Two things that look the same

Pairs people confuse on Nexus Market, and the one test between them

Home ›Addresses ›Same page at two addresses, and only one is theirs

Nexus market mirrors

nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
nexusma2iegzo7atzwbrwxhcdopyri3vare2twibldnlc3txqjdeb5yd.onion
nexusabcdpvtnivv6owtqjkvd22k5x3hlpofkgjqjmgzltlde6mwe2qd.onion

Published as supplied. Nothing here is monitored, so none of this is a claim that any address opens right now.

Addresses / Pair 03 of 41

Same page at two addresses, and only one is theirs

The page in front of you is the right page. Right logo, right layout, login form in the usual spot. None of that tells you whose server drew it.

Same page, different server

A mirrorA

Another door, same building

An address the market itself publishes so that traffic is spread and one failure does not take everything down with it. Different string, same service behind it. Your account is the same account and your balance is the same balance.

A copy of the siteB

Another building, same paint

A separate machine run by somebody else, serving pages made to look like the market. Nothing you type there ever reaches the market. The resemblance is not a side effect, it is the entire product.

Duplicating how a site looks is trivial work. A page is text and images sent to your browser, and anybody who can load it can save it and serve it straight back. There is no skill in it and almost no cost. The appearance of a page therefore carries no information whatsoever about who is serving it, and looking at the page harder will not change that.

This is uncomfortable, since inspecting the page is the natural thing to do and it feels like diligence. It is not diligence. You are examining the one component of the arrangement that the other side controls completely, and they had every opportunity to make it convincing before you arrived.

Why the string is the only thing that matters

The address is different in kind from everything else on your screen. Those fifty-six characters are derived from a public key, and a service can only answer at that address if it holds the matching private key. The string is not a label somebody stuck on a server. It is a claim the server has to be able to back with mathematics, on every single connection.

That is why nobody can serve a copy from a real address. They can serve a perfect copy from a nearly identical one, which is a different problem and the reason manufactured lookalikes exist at all. What they cannot do is borrow the string itself.

Judge the address, never the page

Compare the address you are actually on, in full, against a set the market publishes. The page is not evidence. The string is the only part of the picture that cannot be copied.

  1. Take the address out of the address bar rather than reading it off the screen, since what is printed inside a page is written by the page.
  2. Hold it against a set you obtained from somewhere the market controls, not from a search result and not from a message that arrived unasked.
  3. Compare the whole string, middle included. Matching opening characters are cheap to manufacture and are what a hurried reader checks.
  4. In the set, it is a mirror. Not in the set, it is not theirs, and the page being flawless changes nothing about that.

The price of each mistake

If you treat a mirror as a copy
You close a working door and go looking for another one. Cost is a few minutes, plus whatever risk you pick up while hunting for addresses in a suspicious mood.
If you treat a copy as a mirror
You log in on a machine run by somebody else. Your credentials are theirs from that moment, any deposit address the page shows is theirs, and nothing you send is coming back.

The gap between those two is about as wide as it gets anywhere on this site. One is a wasted tab. The other hands over an account and a payment in the same session, and it does it while you feel like everything went normally, since a good copy behaves normally right up to the moment it matters.

That gap should shape the default. Refusing an address you cannot place is nearly free, so refuse freely. The costs table lines this pair up against the others, and the shape is the same each time: the cheap error is the one where you stop and check.

What to do next

If it is a mirror
Use it. Save the string whole in a place you control rather than relying on the link that brought you, and treat every mirror in the set as equally ordinary. None of them is the main one.
If it is a copy
Close it without typing anything. If you already logged in, assume those credentials are gone and change them from an address you have actually placed. Do not send anything to an address that page displayed.

Questions readers send about this pair

How can a fake site look exactly like the real one?

It can copy every byte of the page, since the page is sent to whoever asks for it. Appearance is free to duplicate. The address is not, which is why judgement has to sit there rather than on the design.

Do mirrors share my account and balance?

A genuine mirror is the same service reached by a different address, so yes. If an address asks you to register again from scratch, that is worth stopping over rather than complying with.

Is a mirror less safe than the main address?

There is no main address in any meaningful sense. A published set is a set. Treating one member as blessed and the others as second-rate is the habit that makes people accept an unfamiliar string when their favourite fails.

Every page here

AddressesGetting inMoneyOrdersPeopleWordsDown for now, or finished for goodOld address, or one built to be misreadSame page at two addresses, and only one is theirsThe redirect and the string it stands in forYour path through Tor, or the far endDid the set move, or did your copy slipLoading proves a server answered, and nothing moreRate limiting against a password that no longer matchesWhen the puzzle is broken and when the reader isA door you shut yourself against a lock somebody changedLogged out by a clock against logged out by a decisionA code that does not match against a clock that does notAn absence against a single character out of placeA wait somebody planned against a wait nobody didA deposit that is slow, or a deposit that is goneThe address expired, or it was never issued to youA rule about release, or a decision about youWho took the difference, the operator or the networkA saving on quantity, or a saving on protectionMoney back, or the end of the argumentStill moving, or already refusedStill settling, or short by a fractionA date with something behind it, and a date withoutOne request moves a clock, the other moves the moneyAsking for a ruling, or handing over informationA word in a database, and an event in a recordNothing new to report is not the same as bad newsA rule that runs by itself, and a date somebody prefersSilence and being ignored look identicalQuiet is not the same as goneFeedback tells you a mood, evidence tells you a factWhat a signature actually provesThe market only speaks in one placeAn empty history and a claimed historyThe result is good. Whose key was it?The same clean result, months apartYou cannot check an image, however clear it isOne of these strings was chosen by somebodyPosted where, and written by whomWho granted it, and what were they promisingTwo lists of addresses, two different guaranteesHow to read a pairEvery pairThe testsThe costsMirrorsQuestions