Nexus Link Desk Provenance, not popularity
Link Desk / Checking one

Current Nexus addresses

Three nodes, one platform behind them. Copy, never retype, and verify the signature when you arrive.

Node 01 nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
Node 02 nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
Node 03 nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

An address that loads is not an address that is genuine. The check that settles it takes under a minute.

Pinning a key

The step everybody skips, and the one every other protection on this site rests on. It is careful work, it takes about half an hour, and you do it once.

Why the fingerprint and not the key

A key is a large blob you cannot meaningfully inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable.

That inverts the usual instinct, which is to carefully save the key file somewhere safe. The file needs no protection at all. It is public, and you can fetch it from anywhere including somewhere hostile, then check it against the fingerprint you hold. The fingerprint is the only thing that has to be right.

The circularity to avoidA signature verified against a key taken from the page being verified establishes nothing. The page and the key and the signature all came from the same party, and internal consistency is free.

Establishing it

  1. Collect the fingerprint from several places. Independent means they would have to be compromised separately, so three pages run by the same operator count as one source, and three sites that all copied a fourth count as one as well.
  2. Compare them in full. Character by character, the whole string. Not the first four and last four, which is the check a forger designs around.
  3. If they agree, write it down somewhere you control and will find again. Paper is genuinely good here, because it cannot be edited by anything running on your machine.
  4. If they disagree, stop. At least one source is wrong or compromised and you cannot tell which from where you are standing. This is a reason to wait, not to pick the majority.

What counts as independent

Genuinely independentSources with different operators, different infrastructure, and no history of copying each other. Rare in this space and worth seeking out.
Not independentA network of sites run by one person. Very common, and usually not disclosed.
Not independentSeveral sites that all took the value from the same upstream page, which is the default situation.
Weakly independentThe same value appearing across a long stretch of time in archived captures. Not proof, and better than nothing.

That last row is worth using. A fingerprint that appears identically in captures from two years ago and today has at least persisted, and persistence is harder to fake retroactively than a page is to edit now.

After it is done

Nothing. That is the point. Every later verification is mechanical and takes under a minute, and you never repeat this step unless the key genuinely changes, which is rare and which should be treated with more suspicion than usual rather than less.

The reason this step gets skipped is that it produces nothing visible. There is no payoff at the moment you do it, no page loads differently, nothing confirms you did it right. The payoff arrives later, on an evening when something looks completely normal and is not.