Buyer Opsec Foundations: The Minimum That Actually Matters
Most buyers are not caught by elite hacking. They are caught by reused usernames, linked wallets, and unencrypted phones. Here is the boring baseline that decides real outcomes.
home / news
news & notes
205 postsshort notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
latest notes
newest firstDevice security before Tor: your browser is not the weakest link
Tor cannot protect a compromised device. Why OS updates, disk encryption and malware hygiene matter more than any browser setting before you connect to the network.
Tails, Whonix or just a VM: honest answers about isolation on Tor
Tails forgets everything, Whonix refuses to leak, and a plain VM only contains. What each Tor setup really protects, where each fails, and who should run which.
Zombie credentials: why old password dumps still fuel account takeovers
A password stolen in a 2013 breach can still empty your inbox today. Inside the combolist economy, credential stuffing at scale, and the true cost of reusing one password.
Scam Warning Lists: Who Maintains Them and When to Trust Them
Scam warning lists look authoritative from outside. Who maintains them, how reports get verified, and where they fail explains why readers should treat them as evidence, not verdicts.
Link directories and dark.fail: what verified onion lists actually prove
What link directories like dark.fail actually verify, how PGP-signed mirror lists work, where they fall short, and how to build a verification habit that survives.
Verifying software downloads over Tor: checksums and signatures done right
Checking a hash against the same server that served your download proves nothing. Here is how to verify software over Tor properly: signatures, key fingerprints and a little patience.
Threat model thinking: deciding which protections you actually need
Security advice tells you to do everything. A threat model tells you what matters for you: your assets, your adversaries, their capabilities, and where effort is wasted.
The v3-only era: life after legacy onion addresses disappeared
Four years after Tor pulled the plug on v2 onion services, we look back at why the old addresses died, what v3 fixed, and how the ecosystem settled.
The long goodbye of v2 onion addresses: how Tor retired a 16-character era
From SHA-1 collisions to the October 2021 cutoff: how the Tor Project deprecated v2 onion services, and why thousands of sites initially stayed behind on legacy addresses.
Tor Browser 13 and the Mozilla rebase: what really changed under the hood
Tor Browser 13 was more than a visual refresh. Its rebase onto Firefox ESR 115 changed how the anonymity browser absorbs security fixes on desktop and Android.
Snowflake bridges explained: how volunteers become temporary Tor relays
Snowflake turns thousands of volunteer browsers into disposable WebRTC proxies that stand in front of Tor. How the design works, what limits it, and why censors struggle to keep up.