Privacy & Security Setup

Tor Browser Setup

About Tor Network

Tor Browser enables anonymous web browsing via onion routing protocol, concealing user identity and geographic location through multi-hop encrypted connections across distributed relay network. Required for .onion domain access and maintaining operational anonymity.

Linux Installation

# Retrieve Tor Browser package
wget https://www.torproject.org/dist/torbrowser/14.0/tor-browser-linux-x86_64-14.0_ALL.tar.xz

# Extract downloaded archive
tar -xf tor-browser-linux-*.tar.xz

# Change to browser directory
cd tor-browser

# Launch application
./start-tor-browser

macOS Installation

# Via Homebrew package manager
brew install --cask tor-browser

# Alternative: Manual download
# Visit torproject.org/download
# Mount .dmg and copy to Applications folder

Windows Installation

Obtain installation package from official Tor Project and execute .exe installer. Proceed through setup wizard with default settings.

Essential Configuration

• Privacy Mode: Select "Safer" or "Safest" via Settings → Security panel
• Script Control: Activate NoScript addon for JavaScript blocking
• Bridge Nodes: Configure bridge relays for censored networks
• Circuit Renewal: Select onion menu → "New Identity" for fresh connection path

Tools

• Official Tor Project
• GitHub: Tor Browser Launcher
• Tor Browser Manual

VPN Implementation

VPN Purpose

Virtual Private Networks encrypt internet traffic and obscure network addresses. While Tor handles .onion routing, VPN integration provides additional privacy layer for standard internet activity and ISP traffic obfuscation.

Privacy-Focused Services

• Mullvad: Zero-logs architecture, anonymous signup, cryptocurrency payments accepted
• ProtonVPN: Swiss jurisdiction, independently audited, includes free access tier
• IVPN: Open-source client, privacy-first design, no personal data required

Mullvad Setup (Linux)

# Fetch Debian package
wget https://mullvad.net/download/app/deb/latest -O mullvad.deb

# Install package and dependencies
sudo dpkg -i mullvad.deb
sudo apt install -f

# Start application
mullvad-vpn

ProtonVPN Command Line (Linux)

# Install using pip
pip3 install protonvpn-cli

# Run initialization
protonvpn init

# Connect to optimal server
protonvpn connect --fastest

# Check status
protonvpn status

# Disconnect
protonvpn disconnect

VPN + Tor Setup

Recommended order: You → VPN → Tor → Internet

1. Connect to VPN first
2. Launch Tor Browser
3. Access .onion sites through Tor

Note: This prevents your ISP from seeing Tor usage, but the VPN provider can see you're connecting to Tor (though not what you're doing).

Tools

• Mullvad VPN
• GitHub: Mullvad
• ProtonVPN
• GitHub: ProtonVPN CLI

PGP/GPG Encryption

Why PGP?

Pretty Good Privacy (PGP) and its open-source implementation GNU Privacy Guard (GPG) provide end-to-end encryption for messages. Essential for secure communication on darknet platforms.

Installation

# Debian/Ubuntu
sudo apt-get update
sudo apt-get install gnupg

# macOS (using Homebrew)
brew install gnupg

# Verify installation
gpg --version

Generate Key Pair

# Generate key (interactive)
gpg --full-generate-key

# Choose options:
# - Key type: RSA and RSA (default)
# - Key size: 4096 bits
# - Expiration: 1-2 years recommended
# - Enter your email and passphrase

Export Public Key

# List keys
gpg --list-keys

# Export public key (ASCII armored)
gpg --armor --export your@email.com > pubkey.asc

# Display public key
cat pubkey.asc

Encrypt & Decrypt

# Encrypt a message
echo "Secret message" | gpg --encrypt --armor -r recipient@email.com > message.asc

# Encrypt a file
gpg --encrypt --armor -r recipient@email.com file.txt

# Decrypt
gpg --decrypt message.asc

Sign & Verify

# Sign a message
echo "Message" | gpg --clearsign > signed.asc

# Verify signature
gpg --verify signed.asc

Best Practices

• Use strong passphrase (20+ characters)
• Store private key backup in secure location
• Use 4096-bit keys for maximum security
• Set expiration date (1-2 years)
• Publish public key to keyservers if needed
• Verify fingerprints before trusting keys

Tools

• GnuPG Official Site
• GitHub: GnuPG
• PGP Best Practices

Tails OS (Advanced)

What is Tails?

Tails (The Amnesic Incognito Live System) is a security-focused Debian-based Linux distribution aimed at preserving privacy and anonymity. It runs from a USB drive and leaves no trace on the computer.

Key Features

• Routes all internet traffic through Tor
• Leaves no trace on the host system
• Includes encryption tools (PGP, LUKS)
• Persistent storage option for files
• Pre-configured for anonymity

Installation

1. Download Tails ISO from tails.boum.org
2. Verify the download using PGP signatures
3. Create bootable USB using Etcher or dd command
4. Boot from USB (may need to change BIOS settings)

# Create bootable USB (Linux/macOS)
# WARNING: This will erase all data on the USB drive
# Replace /dev/sdX with your USB device

sudo dd if=tails-amd64-5.8.img of=/dev/sdX bs=4M status=progress
sync

Tools

• Official Tails Website
• GitLab: Tails Source Code
• Tails Documentation

Additional Security Tools

Whonix

Operating system designed for anonymity. Runs in virtual machines with all traffic forced through Tor.

• Whonix Official Site
• GitHub: Whonix

KeePassXC (Password Manager)

Open-source, offline password manager with strong encryption.

# Install KeePassXC
sudo apt-get install keepassxc  # Debian/Ubuntu
brew install keepassxc           # macOS

• KeePassXC Official Site
• GitHub: KeePassXC

VeraCrypt (Disk Encryption)

Free, open-source disk encryption software for creating encrypted volumes.

• VeraCrypt Official Site
• GitHub: VeraCrypt

OPSEC Best Practices

Operational Security Guidelines

• Compartmentalization: Keep identities separate, use different accounts
• Metadata: Remove metadata from files before sharing
• Browser Fingerprinting: Use Tor Browser, avoid extensions
• Time Zone: Be aware of timestamps revealing your location
• Writing Style: Avoid unique phrases that could identify you
• Social Engineering: Be skeptical of requests for information
• Software Updates: Keep all security tools updated
• Physical Security: Protect devices, use full-disk encryption

Further Reading

• Crypto OPSEC Self-Guard
• Privacy Guides