After a paste loses a character in a nexus market link

A paste that loses a character in a nexus market link is a small event on the source side and a bigger one if the shorter string checksums into a real onion. The tell is the length.

What it is

A copy step from a source to the browser can drop a character in several ordinary ways. A hyphen or a punctuation mark in the source rendering that was not part of the string. A selection that started one character late. A clipboard manager that trimmed whitespace and took a real character with it. The v3 format cannot repair the loss. Either the shortened string is not 56 characters plus .onion and the browser reports no such address, or the shortened string happens to check out as another real onion and a page opens.

This card is about the case where the paste is in the address bar and the reader is deciding whether to press enter.

Lifeline

Where the character usually goes

• The first block. A selection that started one glyph late loses a character from the vanity head.
• A block break rendered as a soft hyphen. Some sources visually wrap a long run and the wrap point can be dropped on copy.
• The end of the run. A double click that stopped short of the last character before .onion.
• Between the address and the .onion label. A paste that dropped the last character of the run leaves a string that still ends in .onion and is one character short.

The small next check

Count

The run before .onion should be 56 characters. A one line count is the fastest signal that a character was lost.

Vanity head

The first characters should still spell nexus and the short readable tail. A missing character in the head is loud.

Suffix

The address should end in the four characters that spell .onion. A stray dot before or after is a signal the paste took on a character it should not have.

Nothing else

A blank, a newline or any punctuation inside the run is a signal the paste picked something up.

What to do before pressing enter

1. Do not press enter on a string that is a different length than 56 characters plus .onion.
2. Clear the address bar.
3. Return to the source and reselect the string carefully, from the first character to the last.
4. Paste again into the address bar.
5. Recount. If the length is right this time, cross the vanity head and the suffix against the panel above before pressing enter.

Why the wrong short string sometimes opens something

A v3 onion has a checksum built into the last characters of the string. Any 56 character run that satisfies the checksum is a real onion service, provided the service is running. That is a large space, and it is why a shortened string that happened to satisfy the checksum can return a page. The page is not the market. The page is a different onion that happens to have a valid string one character away from the one the reader meant to paste.

This is the same shape as the lookalike traps under the trap rubric. A paste that dropped a character is a lookalike the reader made themselves without meaning to. The catch is the same.

The safest place to paste an onion

Into a plain text field first

A paste into a plain text field in a note or a scratch buffer lets the reader count and read the string without triggering a request. The address bar sends the request as soon as enter is pressed.

With any autocomplete off

A paste into a bar that autocompletes from history can complete to the wrong string if a shortened paste matches an earlier entry by prefix.

After a look at the clipboard

Some browsers show a preview of the clipboard content on paste. A previewed paste is easier to read before it commits.

Never into a receiver field on a form

A deposit or withdrawal field is the wrong first place for a paste. The address bar is the address bar.

A small next check before enter

1. Look at the bar. Count the characters in the run before .onion.
2. Compare the length against the expected 56 character run.
3. If the length is off by one, the paste dropped or gained a character. Reset and repaste.
4. If the length is right, cross the vanity head against the panel above.
5. If the vanity head is right, cross the last block too.
6. If any of the above disagrees, close the tab and start the paste over from a trusted source.

Engagement

What this card does not say

• It does not name any clipboard manager, browser extension or paste tool.
• It does not claim any particular character shape is likelier than another to be lost.
• It does not put a date on when a specific paste pattern was first seen.
• It does not offer a script that counts characters for the reader.

Discover more