How to Verify a Nexus Market Mirror

Verification is the answer to the question "is this address the market's?". The short answer is to compare it against a list you trust. The full answer is to understand what the list is, and why the comparison works, and this is the path, from the deepest check to the everyday one.

The signed announcement

The market publishes its mirrors in a signed post. The signature is made with a key that the market controls, and it means that the list was produced by the market and has not been edited since. The signature is the proof, and the list is the content. A directory that follows the signed announcement is publishing the market's own words, and a directory that does not is publishing its own.

The practical use of the signature is to check the list, not to read it. If you have the market's public key, you can verify that a list was signed by it, and that it has not changed. If you do not have the key, the check is the comparison against a directory you have used before, which is the everyday version of the same idea.

The everyday check

The everyday check is the one that happens at every login. Copy the address from a list you trust, paste it into the browser, wait for the page, and read the address in the bar from the end backwards. The backwards read is the habit, because the eye skips differences at the start of a string and catches them at the end. The check takes five seconds, and it is the one that stops the clone.

What the check proves

The check proves that the address you loaded is the address you copied. It does not prove that the address is the market's, because the proof of that is the list you copied from, and the trust you have in that list. The two steps are separate, and the failure is usually in the second one, in the list, not in the comparison. A directory that is wrong is wrong for everyone who trusts it, and the trust is the part that has to be earned, by a history of being right, and by honesty about being a directory.

The mirror list is the current addresses, and the phishing guide covers the clones that the check is for.