NM-002: Onion addressing and the verified address set

1. Address structure

A version three onion address is fifty six characters followed by the .onion suffix. Those characters are derived from a public key rather than chosen, which is why they look like noise and why they cannot be shortened, guessed or corrected from memory. Two addresses differing by one character are unrelated services with no connection to each other.

2. Why several addresses exist

Nexus publishes more than one address and keeps them live simultaneously. A hidden service absorbs sustained traffic floods, and a service reachable at a single address stops being reachable at all when that address is targeted. Several addresses means an attacker has to hold all of them at once to produce the same effect.

The addresses are entry points to one service rather than copies of a site. The account, the balance, the order history and any open dispute are identical behind each one, so switching mid session costs nothing and loses nothing.

3. Handling rules

1. Copy addresses, never type them, because fifty six characters reproduced by hand is the single most common way somebody lands on a lookalike
2. Take them from a source you trusted before you needed one, rather than from a search performed while your usual address is quiet
3. Store them somewhere you will still have in six months, and check a stored address against a current source before use
4. Treat any address arriving through a chat message or a comment as unverified regardless of who sent it

4. The verified set

The addresses listed on this archive are the set it treats as verified. They are shown in full rather than shortened, with a copy control, on every page, because an address that has to be hunted for is an address somebody will end up searching for instead.

5. Retirement

Addresses are retired and replaced over time. A saved address that stops working is more often retired than compromised, but the two look identical from outside, which is why the rule is to check against a current source rather than to assume either.