In the fourth part of this series we covered why TOR is not a silver bullet for privacy and anonymity, what it can and cannot protect you from, and a few case studies of the greatest opsec mistakes that unmasked identities behind TOR. If you haven't read the last part I would recommend starting there before diving into this one.
Now that the architecture, pros and cons are out of the way, we can dive into how to access TOR and the dark web safely and securely.
Accessing TOR and the Dark Web: The Setup
While there are multiple ways to access TOR, ranging from the CLI to configuring it via a SOCKS Proxy, the TOR Browser remains the most convenient and the most common way.
During the initial phases of TOR the browser did not exist. It was later introduced to make TOR accessible to everyone regardless of their technical background. TOR's ability to hide users depends on the volume of traffic in the network, which is the exact reason why the military opened TOR to the public. They needed as many users as possible for TOR to work effectively. A low user count makes it far easier to pinpoint individuals, so the TOR Browser was built to bring in a whole new spectrum of users who previously lacked the technical knowledge to connect manually.
Threat Model Matrix
The ideal way to access TOR and the dark web depends entirely on your privacy and anonymity needs and your own threat model. There is no single approach that works for everyone. When building your threat model it helps to ask a few basic questions:
-
Who are you hiding yourself and your activity from?
-
Where are you accessing TOR from, and is there censorship in your region or heavy monitoring on your network?
-
What are you planning to do, and does it cross into legal grey areas or attract attention from powerful entities?
-
How can you access it practically, do you have a spare device or only your personal one?
When you answer these questions of who, what, where and how, you gain a much clearer picture of your threat model. It can be a time consuming process so I came up with five levels to simplify it, a matrix for accessing TOR and the dark web based on risk with a corresponding recommended setup.
It’s important to remember that no setup eliminates risk entirely. There will always be residual risk, and in some cases the setup itself introduces new secondary risks. Understanding your risk tolerance and being able to live with what remains is part of the process.
Level 5 — Lowest Risk
This level is the casual everyday user who values privacy but faces no specific threats. This could be someone in a country with moderate internet surveillance or ISP monitoring who wants to browse without being tracked, a user who finds VPNs expensive or banned in their region, or simply someone who is privacy conscious and wants to access the clearnet without leaving a trail. They have no intention of accessing the dark web and are not involved in any activity that would attract attention from any adversary. At this level simply installing TOR and using it from a personal device is enough.
Worth noting though, some major platforms like Grok, ChatGPT and Claude block connections from TOR exit nodes, low bandwidth networks will increase latency noticeably, and live streaming or anything requiring UDP is off the table since TOR only supports TCP. Within those limits TOR does a solid job of hiding your clearnet activity.
Level 4 — Low Risk
This level is the curious user who wants to explore the dark web out of personal interest. Hobbyists, tech enthusiasts and students who have read about the dark web and want to see it firsthand, like myself. They are not doing anything illegal or sensitive but they understand the dark web is a different environment and want a basic layer of separation between their activities and their personal identity. The biggest threat at this level is accidental exposure to illegal content or inadvertently leaving traces on a personal device. The user can access TOR either directly on their personal device, though that is not recommended, or with a virtual layer of separation using Whonix on their host machine.
Whonix gives you two virtual machines: a gateway that isolates your network and routes all traffic through TOR, and a workstation where you actually do things. This separation stops malware in the workstation from reaching the network and prevents de-anonymization by keeping the two environments completely apart.
Level 3 — Medium Risk
This level covers researchers, students, threat hunters and entry level journalists accessing the dark web for professional or academic purposes. They may be investigating cybercrime, monitoring threat actor forums or gathering information on sensitive topics. Their activities could attract attention from cybercriminals or low level threat actors if their identity is exposed, and the professional or legal consequences of discovery make using a personal device a genuine risk. Here the recommended setup is Whonix combined with Qubes OS, the most secure combination available for a desktop environment.
Whonix forces all traffic through TOR and keeps the network isolated while Qubes OS adds its own hypervisor on top and lets you create separate OS instances called AppVMs for each task. It also lets you spin up disposable VMs for things like reverse engineering or safely opening a suspicious attachment.
