Awazon Phrasebook Every phrase, label and message you will actually see, decoded
Phrasebook /About addresses /Signed roster
About addresses

Signed roster

Awazon addresses

Three published addresses for the same market. Copy rather than retype.

awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

This list is published, not monitored. An address that opens is not an address that is genuine, and the signed roster entry explains what actually settles that.

Four of the five entries in this section are about reachability. This one is about authenticity, and it is the only thing here that answers that question at all.

What it literally says
That the list of addresses carries a signature.
What it actually means
Two things, narrowly and absolutely: that whoever produced it held a specific private key, and that the text has not changed by a single character.
What it does not mean
That the signer is honest, that your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely and no others at all.
What to do
Check it against a fingerprint you established from several independent sources and stored yourself. Read which key signed and the date inside the signed text.
If it looks different
A signature checked against a key the page handed you proves nothing. The page, the key and the signature all came from one party.
CommonShould be every time
Needs actionCheck before typing
Settles authenticityYes, alone

The four possible results

ResultMeaningWhat to do
Bad signatureText altered after signing, or fabricatedLeave. Unambiguous.
No public keySigned by a key you do not hold. A gap in your keyring.Import the right key after checking its fingerprint. Never one the page offers.
Good, unexpected keyThe maths works against a key that is not yoursLeave. The word good appears, which is why this catches people.
Good, old dateVerifies, statement is months oldTreat as unconfirmed. Signatures never expire, so old genuine ones get replayed.
The habit inside the habitThe last two rows are what catch experienced readers, and one habit defeats both. Read which key signed and when, rather than stopping at the word good. Two seconds.

Why the date sits inside the signature

A signature has no expiry. A statement signed two years ago verifies exactly as cleanly today, which makes signatures excellent for archives and awkward for anything about the present. Putting the timestamp inside the signed text fixes that, because it cannot then be adjusted without breaking the signature. Somebody replaying an old roster is stuck presenting an old date, and the only remaining question is whether you look.

The step people skip

Establishing the fingerprint. Collect it from several places that would have to be compromised separately, compare it in full rather than the ends, and write it down somewhere you control. It takes about an hour, once, and every check afterwards takes under a minute. The reason it gets skipped is that it produces nothing visible at the time.