C4 // Laptop to a phone

The market opens on a phone. The one check that protects you does not survive the trip, and that is not a matter of taste.

Awazon Market // onion addresses

The three strings below open the same market. The same account, the same balance, the same open orders sit behind each one. Copy a string, paste it into Tor Browser, and read the last six characters in the address bar before you type a password.

awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

NOTHING HERE IS RANKED. THE ORDER IS THE ORDER THEY WERE WRITTEN IN.

Baseline

Tor Browser on a laptop, full address bar visible, fifty six characters readable at a glance.

Substitution

Tor Browser for Android, or Onion Browser on iOS, on the phone you carry.

What moves

Convenience upwards. Nothing else moves in your favour.

Does not move

The market, your account, your balance, the addresses. The session is the same session.

Cost

A truncated address bar, a device that is rarely encrypted the way a laptop is, a clipboard several apps can read, notifications on a lock screen, and a machine that goes everywhere with you.

Verdict

Costs more than it moves. Read on a phone if you must. Do not sign in or send anything from one.

IThe address bar is the whole argument

A mobile browser shows perhaps a dozen characters of a fifty six character onion. It truncates the middle, which is precisely where a clone changes things, because the beginning is bought with a vanity generator and matched exactly. The check described in record A2 requires you to see the last six characters and compare them to what you copied. On a phone that means tapping into the bar, scrolling a tiny field, and reading a string in a font sized for a thumb.

Nobody does this reliably. The check is not hard because of the phone, it is skipped because of the phone, and a check that gets skipped provides nothing.

IIThe device around the browser

The clipboard is shared, and on some releases readable by whatever is running in the foreground. Copying an onion address puts it somewhere with a wider audience than on a laptop.
Notifications render on a locked screen by default, which means message previews from the market can appear to anybody holding the handset.
The device travels. A laptop that stays in one room has a threat model. A phone that goes to work, to a bar and through an airport does not have one.
Encryption exists but the passcode protecting it is usually four to six digits, chosen for speed at a checkout.

IIIThe reasonable middle

Reading is not signing in. Checking whether an address resolves at all, or reading a market announcement, costs you nothing on a phone because there is no password and no transfer involved. Draw the line at the login form: if the next action would be typing a password or authorising a send, that action belongs on a machine where you can read the address.

IViOS in particular

There is no Tor Browser for iOS. Onion Browser is a separate project working inside the constraints Apple imposes on browser engines, which means the fingerprint work of the desktop release is not reproduced. It reaches the market and it is honest about being a compromise.

THE LINE

Reading on a phone is fine. Authenticating on a phone means running the session without the only check that catches a clone.