Access and phishing

Text captcha, six characters, with decoy input fields whose names rotate every page load. Bots fill the wrong field, trip a honeypot, and never reach the real login. The page header prints the onion you should be on, so you can cross-check the address bar against what the market says its own address is.

The mirror list is the star of this plate. It is deep and it is signed, and the entire point of Mars is that you rotate across it freely. When one address stalls, the correct response is not to wait, it is to open the signed list and move to the next live onion. Keep the list, not a single bookmark.

Verify the list against the market key. The redundancy only helps if every address you rotate to is one the market actually published.