How to check that a Mars Market address is the real one
Two ways to check an address
There are two tiers, and they are not the same task.
The ten-second check is what you do on every visit. The full check is what you do when you are on a new device, after a rotation, or when something feels off. If you only ever do the ten-second check, you will be fine most of the time. If you skip the full check on your first visit from a laptop you just set up, you are betting on luck.
The ten-second check
Three things, in order.
- The address starts with
mars. - Between the start and
.onionthere are 56 characters. Count them once. You will not need to count them again, but the habit of counting once is what separates a check from a glance. - The last six characters of what is in your address bar match the last six characters of what you copied from this site.
That last one matters because it is where clones fail. A vanity prefix like mars is cheap to generate. Operators do it on purpose so the address is memorable. The tail is random, and a phisher who does not control the onion cannot make it match yours. A clone that matches only the prefix is the common pattern you will see in chat links and forum replies. It is not the market.
The full check: the PGP chain
The operator signs the mirror list with a PGP key. The signature is the part that survives contact with a phisher, because the phisher does not hold the key.
The signed list lives in two places:
- the "Verify Mirror" panel on the market's own login page, behind the gate
- the operator's Dread subforum,
/d/MarsMarket
The signing key:
- user id:
msk <[email protected]> - fingerprint:
5C7E5124 821D5AD6 9C4E668C 2324E086 159BACCC
You do not need to memorize the fingerprint. You need to know where to get a copy of the key from a channel you already trust.
The order of trust, which is the part people get wrong
- Get the key from a channel you already trust. The Dread sub. A friend who has already verified the market and will compare fingerprints with you over a channel you both trust. Not from the address you are trying to verify. That is the mistake: opening a site, taking the key it publishes, and then using that key to verify the same site. You have just asked the stranger to confirm his own identity.
- Check that the mirror list you have is actually signed by that key. A signature that does not verify against the fingerprint is not a signature.
- Compare the address in your address bar against the signed list. Character by character if you are being careful.
A site that publishes a key and a signed list together proves nothing. A phisher can fake both at once, because he controls both. The key has to come from outside the thing you are checking.
What "verified" means on this directory
The three addresses published on this site are:
marsautbk3di5cj75eh4dakjjrngddnjwqfdltbq2sy6cf7unzkd2bad.onionmarshjhtog245vzjzcicnmv2ci6yljibvdm4pngq5kmkfvcutppboxad.onionmarsmtbwtxkohhpu34m4jkwcntian7n257wsex5tbkmsjdjrsz6me3yd.onion
All three are the same store. Same accounts, same balances. Log in at any one of them and you are in the same place.
They matched the operator's signed set when the page was last updated. That is all the word "verified" means here. It is a statement about the source, not a live status. This site does not monitor the onions. It makes no network requests to them. It cannot tell you whether an address is answering right now, and it will not put a green dot next to one to suggest it can.
When a check fails
Do not log in. Do not deposit. Close the tab. Go back to the mirrors page (mirrors.html), re-copy the address from there, and run the checks again. If the same address fails again, the problem is not your copy. Treat the address as unknown until the full check passes.