type: 'about:config' in the browser search bar,
search for 'JavaScript.enabled', and set it to false. It might break
certain websites; if that happens, lower the setting from safest to
safer.

You can also find a simple script to automate this proces on start-up of
the browser using Tails-autostart. But I won't advice you on that,
because downloading anything on Tails is at your own risk. I only
recommend community trusted projects, such as Feather wallet.

4. Financial Obfuscation

Now, let's get some XMR to make your purchases on the DNM:

First, download Feather wallet: http://featherdvtpi7ckdbkb2yxjfwx3oyvr3xjz3oo4rszylfzjdg6pbm3id.onion/
Start up Feather, make a new wallet, and store the password/seed in KeepassXC before you do anything with the wallet. Double-check the
password/seed if all is correct.
Option 1: Buy XMR directly from a P2P/decentralized exchange such as OpenMonero, BISQ, Haveno, etc. Send your XMR to your Feather wallet
(don't send XMR directly to a market).
Option 2: Buy any crypto (such as Litecoin) from any common fiat-crypto exchanger and send it to a crypto-crypto exchange to convert
your crypto into XMR that you receive in your Feather wallet on Tails
OS.

Note

Preferably let the XMR sit in your Feather wallet for a couple of
hours/days before sending it to the market to minimize timed association
attacks.

Find a crypto-crypto exchanger here: http://kycnotmezdiftahfmc34pqbpicxlnx3jbf5p7jypge7gdvduu7i6qjqd.onion/ I can recommend OpenMonero, Trocador, BISQ, Haveno, and many others.

Go to a DNM found on official Dread market pages, such as /d/Superlist /d/DarkNetMarkets or https://daunt.link/, and buy whatever you desire. There's also the new and growing /d/vendorsuperlist/; subscribe to them to support the Dread community!

5. Final Considerations

ALWAYS encrypt your own messages; do NOT rely on auto-encrypt. NEVER send ANY personal data without PGP encryption. It's a danger to yourself, but
also to the vendor—and I personally will always ban you if you send me
your address without encryption.
Don't snitch in yourself, no need to make preventable mistakes.
As mentioned before, always assume a market is compromised.

No compromises on OpSec are acceptable, yet reasonable choices need to
be made. Consider your threat model. Who's your threat and what can you
do to prevent detection?
https://anonymousplanet.org/guide/#appendix-b3-threat-modeling-resources

Use the second optional USB to make a backup of all your data.

The next OpSec step would be the Qubes/Whonix route. And further
hardening & obfuscation techinques, but that would only be required
for vendors and IT professionals.

TailsOS is a tool that should be mandatory for anyone visiting the DW
frequently. I am unfamiliar of cases where people got busted due to
Tails. But then again, it's not like that information would be freely
shared by LE - They usually don't show their cards, they just play them
in secret - And we're left guessing and putting the pieces of logic
together through snippets of information and deduction, and so do they.

Qubes/Whonx route is only a necessity when the knowledge of your OpSec
makes you become aware it's a reasonable necessity to invest your time
in to safeguard you from specific threats.

I think Tails suffices for most purposes here, and we should aim te
educate each other - We all started here as ignorant apes. And it's
usually a journey made by one's self, to venture into the DW. Some
guidance would good in this dark place.

Love,

KS

ps Trust no one. Not even yourself, because you might not even know how stupid you really are.
Please understand, most likely you know too little to just make decisions right now, they might have unforeseen consequences.

Mistakes have already been made by others, you don't need to make the same mistakes.
The path was made through personal sacrifices of time, money, and blood.

Follow the knowledge already laid down before you.

Stay vigilant, Stay Safe and Stay Anonymous!