Level 2 — High Risk
This level covers journalists, activists and researchers working in sensitive environments where their work directly challenges powerful entities, whether corporations, criminal organisations or governments. They are handling sensitive sources, confidential documents or information that if traced back to them could result in legal consequences, professional retaliation or physical danger. Their threat model includes sophisticated cybercriminals and potentially state level adversaries with moderate resources. From this level onwards hardware level isolation becomes important.
The recommended approach is Tails OS, a live OS that runs entirely from a USB and stores everything in RAM, wiping itself completely when the USB is removed. A dedicated device is optional at this level but advisable. Persistent storage can be added and is stored on the USB itself, encrypted at rest.
Level 1 — Highest Risk
This level is the whistleblower, the investigative journalist in a hostile state, the political dissident, or anyone whose activities place them in direct opposition to state level or well resourced adversaries. Their identity being exposed is not just a legal or professional risk, it is a physical safety risk. Their threat model includes state sponsored attackers, three letter agencies and adversaries with resources approaching a global passive adversary. Every digital action is a potential attack surface and their personal device is considered compromised by default.
A dedicated device is no longer optional here, it is mandatory. Combined with Tails OS it provides the opsec foundation needed to access the dark web through TOR. The goal at this level is complete isolation between dark web activity and real life identity.
This should give you a rough idea of where you sit and help you frame your own threat model. Now let’s get into the setup.
TAILS: The Anti-Forensic OS
For this article I will only be covering Tails OS.
A fair question is why not Qubes OS, Whonix or Whonix with Qubes ?
When it comes to dark web opsec where the primary goal is reducing your digital footprint, Tails is simply the best at it. The others are excellent for security but Tails is purpose built for leaving nothing behind.
Before we get into the practical part, let’s understand what Tails actually is.
What is TAILS ?
Tails, which stands for The Amnesic Incognito Live System, is a Debian based Linux live distribution designed to give users a regular internet experience while maintaining privacy and anonymity.
While Tails started as an independent project with financial support from the Tor Project and the Freedom of the Press Foundation among others, it later merged with the Tor Project on September 26, 2024.
But what sets it apart from other Debian based systems like Ubuntu?
To understand this let’s start with unpacking the name itself.
Amnesic — Memory Loss
One of the defining characteristics of Tails is that it is amnesic by nature, meaning it is forgetful. It starts with nothing and ends with nothing. No memory is kept permanently, everything lives in RAM, and once the session ends and the system shuts down Tails forgets everything. The next time you boot it you are starting completely fresh, as if it has never been used before.
Cold Boot
A common concern here is cold boot attacks. RAM is volatile by nature, meaning data stored in it degrades after power is lost rather than disappearing instantly. This creates a window, a grace period, during which data can still be partially recovered even after shutdown. The hotter the device the faster the data degrades, which is why cold boot attacks sometimes involve artificially freezing the RAM using liquid nitrogen or similar agents to slow the degradation and extend that window. The risk of moisture from the spray damaging the RAM is a real trade off in those situations.
As a countermeasure Tails performs memory zeroing on shutdown, overwriting the RAM with zeroes before the system powers off, eliminating any useful data before the grace period can be exploited.
Incognito — Anonymous
Tails forces all traffic through TOR to conceal the user’s identity and uses a pre-configured firewall to block any application that tries to connect to the internet directly.
This also means Tails inherits TOR’s threat model. It cannot protect you against the things TOR itself cannot, like end to end correlation attacks or global passive adversaries.
Live System — Ephemeral
Tails is a live OS, which means it is a fully functional operating system that runs entirely from RAM rather than being installed on the hardware, and it boots from removable media like a USB drive or DVD. Everything is stored in RAM unless you opt into persistent storage, which lives on the bootable media itself rather than the hard disk.
This also makes Tails portable. You can plug it into virtually any computer and use the OS without leaving any trace of your activities on that machine.
