Pinning the fingerprint
One careful hour, once, and every check afterwards becomes mechanical. This is that hour.
Nearly every piece of advice on this site eventually reduces to check the signature, which quietly assumes you have the right key. Establishing that is the part people skip, and it is the part everything else rests on.
Why the fingerprint and not the key
A key is a large blob you cannot inspect. A fingerprint is a short hash of it, forty hex characters, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat any key file as disposable, because a key that does not match the fingerprint is not the key regardless of where it came from.
This inverts the usual instinct, which is to carefully save the key file somewhere safe. The file does not need protecting. It is public, and you can fetch it from anywhere including somewhere hostile, then check it against the fingerprint you hold. The fingerprint is the thing that must be right.
Establishing it
- Collect the fingerprint from several independent places. Independent means they would have to be compromised separately, so three pages by the same operator do not count as three sources.
- Compare them character by character, in full. Not the first four and last four, which is the check that a forger designs around.
- If they all agree, write it down somewhere you control and will find again. Paper is fine and has the advantage of not being editable by anything running on your machine.
- If they disagree, stop. A disagreement means at least one source is wrong or compromised, and you cannot tell which from where you are standing.
The four outcomes of a check
| BAD signature | The maths fails. Text altered after signing or signature fabricated. Unambiguous, and the only response is to leave. |
|---|---|
| No public key | Signed by a key you do not hold. A gap in your keyring, not a verdict on the message. Import the right key after checking the fingerprint, never one the page hands you. |
| GOOD, wrong key | The maths works against a key that is not yours. The dangerous one, because the word GOOD appears. Read which key ID signed, not just the word. |
| GOOD, stale content | Everything verifies but the statement is old. Signatures never expire, so old genuine statements get replayed. Read the date inside the signed text. |
The habit that makes it work
Read the output rather than pattern matching on the word GOOD. The last two rows above are the ones that catch experienced people, and both are defeated by spending two extra seconds looking at which key signed and when. Everything else about verification is mechanical. That two seconds is the part that requires attention, every time, and it is the part that stops being done once the check becomes routine.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.