messages ยท post 05 of 7 in this channel
A signed message from WeTheNorth is worth checking
Most of this feed says that verification is harder than it looks. This post is the exception, and it is worth the effort.
the three wethenorth market addresses
hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onionhn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onionhn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onionprinted the way they were handed over. no labels, no numbering, nothing here says which one to try first. this feed never opens them, so it has no status light, no percentage and no date of checking to give you.
what a signature is
A block of text attached to a message, produced with a private key. Anyone holding the matching public key can check it.
If the check passes, the message came from whoever holds that private key and has not been altered by a single character since.
The mechanism is in pgp, the short version, and this post is about using it rather than understanding it.
why it matters here specifically
Because a signed statement is the only way an operator can say something publicly that cannot be forged by whoever else is publishing pages about them.
Announcements, address changes, anything that people would want to fake. A signature is what separates a real statement from an imitation of one.
Nothing else available to a reader comes close. Not layout, not tone, not a page ranking well.
the weak link, which is the whole problem
A signature check tells you the message matches a key. It says nothing about whether that key was ever the right key.
If you take both the message and the key from the same page, you have verified that the page is internally consistent. That is not verification, it is a circle.
The key has to come from somewhere else, and preferably from somewhere you had it before any of this started.
so the useful habit
Get the key first, at a calm moment, from wherever you consider most reliable. Keep it. Then you have something to check against later, when it matters and you are not calm.
A key you fetched during an emergency, from a page you found during that same emergency, is doing no work at all.
this feed publishes no signed statements
Because it has nothing to sign. It is not the market and it holds no key belonging to it, so a signature here would prove only that this site signed something.
Any page claiming to publish a signed statement on the market's behalf is worth reading very carefully, starting with where it says the key came from.
what to do with a failed check
Treat it as a hard no, not as a probably fine. Signatures fail for boring reasons like copied whitespace, and they also fail for the interesting reason.
You cannot tell which from the outside, so the safe reading of a failed check is the pessimistic one.
The cost of being wrong in each direction is wildly uneven. Wrongly rejecting a genuine message costs you an inconvenience. Wrongly accepting a forged one costs whatever the message persuaded you to do.
With that asymmetry, treating every failure as a no is not caution, it is arithmetic.
replies
a reader askedWhere do I get the right public key?
the answerFrom somewhere you already trusted before the question came up. That is a genuinely awkward answer and it is the correct one, since a key fetched in a hurry proves nothing.
a reader askedDoes a valid signature mean an address in the message is safe?
the answerIt means the message came from the key holder unaltered. Whether that key holder is who you think is the separate question this post keeps returning to.
a reader askedIs checking a signature difficult?
the answerIt is a small amount of one time setup and then a routine operation. It is more effort than glancing at a page and considerably more use.
what this post is not Not a verification of anything on this site. This feed publishes no signed statements and holds no key belonging to WeTheNorth Market.