Drug2gj6 w49X … jfUF AmhQ. VPN is not a substitute and Tails/Whonix are the sensible heavy-threat environments. Nothing else belongs in that browser profile.Why everything is onion-first
The product has exactly one network surface it needs: a Tor circuit to the onion service. Unique private mirrors exist because “the main mirrors get attacked all the time” (their own line), so the public string is a shared door under load — your session does not depend on it, and if your copy of the public string ever came from somewhere you have not verified, it is a stranger's front page. The fingerprint to check against is in every banner of this site; the verification step is one command in GnuPG once the announcement is in hand.
Getting Tor right
- Source: current Tor Browser from torproject.org, signature verified on download. Community thread complaints about connectivity are mostly client-shaped (“90 % of the time it just doesn't work”), and the market's reply was the PoW line — but a frankensteined bundle is still the most likely root cause of the rest.
- Profile: Default or Safer; randomised fingerprinting is the point. Random extensions (ad-blocker forks, leak protectors) re-introduce fingerprint deltas and JS quirks — the thread's slow-load class of complaint tracks this.
- No clearnet fallback: do not run a rule set that silently retries the market's clearnet gateway over plain https; that defeats the whole point of being here.
Connection behaviour — what to expect
- Navigate to the onion string (box above; copy button = canonical string).
- Puzzle gate spins — CPU work, not a network stall.
- Storefront loads; sign-in message identifies which mirror you are on. Read it — the signed post calls that message “the best way to avoid phishing”.
- Announcements/news popups verify to the staff key before further trust.
If step two never finishes: different core (a shared-VM slice with cgroup CPU cap will crawl), same client, one more retry. “99 % are working, and yours is not, the problem is on your side” is a blunt paraphrase of the documented behaviour, not snobbery — the market also hands out a customer mirror via ticket when a user genuinely qualifies (a vendor in-thread was told to “send a ticket, staff will figure out what's going on”).
What the puzzle costs
PoW on a market entry is anti-spray / anti-bot in the classic shape: cheap for humans-on-real-hardware, dear for fleets. Practical table:
| Hardware class | Expected feel | Action |
|---|---|---|
| Dedicated laptop / workstation core | Solve ≈ seconds | None |
| Tails on decent hardware | Solve ≈ seconds–tens of seconds | None |
| Thin-client / shared slice (CPU cap) | Slow, occasional stall | Retry; different profile |
| Maintained 2015-era hardware | Noticeable wait | Patience or upgrade |
The vendor-side analogue is the same gate (vendors get two mirrors and still go through the front door), so do not read vendor-thread complaints about entry speed as customer-side-only.
Tails / Whonix — where signing belongs
The market's own E2EE helper (reverse-proxy encrypt/decrypt; Python ≈280 loc, Go ≈290 loc; signed; no binaries; targets: Tails, Whonix, Qubes, Debian) assumes exactly these environments, so that is where the message traffic is meant to be transparent. Recommended shape for a serious account:
- Tails (or Whonix workstation) for browser + Tor to the market, dedicated LUKS volume for the market keypair.
- Signing in the same profile — no reason to shuffle keys between machines; every challenge, message and dispute sign lands on one pair.
- Secret key passphrased, offline backup; remember the market is “no recovery”, by staff line.
VPN + Tor — the myth, plainly
A VPN in front of Tor (or instead) does not buy anything here: Tor already hides origin and endpoint, and the VPN merely adds a log-owner to the trust set — which endpoint you trust, whose logs, what the VPN+Tor ordering does to your threat model, is a different essay and a different market decision. For reading the storefront and doing login/message signing, plain Tor to the onion is the whole stack, and anything marketed on top is extra surface, not extra anonymity. If you run one anyway, at least make the order Tor-after-VPN and know you have named an exit to trust before the circuit exists.
Where this leads
Once the client is in hand and the storefront is up: the challenge/sign walkthrough on the login portal page, invoice mechanics on invoices, and every number the market asserts, in one table on the FAQ. The copy box on the top page is still the canonical onion string for pastes.