Awazon Market security, and where each layer stops

Two factor login

A second factor at login stops the class of problem where somebody has your password and nothing else. On a market where the account is also a wallet, that is not a nicety, and the moment worth protecting is the moment someone who has harvested credentials tries to use them.

It is worth knowing what it does not touch. A second factor is checked before you are shown your own data, not before the data is served, so it does nothing for a balance that was already drained and nothing at all for an operator who decides to stop answering. Anyone who reads the 2FA switch as a substitute for a self hosted wallet has read it backwards.

Where a market keeps the recovery path matters more than the switch. If a lost second factor resets to a password and a password resets to an inbox, the chain is only as strong as that inbox, and an inbox is a piece of consumer software with a support desk at the end of it.

PGP and the signed announcement

Pretty Good Privacy here is not encrypted messaging with the shop. It is the signature attached to the post in which an operator publishes an address, and it is the reason an announcement can be trusted a week after it is made. A post signed with the key that has been circulating since the market opened ties a new address back to the same hands, which is a claim nobody else can make about a page listing eleven mirrors.

To use it you need a PGP tool on your own machine and the operators public key. Some directories republish that key next to the listing. Several Awazon listings currently show a missing key, which is worth knowing before you decide that a signed announcement is something you can verify on the day you need it.

The order of operations matters. A forum post that nobody can verify and a mirror that asks for your password are two different objects, and the second only becomes dangerous when you reach for the first too late.

The part nobody patches

A hidden service publishes its own address, so an old address is not stolen by an attacker and is not expired by a registry. It is simply no longer pointed anywhere, and the bookmark in your bar keeps trying. Nothing on your machine can tell the difference between a retired address and a dead service.

The other permanent fact is custody. Everything you do not withdraw is a row in somebody else’s table, and the entire security design of a market changes nothing about that row. The only control that costs nothing and works on every market is the size of a balance you are willing to leave sitting still.

A short checklist, in the order it should be done

1. Turn the second factor on before the first deposit goes in.
2. Keep the key material for your own account somewhere that is not the browser you browse onion sites in.
3. Save the recovery code, on paper, at the moment the setup screen shows it. That screen rarely comes back.
4. Bookmark one address rather than a page that only lists them, and recheck the tail of it every time you use the bookmark after a long gap.
5. Withdraw what you are owed instead of accumulating it.

Questions

What is PGP used for on Awazon Market?

Signing the announcement in which an address is published, so a reader who holds the operators key can confirm the post came from the same hands as the last one. It is not the channel between you and a vendor.

Does Awazon Market support two factor login?

The market advertises two factor login as part of its account protection. Where the second factor is kept and what happens when it is lost are the two details worth reading in the account settings, in that order, before you rely on the switch.

Can I recover an account if I forget the passphrase?

Only by whatever reset path the market gives you, which normally routes through the email address on the account. If you never put a working email on an account whose email is the only door, there is no third door.

Should I keep my coins in the account?

Only for as long as an order is open. A balance inside a custodial account is a claim on somebody else’s discipline, and the escrow page is where the limits of that claim are spelled out.