Zero-Trust Environment
Assume all unverified links are hostile. Assume all unencrypted communications are intercepted. The measures outlined below are not optional suggestions; they are mandatory requirements for account safety on MarsMarket.
Table of Contents
Tools Required
- PGP Software Kleopatra / GPG
- Tor Browser v13.0+
- KeepassXC Passwords
Identity Isolation
The most common failure point in operational security is cross-contamination. Your "Darknet Identity" must be completely walled off from your "Clearnet Identity".
- Never reuse usernames from Reddit, Discord, or gaming forums.
- Never reuse passwords. Use a local password manager (e.g., KeepassXC).
- Never discuss your market activity on clear web platforms, even in DMs.
- Never access MarsMarket from a device linked to your real identity (e.g., a work phone).
RULE: If a piece of information exists on the clear web (email, username handle), it does not exist on the dark web. Create entirely new personas.
Phishing Defense & Verification
MarsMarket faces constant Man-in-the-Middle (MitM) attacks. Phishing sites look exactly like the real market but will steal your credentials and deposit addresses.
The Golden Rule of Links
Never trust a link found on a wiki, Reddit, or forum unless you have verified it cryptographically.
How to Verify
- Import the MarsMarket Admin PGP Key.
- Copy the signed message from the login page.
- Verify the signature in Kleopatra/GPG.
- If the signature is BAD or missing, leave immediately.
Visual Indicators
- Check the URL characters carefully.
- Look for "Verified" status in Tor browser (if applicable).
- Bookmark your verified links.
Tor Browser Hardening
The default settings of Tor Browser prioritize usability over maximum security. For market operations, you must harden your browser configuration.
Security Level: Safest
Go to Settings > Privacy & Security. Set the security slider to "Safest". This disables JavaScript completely, which prevents many de-anonymization exploits.
Window Management
Do not maximize your Tor Browser window. Leave it at the default size to prevent screen resolution fingerprinting.
Financial Hygiene
Blockchain analysis is sophisticated. Sending funds directly from an exchange (KYC) to a market wallet is a critical error that links your legal identity to the transaction.
| Currency | Risk Level | Protocol |
|---|---|---|
| Bitcoin (BTC) | High Risk | Transparent ledger. Requires tumbling/mixing (Wasabi/Samourai) before use. Not recommended for novices. |
| Monero (XMR) | Low Risk | Private by default. Ring signatures hide sender/receiver. Strongly recommended. |
PGP Encryption (Mandatory)
"If you don't encrypt, you don't care." PGP (Pretty Good Privacy) is the only barrier between your data and law enforcement or interceptors.
1. Client-Side Only
Always encrypt messages on your own device (using Kleopatra, GPG4Win, or GPG Suite). Never type sensitive info into a website text box.
2. Avoid "Auto-Encrypt"
Never use the "Auto-Encrypt" checkbox provided by markets. This relies on the server to handle the encryption, which implies the server sees the plaintext. This defeats the purpose.
3. 2FA is Mandatory
Set up PGP 2-Factor Authentication immediately upon account creation. This prevents account takeovers even if your password is phished.