messages ยท post 02 of 7 in this channel
PGP on WTN market, the short version
The name puts people off and the idea underneath it is small. Here it is with nothing added.
the three wethenorth market addresses
hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onionhn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onionhn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onionprinted the way they were handed over. no labels, no numbering, nothing here says which one to try first. this feed never opens them, so it has no status light, no percentage and no date of checking to give you.
two keys
You have a public key, which you hand out freely, and a private key, which you never give to anyone under any circumstances.
They are a matched pair. Something scrambled with the public key can only be unscrambled with the private one.
That is the whole foundation. Everything else is consequences of those two sentences.
what encryption does
If somebody has your public key, they can write you a message that only your private key can open. It passes through the market as unreadable text.
This is why delivery details are encrypted to a vendor. The market stores something it cannot read, and only the vendor can open it.
It protects the content. It does not hide that a message was sent, or by whom, or when.
what signing does
The other direction. You use your private key to attach a signature, and anyone with your public key can check that the message came from you and was not altered.
It does not hide anything. A signed message is perfectly readable. It proves origin rather than protecting content.
That is the mechanism behind checking a signed message, which is the one genuinely useful verification available to an ordinary reader.
the one rule that matters
The private key never leaves your machine. Not to a website, not to a helpful tool, not to support, not to a vendor, not ever.
Any site offering to do PGP for you in the browser is asking for the one thing that must not move. That is the entire test and it is easy to apply.
Public key out, private key never. Six words and they cover almost everything.
why it is worth the awkwardness
Because without it, the sensitive part of your order is plain text on a server you do not control, and you are relying entirely on that server behaving.
With it, a compromise of the message store yields unreadable blocks. That is a large difference for a modest amount of one time setup.
where this post stops
At the concept. There are no commands here, no tool recommendations and no walkthrough, because a half explained key operation is worse than none.
If you are going to use it, learn it properly from a source that goes all the way through. This post exists so the word stops being frightening, not so you can skip the learning.
The learning is a couple of hours once, and then it is a tool you have. That ratio is unusually good, which is why the awkwardness is worth pushing through rather than working around.
What is not worth doing is half of it. A key you generated and never learned to use is a private key sitting on a machine for no benefit at all.
replies
a reader askedDo I need PGP to use the market?
the answerNot always. Many markets encrypt delivery details for you. Having your own key gives you signing and verification, which the market cannot do on your behalf.
a reader askedIs a browser based PGP tool acceptable?
the answerIt requires your private key in a browser, which breaks the only rule in this post. There are proper tools that run on your own machine and they are not much harder.
a reader askedSomeone asked me for my key. Which one do I send?
the answerThe public one, always, and only ever that one. If the request is specifically for the private key, the conversation is over.
what this post is not Not a PGP tutorial. There is no software named here, no command listed and no setup walked through, deliberately.