Verifying onions. It’s such an important thing yet so many people don’t know how to do it properly. Always, regardless of where you get the onion from take the time to verify it. You never know when you have a typo, or a simple error. Taking the 10 seconds to verify can save your coins from falling to a phisher.
You should always manually verify the onion address yourself! Don't use a 3rd party tool.
Note: Before you can verify you are on the correct Onion make sure you understand how to verify a PGP signature.
Now that you know how to verify a signature we can verify an onion address. First we need to get a sites pgp key. Always get your keys from trusted 3rd party sources, such as pgp.fail, Dread and darknetlive.com.
Import the key like normal.
Once you have it imported put /mirrors.txt at the end of the onion you are on. It should look something like this SiteOnionAddress.onion/mirrors.txt You should see a page with some information like this on it:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Here are our onion links: jbhpox5cr6ipl7oplpsmb3rs8s2wrzr5g15mj6pr40owwh3uzlpt6gww.onion wlqx5htbtatezxb9u9qcz1ww3yo5irjyszosb6dx6hdkj6j4mic3rowy.onion s8s8vfk1uf6m2xcsgfq318xfymyu3s6goaq542idg6gbmdc1l5hapu6h.onion - SomeDarknetSite -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJYsU1SAAoJEMPzj/CHV15DkfgP/RcJw9EtFiv/+4LIV5rrgqcF +FHEZiYb5jQhsqHrR7jS69rAwxzMD/rttQxMMw4cXBDh/dQaelwOVWbcy4DUwHaj c3gFOzt/42VK40LcQlEs =ON6z -----END PGP SIGNATURE-----
If you see a message like above you can now verify the message is signed by the sites pgp key you imported. It should come back with good signature at the bottom ,and at the top you will see a list of the current site mirrors Make sure the address you are on matches one of the ones in the signed message. If it does you are on a official site onion!
Once you do this a few times it really only takes about 10 seconds to do. Always take the time to verify an onion regardless of where you get them from
