How to access Awazon Market without a browser you half trust

Step one, and the one thing to get right about it

Tor Browser comes from the Tor Project and should be taken from torproject.org. Every step of the process below breaks down somewhere else, but a browser handed to you by a search ad is the step where most of it does.

On Android the same project ships Orbot, which is a proxy that pushes an app’s traffic through Tor rather than a browser with a location bar. On iOS the build that carries the same onion routing is called TorDNS, and onion addresses are the last thing it does comfortably, so most people who arrive here from a phone end up on Android or desktop.

A browser plus a toggle is not the same object. The hardened Firefox build the project ships disables the things that leak by default, and the version you already use does not.

Step two, the slider

Set the security level to Safest. It disables JavaScript on every site, which for a storefront that renders as plain HTML is close to free, and it is the setting that makes most of the fingerprinting surface disappear. If a page comes up half assembled, moving one notch to Safer for one visit is a legitimate decision, and switching JavaScript off again afterwards is not optional.

Safest also blocks a number of the fonts and scripts that an imitation page leans on to look convincing. A real onion looks worse at Safest than a fake one does, and knowing that in advance stops a lot of bad second impressions.

Step three, the address bar

The address bar is the only certificate an onion site has. Read the prefix, read the last six characters, compare them against a signed announcement. How a v3 address is constructed explains why the tail is the part that cannot be pasted in for free.

Step four, the part people skip

Turn on the two factor option in the account settings before you move money in, not after. A market cannot return a compromised password, and the login is the one place where a mirror can lie about who you are talking to. Security, 2FA and PGP covers what the second factor protects and what it leaves alone.

What can still go wrong on a first visit

• A bridge is required by some ISPs and by some countries. Tor Browser will offer obfs4 and Snowflake bridges in its connection assistant, and a bridge is the fix when the bootstrap stops at a percentage that never moves.
• An old bookmark to an address that has been retired gives a timeout, which reads exactly like an outage.
• A desktop that routes system DNS through your ISP while the browser is on Tor leaks what you asked for. The onion address page says why DNS does not resolve a .onion name at all.
• The clock on a phone that has been switched off for a week can break certificate validation on the clear web sites you pass through on the way in. Onion hops themselves do not need the clock to be right.
• Automatic updates on Tor Browser occasionally restart the circuit mid order. Do the update before you deposit, not while a dispute is open.

Questions

Do I need Tor to open an Awazon Market link?

Yes. A .onion name is resolved inside the onion network by the browser itself. Chrome, Safari and a normal Firefox have no path to that name and no DNS server on earth can hand one back.

Is a tor2web link safe enough?

It moves your traffic through somebody else’s clear web relay, in plain HTTP, before it enters Tor. That relay sees the whole of what you send. Fine for reading a listing, wrong for logging in. The screen most of these links hand you is described on the access queue page.

Why does the market block JavaScript at all?

A script is an instruction to run the operator’s code inside your browser. A storefront that renders on the server has less of it to begin with, and at Safest it has none.

Does the browser choice change what the escrow does?

Not by one signature. The escrow rules belong to the market and are identical whichever way you arrived.