Is TAILS Secure ?
From a security standpoint Tails is self-contained because it replaces the host OS and runs bare-metal directly on the hardware, unlike virtualisation which runs on top of an active host. This means malware that infects Tails cannot reach your host OS.
The reverse is not quite the same though if you boot Tails on a device with compromised firmware it is very likely Tails itself would be compromised.
The short lived nature of Tails also makes it extremely difficult for malware to persist. After every session the memory is wiped, giving malware nowhere to survive between boots.
Unlike other distributions where privacy and security tools are installed as add-ons, Tails comes pre configured with everything you need already built in. Built-in security is always more trustworthy than add-on security.
Now for the feature most people love about Tails, the shutdown. There are two ways to shut it down. The manual way, which works like any other OS except it wipes the memory before powering off. And the emergency shutdown, which is as simple as pulling out the USB. Tails immediately skips to wiping memory, recommended when you do not have time for the manual process.
So next time the feds knock on your door, just pull out the USB.
Where Tails Falls Short
Regardless of all of this, it is important to be clear, there is no such thing as 100% anonymity or security. As the Tails documentation itself says:
Tails is not magic
It will not protect you from BIOS or firmware attacks, a keylogger on the device, your own opsec mistakes like installing malware or using persistent storage with a weak password, or zero day vulnerabilities in any pre-installed application.
Despite all of that Tails remains the top choice for dark web access for one reason its amnesic nature which makes it a literal anti-forensic operating system. The primary goal is minimising the digital trail that leads back to you, and no OS does that better.
To show both sides of what Tails can and cannot do, here are some real world cases.
Example 1: Brian Kil
Buster Hernandez, also known as Brian Kil, was a child predator and sexual extortionist whose crimes against underage victims began around 2012. The Brownsburg Police Department contacted the FBI in December 2015 after a case involving a minor female victim. Hernandez used Facebook to communicate with and sextort his victims. Facebook and the FBI investigated him for years trying to expose his identity with no success. The FBI even attempted to hack him directly and failed. From the evidence they had and their own failed attempts it was clear Hernandez was using Tails, which made de-anonymising him extremely difficult. At that point Facebook commissioned a cybersecurity consulting firm to develop a custom zero day exploit for Tails. The exploit targeted a vulnerability in the GNOME video player pre-installed in Tails. Facebook then sent Hernandez a video with a malicious code embedded in it and when he played it his identity was successfully revealed. The exact vulnerability remains unknown publicly but Tails is reported to have patched it although according to reports neither FBI nor Facebook ever disclosed the vulnerability to Tails.
Example 2: Snowden
On the other side of the same coin is Edward Snowden who used Tails to evade NSA and share the leaked documents. Leaked NSA documents confirmed that the agency considered Tails a major threat. That reputation alone speaks to its credibility. But as always the way you use it determines your security. Even Tails cannot protect you from your own behaviour.
While in exile Snowden started advocating Qubes OS as his threat model shifted from evading NSA to securing his workstation from sophisticated state sponsored attackers.
TOR Browser and TAILS
This guide covers Tails OS and the TOR Browser. For other setups you will need to do your own research.
Let’s start with installing Tails OS.
Begin by opening the TOR Browser.
This is optional, you can use any browser of your choice but using the TOR Browser is recommended if you want to stay hidden during the download itself.
Installing TOR Browser
If you do not have the TOR Browser yet now is the time to install it. The simplest way is from the official TOR website. However in some cases that is not possible. If you are in a heavily censored region the main TOR page may itself be blocked.
It is also documented from the Snowden leaks that XKeyscore, a system used to monitor and profile global internet traffic in real time, flags users who download or use the TOR Browser and Tails OS as potential threats.
In those cases TOR provides two official workarounds:
1. Official Mirror Links
Visit the official TOR support page and use the mirror links provided to download the TOR Browser.
2. GetTor — Official Bot
GetTor is an automated service that responds with a download link for the latest version of the TOR Browser from various sources including GitHub, Dropbox and Google Drive.
