Tor Browser Setup and Onion Routing Basics for Market Access

Three hops. That is the entire design, and it still gets described as if it were a spell.

I treat Tor as a transport with a published threat model, not as a costume for browsing places you should not be buying from. This note is research context only. It does not point at any live market, mirror, or checkout flow. Using the Tor Browser is legal in the United States. What you do after the circuit is up can still be a crime, and the tool does not change that.

What the circuit actually is

Onion routing does not look up a direct path from your machine to a site. It picks a random series of relays and sends traffic through them. By convention that path is three nodes long: an entry node, also called a guard, then a middle node, then an exit node. The NYU explainer on Tor and onion routing is blunt about this. The path is a Tor circuit, not a smarter version of ordinary internet routing.

Before the client sends anything, it wraps the traffic in multiple layers of encryption. Each layer matches one node. A relay can peel only its own layer. It learns who handed it the packet and where the next hop is. It does not learn the rest.

That single property is the anonymity claim. In normal routing, intermediaries can often see both ends of a flow, or at least your IP next to the server you asked for. Inside a Tor circuit, no single relay is supposed to hold both your address and the final destination. The source is never meant to be tied to the destination in one observation.

The client holds the keys for the whole onion. Each relay holds only the key for its own layer. GeeksforGeeks puts it in those terms, and it matches the older description: the message stays wrapped until it leaves the onion-routing network. Eavesdroppers on one hop see ciphertext, not the conversation.

Where the circuit is weak

The interesting failures sit at the two ends, not in the middle hop that people obsess over.

At the start, your ISP can see that your device is talking to a Tor entry node. They can infer that you are using Tor. They are not supposed to see which site you asked for, or the contents, once the traffic is inside the network. “Using Tor” and “doing X on this site” are different facts. Plenty of investigations only need the first one.

At the end, the exit node decrypts the last layer and talks to the ordinary internet. If the site is plain HTTP, that exit can read what you send. IdentityIQ states the practical rule without decoration: the exit can see unencrypted data, so use HTTPS. The NYU writeup says the same thing from the other side. The final leg is where a snooper can pull identifying data if you skipped an encrypted protocol.

I do not treat “I was on Tor” as a substitute for endpoint encryption. The circuit hides the path. It does not encrypt the website for you after the exit.

There is a second, quieter limit. Wikipedia’s onion-routing page notes that timing analysis can break this kind of anonymity. An observer who can watch both your link and the far end can try to match bursts, even when the payload is wrapped. The design resists casual traffic analysis. It does not promise immunity to a patient one.

Why the path is deliberately dumb

Normal routing picks a path for congestion, protocol cost, and speed. Onion routing does not. IdentityIQ’s comparison is the clean one: Tor’s path selection favors privacy over efficiency. Relays are chosen to jumble origin and destination, not to give you the fastest route.

That is why sessions feel slow, and why a “faster” unofficial build is a bad trade. You are paying in latency so that no hop is optimizing for a short, predictable route that an observer could guess.

A few contrasts are worth keeping straight:

• Normal packets are often unencrypted by default. Onion routing adds a layer per hop.
• Normal routing exposes your IP to the servers that handle the flow. Each Tor relay is meant to know only the previous hop and the next one.
• Normal routing exists to deliver packets reliably. Onion routing exists to separate who you are from where the traffic goes.
• The network is decentralized. There is no central switch that “turns anonymity on” for a session.

GeeksforGeeks lists the same shape: layered encryption, relays that see only neighbors, resistance to simple traffic analysis, and no central authority. None of that is a warranty. It is a set of constraints.

Hidden services are a different exit

People collapse two Tor jobs into one. They are not the same.

Job one is reaching the ordinary web through an exit. The last relay is on the public internet, and it can see whatever you failed to encrypt.

Job two is a hidden service. Tor can host sites whose names end in .onion. Those addresses are reachable only through Tor. IdentityIQ notes that both the operator and the visitor are meant to keep location and identity off the clear address system. The site is not “behind an exit” in the HTTP sense above. There is no public IP on a directory listing for you to resolve in a normal browser.

A .onion name is an address format. It is not a reputation score. I will not rehash how clones and fake mirrors get passed around. That is a separate problem, and a string of random characters does not settle it.

If you are only reading public reporting about markets, you often never need a hidden service at all. Court filings, seizure notices, and vendor postmortems sit on the regular web. Tor becomes relevant when the document itself lives only on the onion network, or when you are studying how the transport behaves.

What “setup” can honestly mean

The sources I am using do not publish a click path, a version number, or a settings panel. I am not going to invent one.

What they do describe is the client behavior. You run a Tor client. It builds a three-hop circuit with the network’s own selection algorithm. It applies the layers. Traffic enters at the guard, which is the only relay that should see your IP. Later relays should not. If the destination is a normal site, an exit finishes the job. If the destination is a .onion service, you stay inside Tor’s hidden-service model instead of popping out onto the public web.

There is no market mode in that design. There is no extra circuit that appears because a site sells something. The same three-hop convention, the same per-hop keys, and the same exit rule apply whether the page is a newspaper or a storefront.

A few limits fall out of that, and I would rather state them than imply a hardened workstation:

• The guard knows your IP. That is the point of an entry. Later hops are what keep that IP off the destination.
• The exit, when there is one, sees plaintext if you did not use HTTPS.
• The site you finally talk to still sees the account, the language, the screen size, and anything you type. Tor does not anonymize the application.
• Your ISP can still see Tor use, even when it cannot see the destination.

If a guide promises that a browser install erases those four facts, it is selling a feeling.

Where the idea came from

Onion routing is older than the current browser. Wikipedia records the work in the mid-1990s at the U.S. Naval Research Laboratory, by Paul Syverson, Michael G. Reed, and David Goldschlag, aimed at protecting U.S. intelligence communications. DARPA refined it. The Navy patented it in 1998. The same year the authors described it in the IEEE Journal on Selected Areas in Communications, including uses on things that already existed: web browsing, email, remote login, VPN-style links, electronic cash.

The original problem was traffic analysis, not shopping. An outsider who can watch the wire should not be able to tie a user to a destination. That framing still fits journalists and activists, which is the use GeeksforGeeks actually names. It fits a researcher pulling a .onion page to document a seizure. It is a poor fit for anyone who thinks the circuit launders a transaction.

What I will not treat as a feature

Path hiding is not payment privacy. It is not a defense against a market operator who logs your messages. It is not a defense against malware in a page, or against you reusing a name you already burned on the clearnet.

I also will not dress this up with escrow totals or seizure timelines. The notes in front of me do not contain those figures, and a round number invented to sound forensic would be worse than silence.

The cynical read, which I think is the accurate one, is that both sides oversell the network. Law-enforcement press lines sometimes talk as if Tor were opaque magic. Market admins talk as if a circuit made their users untouchable. The engineering sits in between. Three relays, layered keys, a visible guard, a dangerous exit, a separate hidden-service path, and known attacks like timing analysis.

If you are documenting how onion services differ from clearnet exits, that model is enough to start. If you want a route into a live market, this is the wrong note, and I am not writing that one.