Chapter 2 of 6 / is this the real one
Is this the real one
This is the shortest chapter to summarise and the hardest to act on. One check answers it completely and nothing else answers it at all, which means most of what people do here is effort spent in the wrong place.
What are you seeing
- The address looks familiarFamiliar is what a forgery buys. It was never evidence.
- There is no signed message anywhereAn announcement nobody signed is an announcement nobody claimed.
- The check said good and I am still unsureGood against the wrong key is still the wrong key.
- The signed statement is months oldSignatures never expire, so real old ones get shown again.
- Somebody sent me this linkClickable text, a QR square and a shortener all hide the string.
- The page looks slightly differentUsually a real change. Never evidence either way.
The one thing that settles it
A signed statement, checked against a fingerprint you collected somewhere else beforehand. It proves two things narrowly and completely: that the holder of one specific private key produced the text, and that the text has not been altered since.
It does not prove the signer is honest, that the key is still in the same hands, or that the statement is current. Those limits are why the check is worth anything. Something that claimed to answer all of it would be answering none of it.
The mistake that makes the whole check pointless
Verifying against a key taken from the page you are checking is a page vouching for itself, and internal consistency costs a forger nothing. The fingerprint has to come from elsewhere, and gathering it is the only part of this subject that takes real work. About an hour, once.
What does not settle it
| What people check | What it is worth |
|---|---|
| The layout looks right | Nothing. A page is a file and the copy is the same file |
| It loaded quickly | Slightly worse than nothing. Copies carry no load |
| The address starts with the right characters | Nothing on its own. That is what a forgery buys first |
| A friend sent the link | Nothing. Trust does not carry across |
| It was high in search results | Nothing. Pages get built honestly and swapped later |
| There is a padlock | Nothing. It is not that kind of address |
Every row above is a reasonable thing to notice and none of them is evidence. That is not a criticism of anyone, it is a fact about how cheap copying a website is.
The order that makes this chapter easy
- Compare the address against your own saved copy before you open it.
- Check a signed statement against your pinned fingerprint before you type anything.
- Only then look at the page. A screen is the last thing to judge by, not the first.