Security on a market is a stack, and the stack fails at the layer that is weakest, not the layer that is most complicated. This is the stack, in the order it fails, and the habit that holds each layer.

The browser layer

The browser is the first layer, and it fails when it is the wrong browser, or the wrong build. A normal browser cannot reach the market at all, and a browser that was downloaded from a search result may carry extra software. The habit is to type the download address yourself, and to use the browser that is built for the network, which is Tor Browser, from torproject.org.

The address layer

The address is the second layer, and it fails when it is typed, or when it is not checked. A typed address is a chance for a mistake, and an unchecked address is a chance for a clone. The habit is to copy the address, and to read it from the end backwards after the page loads, before the password goes in. Five seconds, every login.

The account layer

The account is the third layer, and it fails when the password is reused, or when the second factor is missing. A reused password is a password that has already been taken somewhere else, and a missing 2FA is an account that is one keylogger away from being open. The habit is a long unique password, and 2FA enabled in the first session, with the recovery codes written down and tested.

The message layer

The message is the fourth layer, and it fails when the delivery details are sent in the clear. The platform can read an unencrypted message, and the delivery details are the part that identifies you to a courier. The habit is to encrypt the delivery details with the vendor's key, and to keep the PGP private key backed up separately from the account.

The money layer

The money is the fifth layer, and it fails when the balance is larger than the session, or when the payment comes from an exchange. A large balance is a large exposure, and an exchange payment is a trace that connects the payment to an identity. The habit is to deposit only what the order needs, to pay from a personal wallet, and to withdraw the rest.

The layers are separate, and the failure is always at one of them, and the check at each one is a habit that takes seconds. The address check, the account setup, the message layer, and the money layer each have their own guide.