Verifying an address

Two independent checks. Do both before a first login. After that, the address check alone covers every session, because the key does not change and the address is the thing that gets copied wrong or phished.

Check one: the characters

Copy an address from the list, paste it into the Tor Browser, and before you do anything else read the last six characters of the address bar back out loud, then against the tail printed next to the address you copied. If you are ever in a situation where you must type by hand (you should not be), compare the last twelve instead.

The reason the check lives at the end: a 56 character string is where human attention dies. The beginning is memorized as a shape, blackops plus some letters, and the eye skips to the tail with confidence it does not have. The last six characters carry no meaning, so the eye reads them like a phone number, and that is exactly when they get swapped.

Check two: the signature

The market signs things with one key. Everything that matters, the mirror list on the Dread board, the announcements, the support mail, uses it. The key's identity:

• Identity: Black Ops <[email protected]>
• Fingerprint: 03D4 A411 AC86 38C2 7049 C980 06DF 63DB 2AA3 B0E7
• Key ID: 06DF63DB2AA3B0E7

Get the key from inside the market, where the PGP key is published, import it, then ask your tooling to show the fingerprint and read it back against the string above:

gpg --import blackops.asc
gpg --fingerprint [email protected]

If the output does not match, the key in your hand is not the key the market signs with, and nothing it signs is a fact. The full public key is on the PGP key page, where it can be copied in one block.

How the two checks fit together

The signed mirror list tells you which addresses are real. The character comparison tells you which address you are actually on. Each one alone has a hole: a real key cannot save you if you are logged in on the wrong address, and matching characters do not prove the address is still one the market stands behind. Do both, once per new address, and the question stops being interesting.