AWAMARKET

Home//Address//A2 One character changed

A2Awazon Market // record A2

A2 // One character in fifty six

The most important record on this site. Nothing else here changes as much for as small an input, and no technical layer anywhere prevents it.

Awazon Market // onion addresses

The three strings below open the same market. The same account, the same balance, the same open orders sit behind each one. Copy a string, paste it into Tor Browser, and read the last six characters in the address bar before you type a password.

  • awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
  • awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
  • awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

NOTHING HERE IS RANKED. THE ORDER IS THE ORDER THEY WERE WRITTEN IN.

Baseline
The exact fifty six character string copied from the top of this page.
Substitution
The same string with one character different in the middle, arriving from a forum post, a chat message, a search result or a paste that lost a character.
What moves
Everything. A different address is a different service, run by a different party, showing a login page they wrote to look like the one you expected.
Does not move
How the page looks, how fast it loads, whether your browser complains, and whether your network setup is sound. All of it works perfectly, in their favour.
Cost
The account and whatever the account can reach.
Verdict
Costs more than every other substitution on this site combined. Two seconds of reading prevents it.

IWhy the beginning of the string proves nothing

All three addresses at the top of this page begin with the same word. That is not a coincidence and it is not a security feature: it is a vanity prefix, produced by generating keys in bulk until one happens to start with the letters you wanted. Anybody can do it. The work grows steeply with each additional character, but a handful of letters is cheap and an afternoon of computing is not a barrier for somebody building a clone.

So a string starting with the market name tells you that somebody wanted it to start with the market name. It is the part a forgery is guaranteed to get right, and therefore the part that carries no information.

IIWhat the tail is

The rest of the address is derived from a public key. It cannot be steered without doing the full work of finding a key that produces those exact characters, which is not an afternoon and not a weekend. Matching the last six characters of a v3 onion is out of reach for the people running clone campaigns, which is why they do not try. They change the middle and rely on nobody looking.

Reading those six characters is the entire defence. It is short enough to do every single time and it does not become less effective through repetition.

IIIThe two second procedure

  1. 01Copy the address from this page with the button, so no character is lost by hand.
  2. 02Open it. Wait for the page to appear.
  3. 03Look at the last six characters in the address bar and the last six of what you copied. Do not compare the first six, they will always match.
  4. 04Different: close the tab. Do not type a username, a password, or anything else. A clone learns from every keystroke it receives.

IVWhere the wrong strings come from

VWhat no other layer does

Tails, Whonix, a bridge, a VPN, Safer mode and a fresh Linux install all treat a clone as an ordinary destination and deliver your keystrokes there correctly. This is stated on the constants page as well, because it is the single most misunderstood point in this subject: hardening the machine does not inspect the address.

IF YOU READ ONE THING

Every Awazon address starts the same way on purpose. The last six characters are the only part a forgery cannot reproduce. Read them before the password, every time.