Access and phishing

The login captcha on Anubis is six tiles, each a tilted character, sitting next to a decoy input field. A bot fills the wrong field and trips the trap. A human reads the tiles and solves it in about ten seconds. The form field names rotate on every page load so a script cannot cache the layout and replay it.

There is usually more than one onion live at once. When one address is being flooded the others stay reachable, and a fresh one rotates into the pool within a few hours. The instruction that follows from this is to never bookmark a single address as if it were permanent. Bookmark the signed mirror list and check it when something stops resolving.

Verify the list against the market PGP key before you trust a new address. An address that is not on the signed list does not get your password, however similar it looks to one that is.