A nexus market login stored in a password manager

A nexus market login stored in a password manager sits inside an encrypted vault with a url field beside the credentials. The manager fills only on a matching address, and never checks the target against anything.

What it is

A nexus market login stored in a password manager is a saved entry that keeps the reader's account name, the password and, for many managers, a url field that the manager treats as the address the credentials apply to. The reader opens the vault, finds the entry, and either lets the manager fill the browser or copies the url field into the tor browser address bar by hand.

A password manager is the carrier a reader thinks of last for an onion address, and it is one of the safer ones. The vault is encrypted, the entry can be updated when a mirror rotates, and the manager fills fields on the exact page the entry says it applies to, not on any page that looks similar. The path only works as well as the reader's discipline about keeping the entry current.

What the manager preserves in the entry

Login

The account name the reader signs in with. Not related to the mirror string, but the field the entry is looked up by in most vaults.

Password

The password itself, held in the encrypted vault. The manager never sends it anywhere unless it is filling on a matching url.

Url

The address the manager treats as the target for this entry. On a manager that supports onion strings, this field can hold the mirror. On one that does not, the field is empty or holds a placeholder.

Notes

A free text field that most managers offer. The reader can hold a comment about which of the mirrors the entry was last known to work with, or a fingerprint for a signed list.

What can go wrong

• The manager's autofill matches the entry on a domain that looks like the target but is not, either because the entry is set to match loosely or because the matching logic is not strict about onion strings.
• The vault is out of sync between the reader's devices. One device has the current mirror, the other still has the previous one, and the reader uses whichever device is nearest.
• The entry has drifted. The reader saved the entry on a first mirror, the mirror moved, and the entry was never updated. The manager fills happily against a stale target.
• The vault backup contains an older copy of the entry. A restore from backup overwrites the current entry with the old string, and the reader is back on an address that had been retired.

Lifeline

What the path keeps, what it drops

The path keeps the exact url the entry was saved with, whether that is the string the reader wanted or a lookalike from an early sign in. The manager does not check the target against a source, and it never will. The check is on the reader, once, at the moment the entry is created, and any time the reader chooses to look at the url field afterwards.

The path drops the reason the entry is trusted. A manager holds the url and the password. It does not hold the note the reader read at signup that said which of the mirrors was the current one. That note has to live in the free text field on the entry or be repeated somewhere the reader will look.

What to check when using the entry

• The url field on the entry matches the onion string the reader would use if they were finding a mirror from scratch today. A quick side by side reads faster than a manual paste.
• The manager only fills after the tor browser is on the exact address in the url field, not on any address that opens under a similar domain.
• The vault has synced across the reader's devices since the last update. A stale device is a stale entry.
• The notes field on the entry is current. If the notes say which mirror the entry was last known to work with, the reader has a check they can perform against the addresses panel on this site.

Engagement

Discover more