Via Telegram:
- Open Telegram and search for @GetTor_bot
- Tap “Start” or type and send “/start”
-
Select your language
-
Tap “Send me Tor Browser / Orbot” and choose your OS
-
Alternatively tap “More” then tap “Send me other mirrors for Tor browser” for alternative download links
Via email:
-
Open an email provider, Gmail works but for better privacy consider ProtonMail or Tutanota
-
Compose an email to gettor@torproject.org
-
Write your desired OS in the body, for example: windows
GetTor will respond with download links. It can take some time for a response. If Telegram is available I would recommend going that route to avoid delays.
Make sure to download the signature file alongside the browser as you will need it to verify the download (the .asc file in the above examples is the signature file).
Verifying TOR Browser
This step is optional but highly recommended. Since I am on Windows I will be using Kleopatra, which is a GUI for GPG4Win. If you prefer the command line or are on Linux, follow the official TOR guide instead.
-
Download GPG4Win and Kleopatra
-
Keep the official TOR verification guide open, you will need it as a reference
-
Open Kleopatra
-
Click on “Lookup on Server” in the top bar. This lets you search for the certificates from the GPG server.
-
Copy the TOR Project email address from the guide and paste it into the search field and click “Search”. This fetches all the certificates associated with the tor project email.
-
Scroll through the results to find “Developer TOR Browser”.
-
Visually compare the fingerprint with the one in the official guide, Once confirmed select the certificate and click “Import” in the top bar.
-
To complete verification you need to certify the imported key. Kleopatra requires trust to be established before it will verify anything this typically means confirming the fingerprint as we just did. Click on “Certify” in the dialogue box that just appeared if not select the “TOR Browsers Developers” certificate under the “Imported Certificates” tab and click on “Certify” in the top bar.
Keep in mind in order to certify, you need to have your own OpenPGP certificate, if you do not have one go to the “files” tab in the top bar and click on “Create new OpenPGP key” then enter your name and email, if you want add a passphrase then click create.
-
In the “Certify Certificates” dialogue box select your certificate in “Certify With” and select the “TOR Browser Developers” Certificate then click on “Certify”
-
From the “imported certificates” tab select “TOR Browsers Developers” and click on “Decrypt/Verify” in the top bar.
-
Select the signature ending with
.ascthat you downloaded alongside the Browser executable. Now you will see a green message indicating the signature has been successfully verified
A quick note on what we just did, GPG and PGP are not the same thing, though I will cover both in more detail in a future article. What you need to know here is that this is asymmetric cryptography being used to verify the integrity and authenticity of what you downloaded, confirming it has not been tampered with.
Installing Tails
If you are using the TOR Browser to download TAILS, be sure to set the security level from safest to safer this will restart the browser to implement the change, so consider setting this up before doing anything else.
The safest level blocks all the javascript and javascript is necessary for verifying the TAILS image.
Now that the TOR Browser is set up and verified, head to the official Tails website.
-
Go to the installation page and click on “Download Tails only (for USB sticks)”
-
Once the image has been downloaded, verify it directly from the page itself.
Flashing TAILS
Prerequisite:
The official Tails documentation recommends having three USB drives ideally:
- One for your main Tails OS, your day to day drive
- One as a backup for persistent data
- One as an intermediary for manual upgrades
Two USB drives is the minimum and works perfectly well:
- One for your main Tails OS
- One as the intermediary for upgrades
More on upgrades shortly. For now let’s flash the image.
On Windows the recommended tool is Rufus, available from the Windows App Store or the official website. On Linux go with Balena Etcher or any other imager you prefer.
Open Rufus, your USB may be pre-selected but if not choose it from the dropdown, select the Tails image you downloaded and click Write. It will take a few minutes. Once done eject the USB and shut down the device.
Booting into Tails
The boot menu key differs depending on your device and model so look it up on google for your specific machine. For example on my Lenovo V15 it is F12.
Shut the device down if it is not already off, plug in the USB, power it back on and press the boot menu key. Once the boot menu appears navigate with the arrow keys, select your USB drive and press Enter.
