I was wondering how DNM track the user session, while keeping it safe and private.
I read this: Cookies and Darknet Markets
Usage of Cookies in Darknet Markets
General Practice: Many darknet markets tend to avoid using cookies for privacy and anonymity reasons. Cookies can expose user activity and patterns, which goes against the fundamental principles of privacy that many users seek in these environments.
Session Management: Instead of traditional cookies, some markets may rely on:
Session IDs in URLs: Passing session identifiers through query parameters can allow the server to track user sessions without using cookies, although this has its own set of risks.
Tor and Onion Services: Running on the Tor network can afford some level of anonymity. Users might rely on the network’s inherent privacy rather than cookie-based solutions.
User Privacy: Darknet markets are built around maintaining user anonymity and privacy. Many prefer to avoid storing any persistent data like cookies that could be tracked or traced back to users.
Before someone freaks out, no, Im not asking that to a LLM. I have already read the opsec Bible too. I wanna know wether someone with enough knowledge can tell me how this works. Basically it suggested using the URL request query as a key to a hashmap containing the data needed for the session. As some can already understand, I cant ask this on SO either.... Thanks. Also, how do I add my pgp key on my profile??
Session cookies are not persistent, actually most persistent storage APIs require JS like localStorage.
You can, and should, use cookies. You should NEVER store the cookie as a GET variable, people would leak that immediately lol.
Using PHP as an example, when you store session data against the user PHP will automatically submit the PHPSESSID cookie, which is just a string ID that PHP then internally looks up in its own database (by default, stored in the filesystem) to provide the PHP process with session data set on the user.
Some examples of what you may store inside the session for a DNM: cart, internal user ID. None of those values are ever exposed to the user (unless you use something like a JWT session cookie, which YMMV as to whether this is good or not).
Sessions automatically expire after some time, both in the browser cookies but also on the server side. Enterprise systems will often use an in-memory store such as Valkey for their sessions, which means the session data is generally not persisted to disk and is stored wholly in RAM.
You can, and should, use cookies. You should NEVER store the cookie as a GET variable, people would leak that immediately lol.
Using PHP as an example, when you store session data against the user PHP will automatically submit the PHPSESSID cookie, which is just a string ID that PHP then internally looks up in its own database (by default, stored in the filesystem) to provide the PHP process with session data set on the user.
Some examples of what you may store inside the session for a DNM: cart, internal user ID. None of those values are ever exposed to the user (unless you use something like a JWT session cookie, which YMMV as to whether this is good or not).
Sessions automatically expire after some time, both in the browser cookies but also on the server side. Enterprise systems will often use an in-memory store such as Valkey for their sessions, which means the session data is generally not persisted to disk and is stored wholly in RAM.