Every protection named in this book is real and narrower than the phrase suggests. The gap between those two is where nearly everything goes wrong.
| Protection | Covers | Does not cover |
|---|---|---|
| A checked signature | Whether you are where you think you are | Whether the party is honest, whether your machine is trustworthy, anything after login |
| Escrow | The platform moving funds alone | A vendor who does not ship, your own account compromised, anything paid outside it, a balance not committed |
| A second factor | A leaked or reused password | A live copy of the login page, anything running on your machine |
| The currency | The chain hop | The exchange record, timing at the boundary, custodial services, your own device |
| A vendor record | Who to deal with | When somebody changes their mind, and accounts that changed hands |
| The published address set | Path failures being independent | Whether the party answering is genuine |
The false confidence this creates
People who check carefully sometimes become less careful about everything else, because they feel covered. That is the predictable consequence of holding one strong guarantee in a situation full of weak ones, and it is worth watching for in yourself.
A verified arrival at the genuine market still leaves you exposed to a vendor who does not ship, a balance sitting where it should not, a password reused somewhere else, and a machine you have not thought about. None of those are affected by the signature at all.
The one thing verification cannot see
Something running on your own machine substituting an address between the copy and the paste. Checking a signature establishes that the destination you reached is genuine and says nothing about what happened locally afterwards. That is why the subaddress entry tells you to check the ends, which is the only place in this book where that is the right check.
Six questions and what answers them
| Question | What answers it |
|---|---|
| Am I where I think I am? | A checked signature, and nothing else |
| Is my account safe if a password leaks? | A second factor, and credentials used nowhere else |
| Is my machine trustworthy? | How you set it up and what you install. Nothing here establishes it. |
| Will this vendor deliver? | Their record, with all its known limits |
| Is my money exposed? | Whether it is committed to an order or sitting as a balance |
| Can this be linked back to me? | What happened at the boundary, before any of this started |