Tor Browser hardened setup for market shopping
Tor Browser out of the box is safe enough for reading the news. For anything you would rather nobody link back to you, spend five minutes on the settings below.
Download from the right place
Only from torproject.org or its onion at 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion. Any other download page is either a mirror you cannot check or a fake. Verify the signature at least the first time, the Tor Project explains how on their download page.
Set the Security Level to Safest
Open the shield icon next to the address bar, click Change, pick Safest. This disables JavaScript on all sites, blocks some fonts, disables symbols and formulas. Some sites break. Every Tor market that matters works fine on Safest because the login flow is HTML forms, not React apps.
Standard leaves JS on and gives up most of the fingerprinting resistance the browser is famous for. Safer keeps JS on HTTPS sites. Safest kills JS everywhere. If a page really needs JS you can lift the setting for that tab, but for market pages you never should.
Never resize the window
Tor Browser opens at a fixed size on purpose so that everyone using it looks the same when a site fingerprints your window. Resizing gives you a unique size, which uniquely identifies you across pages. If you maximize by accident, close and reopen the window.
Do not install extensions
Every extension changes the fingerprint. A NoScript, uBlock or dark reader on your Tor Browser makes you look different from a stock install. Even changing the default new tab page is a mistake. Leave the browser exactly as it came.
Use a new identity between accounts
The four little lines menu in the top right has New Identity. This closes every tab, wipes cookies, wipes cache, and opens a fresh circuit. Use it between different market accounts and between anything that should not be linked to anything else. Read the news on one identity, log into your market account on another.
Bridges if the network you are on watches Tor
If your ISP or country blocks or logs Tor connections, use a bridge. Open Settings → Connection, tick Use a bridge, pick obfs4 from the built in list, or request one from bridges.torproject.org. Bridges hide the fact that you are on Tor. They do not hide what you do on Tor.
Do not log into anything real
The single biggest way people burn their Tor session is by opening Facebook, Gmail or their bank in the same browser. Any of those accounts is tied to your real name in the provider's database. If you log in on Tor Browser, the market and the news site you visit next are one step removed from your name. Use Tor Browser for Tor stuff only.
Do not download random files
PDFs, docs, and archives you download from the dark web can phone home the moment you open them outside Tor Browser. If you have to open something, do it inside a Tails or Whonix session where nothing can reach the wider internet without going through Tor.
Small habits that matter
Close Tor Browser between sessions instead of leaving it open for days. Do not paste your public IP anywhere. Do not run torrents over Tor. Assume every screenshot has the URL in it and the URL has your session cookie in it, so do not share screenshots.
What Tor Browser will not do
Tor Browser is only the browser. It does not stop your operating system from talking to Google, Apple or Microsoft in the background. For real separation, run the browser inside Tails or Whonix. The next guide covers that.