Chapter 3 of 6 / I cannot get in
I cannot get in
The chapter where the natural reaction makes things worse. Trying harder and faster is what a rate limiter is built to punish, and by the fourth attempt the cause of the failure is usually the first three.
What are you seeing
- My password is refusedCheck the address before the next attempt, not after.
- The captcha never passesUsually the circuit, sometimes the clock, rarely your typing.
- The second factor code is rejectedCheck the clock before you assume anything else.
- It says the account does not existUsually the username or the wrong address. Occasionally worse.
- I log in and get thrown straight outUsually the session, occasionally somebody else being in there.
Why every refusal looks the same
A hidden service cannot see who is knocking. There is no address to filter on, no country, no account until somebody logs in. Every connection looks identical to every other one, so everything protective the far side does has to be behavioural: slow down repeats, refuse bursts, drop connections under load.
All of those arrive at your browser as the same blank no. Telling you which one applied would also tell whatever is hammering the door, so the vagueness is deliberate and it is not aimed at you.
The sequence that fixes most of this chapter
- Check the address before the next attempt. A form refusing correct credentials is also what a copy looks like after taking them, and every retry hands them over again.
- Build a new circuit. A dying route produces failures that read exactly like rejection.
- Check your clock if a time based code is involved. A drifted machine fails every attempt while you do nothing wrong.
- Try another address from the set. Sessions are shared, so failing on one and working on another points at that address.
- Then stop for an hour. Past this point you are feeding a rate limiter.
The thing that turns this into a real loss
Do not go looking for a support contact. No market runs support on a chat app, a forum account or an email address, so everything presenting itself that way is aimed squarely at people in exactly this state. Support lives behind the login you cannot currently reach, which is unhelpful and true.
What decides whether this is an annoyance or the end
Whether you saved the recovery material when you set the account up. With it, almost everything here is recoverable. Without it, recovery is limited and often impossible, because the alternative would be a mechanism for taking over accounts you do not own. That minute happened months before today and it is the whole difference.