Nexus Entrance / Board index /Reference
Nexus addresses three doors, one platform behind them

Your account, balance and orders are the same through all three. Copy rather than retype, and check the signature once you are through.

Door A nexusb2l73qzjn4slhyfxa3jvpolw7fomiz5sgyyefnsdhikaqgborqd.onion
Door B nexusma2iegzo7atzwbrwxhcdopyri3vare2twibldnlc3txqjdeb5yd.onion
Door C nexusabcd6xxpjuftr7i3uohealsg64xtgwrmznkfh3o3rkcf3raxead.onion

An address that opens is not an address that is genuine. The check that settles it takes under a minute.

The key

The step people skip because it produces nothing visible, and the one everything else on this site depends on.

Why the fingerprint and not the key file

A key is a large blob you cannot meaningfully inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable.

That reverses the usual instinct, which is to carefully save the key somewhere safe. The file needs no protection at all. It is public and you can fetch it from anywhere, including somewhere hostile, then check it against the fingerprint you hold. Only the fingerprint has to be right.

The circularityA signature checked against a key taken from the page you are checking proves nothing. The page, the key and the signature all came from the same party, and internal consistency is free for a forger.

Establishing it

  1. Collect it from several places. Independent means they would have to be compromised separately, so three pages by one operator count as one source, and three sites that copied a fourth also count as one.
  2. Compare in full. The whole string, character by character. Not the first four and last four, which is the check a forger designs around.
  3. If they agree, write it down somewhere you control. Paper is genuinely good, because it cannot be edited by anything running on your machine.
  4. If they disagree, stop and wait. At least one source is wrong and you cannot tell which from where you are standing. This is not a majority vote.

The four outcomes

ResultMeaningDo
BAD signatureThe maths fails. Text altered or signature fabricated.Leave. No judgement required.
No public keySigned by a key you do not hold. A gap in your keyring.Import the right key after checking its fingerprint, never one the page offers.
GOOD, unexpected keyMaths works, against a key that is not yours.Leave. The word GOOD appears, which is why this catches people.
GOOD, old dateVerifies, but the statement is months old.Treat as unconfirmed. Signatures never expire, so old genuine ones get replayed.

The last two are what catch experienced users, and one habit defeats both. Read which key signed and when, rather than pattern matching on the word GOOD. Two seconds.

What it does not tell you

That the signer is honest, that your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and no other tool available to you answers it at all. That narrowness is why it is worth doing and why it is not a substitute for anything else.