How to verify PGP signatures step by step: import, check, and spot fakes
A practical walkthrough of PGP signature verification: install GnuPG, import and check keys, verify detached and clearsigned messages, and avoid common beginner mistakes.
home / news
news & notes
141 postsshort notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
latest notes
newest firstWhy phishing mirrors work: the psychology and mechanics behind the darknet's most reliable scam
Fake mirrors steal logins and deposits because they exploit urgency, brand trust, and poisoned link lists. Here is how the trick works and which habits defeat it.
Clipboard hijackers: the silent malware that swaps your crypto address
Clipboard hijackers watch for copied crypto addresses and swap them in milliseconds. Why glancing at the first and last characters is no longer enough.
Address poisoning explained: how lookalike addresses drain crypto wallets
Address poisoning seeds your transaction history with lookalike wallet addresses and waits for one careless copy-paste. How the scam works, what victims lost, and why saved address books win.
One Wrong Character: How Onion Typosquatting Sends Users to Impostor Servers
Change a single character in a .onion address and Tor connects you to a completely different server. We review documented lookalike campaigns and the verification habits that hold up.
The Padlock on Onion Sites: What HTTPS Certificates Really Mean for .onion
A padlock on an .onion site means something different than on the clearnet. We look at what TLS adds to onion services, and what Tor already does without it.
Fingerprinting in Tor Browser: What Still Leaks and What Does Not
Tor Browser blocks most fingerprinting by making everyone look identical. Here is what the uniformity defense covers, what still slips through, and how users wreck it.
Captchas on hidden services: convenience bought at a privacy price
Onion operators lean on captchas to survive DDoS waves, but third-party challenges can leak visitor data and break anonymity. Here is how to weigh the trade-offs.
One Account, One Password: Why Credential Reuse Keeps Killing Market Logins
Most compromised accounts fall to reused passwords, not exploits. How old dumps fuel modern takeovers, what NIST actually recommends, and how to build logins that survive.
PGP-backed two-factor logins: how the challenge works, when it fails, and why markets made it mandatory
A stolen password no longer opens an account protected by PGP two-factor login. Here is how challenge-response authentication works, where it fails, and what it actually buys you.
Monero vs Bitcoin privacy: what beginners should actually understand
A beginner guide to crypto privacy: how Bitcoin's transparent UTXO model differs from Monero ring signatures and stealth addresses, why markets switched to XMR.
Bitcoin change addresses explained: where your privacy actually leaks
Change outputs quietly link your Bitcoin addresses into a single cluster. How the common-input heuristic works, and the de-anonymizations it made possible.