Getting the browser
The easiest job in the whole run. It is worth a page anyway, because two small things surprise people on the first launch and both look like something has gone wrong.
Back to minute 5Crown market addresses
crownm5jmtbhqnoxhexx7nyiygqgqofp3wnjyyfl74gziohqqy6oq5id.onioncrownrywlm7mnohkzntlir2tlhafq6tzphgqyag5cw5en7nprchfklad.onioncrownwpaimgizxylrvrh4u6acpvk4l757cfla7xs6zjki7tdjqbnv6qd.onionPublished exactly as supplied. Nothing on this site is monitored, tested or checked, so no address here is claimed to be working. What a copied address does and does not settle.
What actually happens here
You go to the official project site, download the build for your system, and install it the way you install anything. Nothing about the install is unusual. On the desktop it is a normal installer or a drag into an applications folder.
Then you open it, and the first surprise arrives. It does not go straight to a page. It shows a connect step, and it sits there for several seconds while it builds a route through the network. On a slow connection or a restricted one it can take much longer, and there is no percentage to watch. That pause is the software working, not failing.
The second surprise is what it looks like when it does open. It is deliberately plain and it does not carry any of your bookmarks, history or logins. That is the point. Notice that this browser is not your normal browser wearing a hat. Treat it as a separate thing that shares nothing with the rest of your machine.
Get it from the source, and check the download
Download it from the project official site and nowhere else. Bundled copies on download portals are a known problem and they have been used to distribute modified builds. The official project publishes signatures alongside the files so that a downloaded copy can be checked against them.
Checking a signature is a genuine step and it is also the step most first time readers skip, because it involves a second tool and some patience. If you are going to skip it, at least type the project address by hand rather than arriving through a search result, since the search result is the part that gets impersonated.
The settings worth touching once
- The security level. There is a control that raises it. Raising it turns off features that have historically been how browsers get attacked. It makes some sites look broken, which is a fair trade in this context.
- Nothing else. Resist customising. Every change you make narrows the crowd of people whose browser looks exactly like yours, and the plain default is the whole point.
- Do not install anything into it. Extensions change how it behaves and how it looks from outside.
- It disables the machinery that most browser attacks depend on.
- It reduces the number of ways a page can behave differently for you than for anybody else.
- It is a single control, applied once, with no ongoing effort.
- Some pages break visibly, and a broken page reads as a problem with the address rather than a setting you changed.
- Sites that depend on scripts may become unusable, which occasionally includes parts of a market interface.
- It gives no protection at all against anything you type in yourself.
The stall is the connect pause on a first launch. It sits there, nothing moves, and the reader closes it and starts again. Repeated closing and reopening makes it slower rather than faster.
The second stall is a restricted network where the plain connection does not complete at all. There is a built in path for that, offered on the same screen, which routes the connection differently. Most people never see this and the ones who do usually assume the software is broken.
The third is quieter. Somebody uses the browser they already had, gets an address not found error, and concludes the address is dead. That error is the expected result of asking an ordinary browser to do something it cannot do.
Almost all of that is transfer time and it runs unattended. Start it, then go and do the address half of this phase while it works.
Before you leave this page
Open the browser once and let it connect fully before you paste anything. A first connection that has already succeeded removes an entire class of confusion at arrival, because you will know that a page failing to load is about the address rather than about the browser.
Keep it closed when you are not using it. It has no reason to sit open on a machine that other people use, which is the subject of the machine page at minute 0.
A download, a wait, and one setting. The only thing that catches people is a pause on first launch that looks exactly like a hang.