Tor and locality, can you answer me? : OpSec | Torhoo darknet markets
I see that most advice is, always connect to the tor network through a bridge and in a square or a coffee shop, never in a private place. Ok this rule is very good, even more so if you add tails to the equation. However, many market administrators log in from their home networks..., is it right to use VPN in these types of cases? Or do you have any other tools for entering the tor network?
If someone is a high profile target for LE they need to consider how to connect to internet.
Especially connecting from home can be risky, one mistake and it can be all over. Therefore high threat level users must consider what the local environment offers.
Anonymous SIM-Router with SIM-card or eSIM (only connect with Ethernet cables)
Anonymous mobile phone with SIM and via USB-tethering
Hack neighbors WiFi (not recommended)
Use an Yagi-antenna and connect to free Internet at nearby
Hook into property network wiring closet
Tunnel fiber cable from your place elsewhere and hijack an Internet connection there.
In all the above do not have the device that connects to Internet in your premises, place it at common areas where everyone has access. Further on, use cables from that device so it connects to every apartment and office in one or several properties (old RG-58 would be perfect). This way you will achieve plausible deniability.
Excellent breakdown the physical separation of the connection point is probably one of the most overlooked layers of OpSec, especially among newer users. People obsess over bridges and VPNs, but forget that if the origin hardware is tied to them physically, it doesn’t matter how many hops they add.
I’d just add one thing:
Even when using setups like SIM routers or directional antennas (Yagi), don’t underestimate pattern analysis. Connecting at the same time, day after day, from the same neighborhood, even with technical obfuscation, still builds a statistical fingerprint. Rotate both locations and schedules.
Also, agreed on not having the connection device inside your premises running Ethernet from a hallway utility box, abandoned flat, or even a power-over-Ethernet setup from a decoy device in a common area can offer serious deniability.
And for anyone considering connecting directly from home with VPN -> Tor: remember, VPNs see your real IP, and VPN logs + metadata + timing attacks are a real vector if you're ever targeted.
Especially connecting from home can be risky, one mistake and it can be all over. Therefore high threat level users must consider what the local environment offers.
In all the above do not have the device that connects to Internet in your premises, place it at common areas where everyone has access. Further on, use cables from that device so it connects to every apartment and office in one or several properties (old RG-58 would be perfect). This way you will achieve plausible deniability.
See also /post/f12b38fc9337bce6ae34
I’d just add one thing:
Even when using setups like SIM routers or directional antennas (Yagi), don’t underestimate pattern analysis. Connecting at the same time, day after day, from the same neighborhood, even with technical obfuscation, still builds a statistical fingerprint. Rotate both locations and schedules.
Also, agreed on not having the connection device inside your premises running Ethernet from a hallway utility box, abandoned flat, or even a power-over-Ethernet setup from a decoy device in a common area can offer serious deniability.
And for anyone considering connecting directly from home with VPN -> Tor: remember, VPNs see your real IP, and VPN logs + metadata + timing attacks are a real vector if you're ever targeted.