If you want to take OPSEC serious you should use QubesOS, which could be argued is one of the most secure OS there is, because it isolates different services/ applications in VMs (virtual machines) and enables you to route all traffic though TOR network (through sys-whonix/ whonix gateway).
How to use it correctly:
Get a Laptop capable of running Qubes (https://www.qubes-os.org/doc/system-requirements/) from e.g. Facebook Marketplace. Make sure to pay with cash. Install QubesOS on it, make sure to disk encrypt QubesOS, set strong passwords for that, let your traffic for everything including updates run through TOR (see QubesOS documentation).
Use an airgapped VM (virtual machine), known as vault in Qubes, to store your passwords (KeypassXC) or sensitive files (one can further improve security here by making the airgapped VM start with MFA only).
For browsing or logging into darknet forums, use a disposable VM that leaves no traces and use stored random generated passwords/usernames in ur encrypted KeypassXC database (in airgapped vm). It is important to mention that your ISP provider can see that u are using TOR network, in most jurisdictions this shouldnt be a problem.
If it is a problem then use a virtual machine that runs proton/ mullvad VPN and route traffic through this vpn qubes before sys-whonix so it appears as if you are using a VPN only. One can also achieve the opposite by u routing traffic through sys-whonix first and then through ur VPN VM to make your outgoing traffic appear as coming from VPN since there are a lot of services blocking TOR traffic.
Most things from installation to set up can be found here: https://www.qubes-os.org/doc/.
Advanced user Opsec addition: Remove battery from laptop --> Use remote control to switch of power so laptop encrypts itself (carry remote control with you when using Laptop)
If you have any improvements/ questions feel free to ask.
How to use it correctly:
Get a Laptop capable of running Qubes (https://www.qubes-os.org/doc/system-requirements/) from e.g. Facebook Marketplace. Make sure to pay with cash. Install QubesOS on it, make sure to disk encrypt QubesOS, set strong passwords for that, let your traffic for everything including updates run through TOR (see QubesOS documentation).
Use an airgapped VM (virtual machine), known as vault in Qubes, to store your passwords (KeypassXC) or sensitive files (one can further improve security here by making the airgapped VM start with MFA only).
For browsing or logging into darknet forums, use a disposable VM that leaves no traces and use stored random generated passwords/usernames in ur encrypted KeypassXC database (in airgapped vm). It is important to mention that your ISP provider can see that u are using TOR network, in most jurisdictions this shouldnt be a problem.
If it is a problem then use a virtual machine that runs proton/ mullvad VPN and route traffic through this vpn qubes before sys-whonix so it appears as if you are using a VPN only. One can also achieve the opposite by u routing traffic through sys-whonix first and then through ur VPN VM to make your outgoing traffic appear as coming from VPN since there are a lot of services blocking TOR traffic.
Most things from installation to set up can be found here: https://www.qubes-os.org/doc/.
Advanced user Opsec addition: Remove battery from laptop --> Use remote control to switch of power so laptop encrypts itself (carry remote control with you when using Laptop)
If you have any improvements/ questions feel free to ask.
