Chapter 2 of 6 / is this the real one
Somebody sent me this link
The whole value of an onion address is that you can read it. Anything that wraps it in something more convenient has taken that away, and convenience was what you were going to check with.
Three wrappers, one problem
| Wrapper | What it hides | What to do |
|---|---|---|
| Clickable text | The real target, which can be any address at all | Copy the link instead of clicking, then read what you copied |
| A QR square | Everything. It is unreadable by design | Decode it to text and read the text. Never scan and go |
| A shortener | The whole address, behind a domain that is not an onion | Do not. There is no version of this worth the convenience |
| A screenshot of a list | Nothing, but you cannot copy or compare from it | Use it to go find a real list, not as a source |
The one with no warning
A QR code has no error message for pointing somewhere wrong. It either takes you somewhere or it does not, and by the time a page is loading the ten seconds where you could have checked have already gone. Treat it as a link you are not allowed to see.
Why knowing the sender does not help
The strongest thing working in favour of a sent link is that you know who sent it, and that feeling is doing no work at all. Your contact got it from somewhere, and either checked it or did not, and you have no way to know which. Trust is not transitive and never has been in this subject.
The same goes for a forum reply with a long posting history behind it. History belongs to an account, accounts change hands quietly, and the history is precisely what makes one worth buying.
What to do instead
- Copy, do not click. Copying gives you the string. Clicking gives you a page.
- Paste it next to your own saved copy and see whether the lines match.
- If you have nothing to compare against, get a current set first. Comparing the link against the address in the same message is not comparing.
- Then check a signature once you are through. Matching the string proves you arrived where you meant to, not that the destination is what it claims.
The version that arrives during an outage
A helpful link that shows up while nothing is loading deserves more suspicion than the same link on an ordinary day, because the comparison you would normally run is unavailable and you already believe something has changed. The page is not persuading you of anything. You did that part yourself before you arrived.