Verified address set

Handling rules

1. Copy addresses rather than typing them. Fifty six characters reproduced by hand is the most common way somebody reaches a lookalike.
2. Take them from a source held before you needed one, not from a search performed while your usual address is quiet.
3. Check any stored address against a current source before use, since addresses are retired and replaced over time.
4. Treat an address arriving in a message or a comment as unverified regardless of who sent it.

The check that follows

Having a good address is half the control. The other half is confirming the page you land on is the service rather than a copy, which is done by comparing the onion printed on the login screen against your browser address bar. The reasoning is set out in NM-004 and the reason it cannot be defeated is that a copy has to live at its own address while your browser reports where you actually are.

Why the set has more than one entry

A hidden service reachable at a single address stops being reachable when that address is flooded. Several live simultaneously means an attacker has to hold all of them at once. The full description is in NM-002, and the classification of failures when one does not respond is in NM-003.