1. Operational Security (OpSec) Basics

OpSec is the foundation of your safety on the darknet. It's a mindset and a set of practices designed to prevent sensitive information from falling into the wrong hands.

• Maintain Anonymity: Never use your real name, email, or any personal identifiers on DrugHub Market or related forums.
• Separate Identities: Keep your clearnet (regular internet) and darknet activities completely separate. Use different usernames, passwords, and browsing habits.
• Use Dedicated Software: For maximum security, use the Tails OS, a live operating system that routes all internet traffic through Tor and leaves no trace on the computer.
• Minimize Information: Only provide the absolute minimum information required for a transaction.
• Assume You Are Monitored: Act as if all your actions could be observed. This mindset encourages cautious behavior.

2. Tor Browser Security

The Tor Browser is your gateway to the darknet, but it must be configured and used correctly.

• Official Source Only: Always download Tor Browser from the official website: www.torproject.org.
• Keep it Updated: Regularly update Tor Browser to protect against the latest vulnerabilities.
• "Safest" Security Level: Set the security level in Tor Browser to "Safest". This disables most JavaScript and other potentially dangerous scripts.
• No Browser Extensions: Do not install any add-ons or plugins in Tor Browser, as they can compromise your anonymity.
• Do Not Resize Window: Keep the Tor Browser window at its default size to prevent browser fingerprinting.

3. PGP Encryption Guide

PGP (Pretty Good Privacy) is the gold standard for secure communication on the darknet. It uses strong encryption to ensure that only the intended recipient can read your messages, making it impossible for ISPs, law enforcement, or hackers to intercept your data.

Why PGP is Essential (Non-Negotiable)

Step-by-Step Setup Guide

A. Install PGP Software

You need a dedicated program to manage your keys and perform encryption. Do not us online PGP tools as they are insecure.

Windows Users: Download and install Gpg4win. This suite includes Kleopatra, the certificate manager you will use for all PGP tasks.

• Windows: Gpg4win (Official suite including Kleopatra)
• macOS: GPG Suite
• Tails OS: Comes with PGP tools pre-installed (click the clipboard icon in the top right).

Install Gpg4win with default settings to get Kleopatra.

B. Generate Your Key Pair

Open Kleopatra (or GPG Keychain on Mac) and create a new OpenPGP key pair. This consists of a Public Key (to share) and a Private Key (to keep secret).

• Name: Use your market username. NEVER use your real name.
• Email: Leave blank or use a fake email (e.g., user@drughub.onion).
• Passphrase: Set a strong, unique password to protect your private key. If you lose this, you lose your account access.

File > New Key Pair > Create a personal OpenPGP key pair.

C. Import Public Keys

To communicate with others (like a vendor or DrugHub Support), you must import their Public Key into your software.

1. Copy the PGP Public Key block (starts with -----BEGIN PGP PUBLIC KEY BLOCK-----).
2. In Kleopatra, click Tools > Clipboard > Certificate Import (or press Ctrl+V).
3. Certify the key if prompted. Verifying the key fingerprint is good practice to ensure it's authentic.

D. Encrypting & Decrypting

This is the core function you will use for every order.

To Encrypt (Sending info)

Write your message (e.g., shipping address) in the Notepad feature of Kleopatra.

1. Click "Recipients" tab.
2. Select the vendor's key you imported.
3. Click "Encrypt".
4. Copy the resulting text block to the market.

To Decrypt (Reading messages)

When you receive an encrypted message (like a login verification code):

1. Copy the encrypted block.
2. In Kleopatra, use the "Notepad" or "Decrypt/Verify" feature.
3. Enter your private key passphrase when prompted to reveal the text.

4. PGP-Based Authentication (Mandatory)

DrugHub implements PGP-based cryptographic login as a mandatory security feature for all accounts. This ensures that only the holder of the private key can access the account, even if the password is known by someone else.

The Secure Login Process:

Every time you log into DrugHub, you will go through the following automated security flow:

1. Signature Verification: The site presents a signed message containing your unique sign-in code.
2. Encrypted Payload: This code is encrypted with the PGP Public Key you provided during registration.
3. Local Decryption: You must copy the encrypted block and decrypt it using your private PGP key (and passphrase) on your local device.
4. Entry: Paste the revealed sign-in code (e.g., DRUG_HUB_BUYER_SIGNIN_...) into the login field to complete the process.

5. Cryptocurrency Security (Monero)

Proper handling of cryptocurrency is essential for maintaining your privacy.

Why Use Monero (XMR)?

DrugHub primarily uses Monero because its transactions are private and untraceable by default. Unlike Bitcoin, where transactions are public on the blockchain, Monero obscures the sender, receiver, and amount, offering superior anonymity.

Safe Cryptocurrency Workflow:

1. Acquire Monero: Buy XMR from a reputable cryptocurrency exchange that complies with your local regulations.
2. Transfer to a Personal Wallet: Withdraw the Monero from the exchange to a local, private wallet that you control. Recommended wallets include the official Monero GUI Wallet or Feather Wallet.
3. Transfer to DrugHub: From your personal wallet, send the required amount to the deposit address provided by DrugHub Market.

6. Phishing Prevention

Phishing is the most common threat to darknet market users. Scammers create fake copies of DrugHub to steal your login credentials and funds.

How to Avoid Phishing:

• Use Verified Links: Only use links from trusted sources like our DrugHub Links page. Bookmark it for future use.
• Verify URLs: Meticulously check every character of the onion URL before entering any information.
• Distrust Messages: Be suspicious of unsolicited messages on forums or chats containing links, even if they appear to be from staff.
• Look for Security Indicators: A legitimate site will have a working CAPTCHA and PGP verification system. If these are missing, leave immediately.