Mars Market addresses

Three published addresses for the same market. Copy rather than retype, and check the signature once you are through.

Address 1 marsautkudspgk6j23cxdtrk36ae4fpis2eoe7izu5y2rsksvmfji2ad.onion

Address 2 marshjhtog245vzjzcicnmv2ci6yljibvdm4pngq5kmkfvcutppboxad.onion

Address 3 marsiujka6lrsaqpnxiwvknthhzsrlmq77mnl2fi62guc4lwxif65syd.onion

This list is published, not monitored. An address that opens is not an address that is genuine, and the check that settles it takes under a minute.

Reference › Before you start

The key

The step people skip because it produces nothing visible at the time. Every other protection described here rests on it.

Why the fingerprint and not the key file

A key is a large blob you cannot meaningfully inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable.

That reverses the usual instinct, which is to save the key file carefully. The file needs no protection at all. It is public, and you can fetch it from anywhere including somewhere hostile, then check it against the fingerprint you hold. Only the fingerprint has to be right.

The circular trapA signature checked against a key taken from the page you are checking proves nothing. The page, the key and the signature all came from one party, and internal consistency costs a forger nothing.

What counts as an independent source

Source	Independent?
Different operators, different infrastructure	Yes. Rare in this space and worth seeking out.
Several sites run by one person	No. Very common, and rarely disclosed.
Several sites that copied a fourth	No. Aggregation is the default here.
The same value across archived captures over years	Weakly. Persistence is harder to fake retroactively than a page is to edit now.

Doing it

Collect the fingerprint from several genuinely independent places.
Compare in full. The whole string, character by character. Not the first four and last four, which is the check a forger designs around.
Write it down somewhere you control. Paper is genuinely good here, because nothing running on your machine can alter it.
If they disagree, stop and wait. At least one source is wrong or compromised and you cannot tell which from where you are standing.

Afterwards

Nothing. That is the point. Every check from then on is mechanical and takes under a minute, and you never repeat this unless the key genuinely changes. A message announcing that it has changed is the one case that needs care, because anyone holding the old key can sign a handover with it. Nothing about a key change requires acting within an hour, so the correct response is to wait several days and look in places that would have to be compromised separately.