Once booted you can select your language, time zone and keyboard layout. You will also be asked whether you want to enable persistent storage at this point.
Anything you do not explicitly make persistent will be wiped on shutdown, that is the implicit rule Tails operates on.
Connecting To TOR
Once you have internet access through WiFi or ethernet the TOR Connection assistant will appear. Here you have two options to connect to TOR:
- Connect automatically to Tor
- Hide that you are connecting to Tor
Both of these are for different purposes and behave in different ways, hence it is important to understand what they do.
Connect automatically to Tor
This is the most commonly used method, here you can either choose to connect to TOR without a bridge this means your ISP will be able to see that you are accessing TOR but won't be able to see what you are doing inside it. If you would rather your ISP not know you are using TOR at all, or if there is heavy censorship blocking TOR connections in your region, you can enable a “Configure a Tor bridge”
Under configure a tor bridge you would be presented with a few options:
-
Use a default bridge
-
Ask for a bridge based on your region
-
Ask for a bridge by email
-
Enter a bridge that you already know
Default bridges are baked into the OS itself but are publicly known, which means there is a higher chance of them being blocked. The bridge by region option uses the MOAT API to fetch a bridge based on your selected region, or automatically based on your IP. The remaining two options involve manual setup which we will get into soon.
Worth noting, when you select the bridge by region option, Tails sends the request over the plain internet. You do not have to worry about that though, because Tails uses domain fronting to protect it.
What is domain fronting?
Domain fronting uses multiple domains to obfuscate traffic to the destination server by hiding where it is actually going. It is most commonly used by adversaries to hide their command and control servers, during the attack they exfiltrate data to a domain backed by a CDN (Content Delivery Network), which then forwards it to the actual destination. In the case of TOR your ISP sees you connecting to something like an AWS domain, which effectively hides the TOR server behind it.
For most users this option is good enough to connect to TOR.
Hide that you are connecting to Tor
If you choose this option you do the heavy lifting yourself. All the previous options are removed and you are left with only two:
- Ask for a bridge by email
- Enter a bridge you already know
Both are manual and will require you to obtain the bridge yourself. I won't go into the details here since this series is already getting bigger than intended. The official Tails documentation covers it thoroughly.
Manual Upgrades
Tails is user friendly and handles most upgrades automatically, but there are cases where it will prompt you to do a manual upgrade.
Running an outdated image is a risk worth taking seriously.
For a manual upgrade you need two USB drives, your regular day to day Tails USB and an intermediary.
-
Download the latest Tails image and flash it onto the intermediary USB following the same process as before
-
Once flashed eject it and shut down the device. Label the USBs clearly so you do not mix them up, a marker or sticker works fine. Plug the intermediary USB into the primary slot to boot from it and plug the regular USB into the second slot so the device recognises it as storage rather than bootable media
-
Boot into the intermediary Tails, go through the basic configurations, then open the “Apps” menu in the top bar, go to “Tails” and click “Tails Cloner”.
You will see two options in the Tails Cloner:
-
Clone the current Tails : clones the current version from your intermediary USB to the target USB. Recommended when your intermediary was freshly flashed with the latest image.
-
Use a downloaded Tails ISO image : clones from a separate image downloaded onto the intermediary USB. Useful if you do not have regular secure internet access. Just make sure persistent storage is enabled on the intermediary and download the image there to avoid RAM issues during the process.
-
Select the appropriate option, choose the target Tails USB if it is not pre-selected and click Upgrade.
Why two USBs instead of just reflashing?
Reflashing wipes everything including your persistent storage. Cloning preserves it. It also makes upgrading multiple USBs much easier. That is why two is the recommended minimum.
You are now set up and ready to use Tails OS with TOR and navigate the dark web.
Is This The End?
I know this was supposed to be the end, but to be honest I underestimated the length. This is a vast domain and once you start writing about it stopping becomes the hard part. The end is close though, in the next part we dive into the dark web ecosystem. Hang tight for part six.
Until next time, stay safe…
