Fingerprinting in Tor Browser: What Still Leaks and What Does Not
Tor Browser blocks most fingerprinting by making everyone look identical. Here is what the uniformity defense covers, what still slips through, and how users wreck it.
Security
70 postsshort, practical notes about not getting phished. no fear mongering, just the checklist.
latest notes
newest firstCaptchas on hidden services: convenience bought at a privacy price
Onion operators lean on captchas to survive DDoS waves, but third-party challenges can leak visitor data and break anonymity. Here is how to weigh the trade-offs.
One Account, One Password: Why Credential Reuse Keeps Killing Market Logins
Most compromised accounts fall to reused passwords, not exploits. How old dumps fuel modern takeovers, what NIST actually recommends, and how to build logins that survive.
PGP-backed two-factor logins: how the challenge works, when it fails, and why markets made it mandatory
A stolen password no longer opens an account protected by PGP two-factor login. Here is how challenge-response authentication works, where it fails, and what it actually buys you.
Monero vs Bitcoin privacy: what beginners should actually understand
A beginner guide to crypto privacy: how Bitcoin's transparent UTXO model differs from Monero ring signatures and stealth addresses, why markets switched to XMR.
Bitcoin change addresses explained: where your privacy actually leaks
Change outputs quietly link your Bitcoin addresses into a single cluster. How the common-input heuristic works, and the de-anonymizations it made possible.
Chain Analysis for Beginners: How Your Transactions Get Clustered
Bitcoin looks anonymous but rarely is. We explain how analysts cluster addresses, why KYC exchanges are the choke point, and what mixing really buys you.
Sanctioning the Code: The Mixer Crackdown and Its Unraveling
From Blender.io to Tornado Cash to Sinbad, OFAC's war on crypto mixers tested a novel idea: that code itself can be sanctioned. Here is how it unfolded.
The End of Easy Bitcoin Privacy: How the Samourai Arrests Killed Off CoinJoin
Arrests, server seizures and regulatory fear ended one-click CoinJoin in under six weeks. Here is how investigators took down Samourai, why Wasabi folded, and what fills the gap.
Wallet hygiene checklist: why separating spending, savings and burn wallets beats any security tool
Most crypto losses trace back to one mistake: keeping every satoshi in a single wallet. A practical checklist for splitting spending, savings and burn wallets.
Fake Admins, Fake Police: How Impersonation and Extortion Scams Prey on Dark Web Users
Fake admins, spoofed police letters and forged seizure banners now drain more wallets than most hacks. Here are the documented campaigns and how to verify any official contact.
The Fake Support Ticket: How Scammers Wear the Staff Badge
Scammers posing as market staff and tool support run a polished ticket-based con. Here is the playbook they follow and the verification steps that actually stop them.