NM-004: Login screen address verification

1. Statement of the problem

Everything visible about a web page can be reproduced. The stylesheet, the images, the wording, the layout and the captcha design are all served to whoever requests the page, which means a copy can be visually identical to the original. Judging authenticity by appearance is therefore not a check.

2. The verification

Nexus prints its onion address inside the anti-phishing image on the login screen and again in the page header. The check is to compare that printed address against the address shown by your browser. They match, or they do not.

3. Why a copy cannot pass

A clone has to be reachable at some address, and that address is what your browser displays. It can print the genuine address on the page to reassure you, but then the page contradicts the address bar. It can print its own address, in which case the mismatch is obvious. There is no arrangement in which a copy sits at its own address, displays the real one, and remains consistent with what your browser shows.

4. Required response to a failure

1. Close the tab immediately, without entering credentials and without solving the captcha
2. Do not use the browser history entry that led there, because that entry is the clone
3. Begin again from a verified address held before the attempt
4. If credentials were already entered, treat them as compromised and change them from a verified address, then change them anywhere else they were reused

5. Frequency

Every session, without exception. A check performed only on a first visit is not a control, because the situation it defends against is precisely the one where you arrive by an unfamiliar route. It costs a few seconds and it is the single highest value action in this archive.

6. Related rule

No genuine login requests a recovery phrase as part of signing in. A page that does is collecting accounts, and no further verification is required before closing it.