How to post on dread from home and avoid correlation by smartphone : OpSec | Torhoo darknet markets
Read comments about this topic but couldn’t find a specific recommendation. I think this is relevant in terms of the recent busts. I am talking about Threat Level High/Highest.
Everyone, probably also large vendors, market admins and mods, have personal smartphones they use in their real life.
The prerequisite for my question is that they have to use their own internet connection from home, use Tor and login to dread to submit posts and comments.
Because as they arrive home this could be recognized by tracking their personal smartphone. Then if they start a Tor connection this can be correlated. One step further if they submit posts and comments this could be also correlated to them and they get busted.
What needs to be done to avoid any correlation in terms of OpSec? Please consider the prerequisite that they have to use their own internet connection.
a) Should they keep their Tor connection as short as possible, e.g. prepare posts/comments offline, and after checking new posts or submitting posts shutting the PC down?
b) Should they instead keep the Tor connection online the whole day (e.g. keep Whonix-Gateway connected or keep Tails connected to Tor)?
c) Should they after arriving home wait several hours before submitting new posts/comments? If yes, how long?
d) Should they use a VPN like Mullvad with DAITA?
Every support is highly appreciated!
In general, if working from home many hours:
First of all the Tor usage must be hidden. Secondly, logging into hidden services should be done with different accounts, not one. For instance a DNM admin should use a mod account and corresponding Dread account for a few hours, then login with a second account with corresponding Dread account, and so on. This will prevent direct timing attacks. If possible, alter the accounts with another person that has different working schedule, this will mess up any timing attack. In this case all mods should use LLM to avoid linguistic differences.
In general, if minimizing the time online:
Login from random free WiFi at dinners and coffee shops, do your thing, and don't visit the same location for months.
I would appreciate if you could give me some hints regarding these follow-up questions:
1) If I use Mullvad trying to hide Tor usage, should I close the VPN connection once I finished the activities or should the VPN connection stay active as long as possible, i.e. the whole time I am at home until I leave home as then I need to shutdown the PC?
2) And after arriving home should I wait several hours before connecting to the VPN and submitting new posts/comments on dread?
3) How frequently or when I should change or rotate Mullvad accounts?