Reading an address
The cheapest improvement anyone can make to their habits, and it takes about five seconds longer than what most people currently do.
What people actually do
Shown a fifty six character string, almost everyone reads the first four or five characters, glances at the end, and accepts it. This is not laziness, it is how reading works. Long strings of unpredictable characters are processed by sampling, and the samples people take are the ends because those are the boundaries.
Forgery is designed around that behaviour. Matching a recognisable opening is cheap, matching the middle is not worth the compute, and matching the whole string is impossible. So the differing characters are placed exactly where sampling does not reach.
Better than reading it
- Do not compare by eye at all. Paste both strings into something that will tell you whether they match exactly. Human comparison of random characters is unreliable no matter how carefully you do it.
- Copy, never retype. Every manual transcription is a chance to introduce an error that will look like an attack when it fails.
- Copy from a current roster, not from a saved note, a message, or memory.
- Then verify at the destination, which establishes what no amount of string comparison can.
Things that are not the problem
| Confusable characters | Base32 as used here excludes visually ambiguous pairs by design. An address that looks slightly off genuinely is off. This is never a font issue. |
| Case | Onion addresses are case insensitive. Seeing one in mixed case somewhere is a formatting choice, not a different address. |
| The .onion suffix | Always the same and carries no information. Anything with a different suffix, appended to look similar, is not an onion address at all. |
| Length | Always fifty six characters before the suffix. A shorter one is from a retired protocol version and has not resolved for years. |
That last row is worth knowing because a short address is an immediate and certain answer. Sixteen characters means a v2 address, which stopped working across the whole network some time ago. Anything publishing one has not been maintained in years, whatever its timestamp claims.
What the string can never tell you
Who runs it, where it is, or whether it is safe. Identifiers carry no reputation and there is no property of the characters that distinguishes a market from a clone of it. Two addresses that look equally random may be either.
This is where habits from clearnet mislead. A domain name carries a hint about who registered it and a certificate carries slightly more. An onion address carries exactly one claim, that whoever answers holds the key, and reading it carefully only protects you from arriving at the wrong string. The signature is what tells you about the party at the other end.