Access and phishing

The captcha is six characters of text, case sensitive, with a couple of decoy input fields next to the real one. Bots fill a honeypot field and the script never reaches the real login. The field names rotate on every page load so the layout cannot be memorised by automation.

Mirror updates are posted with a PGP signature, which is one of the checks that gets a market onto a serious list in the first place. Before you trust an address, confirm it appears on the signed list. The familiar interface does not change the one rule that never bends: verify the door before you knock on it.

For a first-timer the trap to avoid is assuming that because the shop looks ordinary, the safety habits are optional. They are not. The address discipline is the same here as on the most spartan market in the atlas.