Traps / Dossier 02 of 57
Letter o against zero in a nexus market onion
Two round marks with different jobs
Nexus market mirrors, as published on this site
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onionnexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onionPublished as supplied. This site does not probe an onion, so nothing here is a claim that a given address opens for you right now.
This is the dossier for the nexus market onion trap where the letter o and the digit zero swap places in a note, a screenshot or a paste, and the reader who trusts the source opens something else.
What it is
The alphabet of a v3 onion address is fixed. The visible run before the .onion label is drawn from the lowercase letters a to z and the digits 2 to 7. The digit zero is not on that list. The digit one is not on that list either. Any zero in an onion string is a certain sign that the string is not a valid v3 onion, and any lowercase o in the same position of a paste is a certain sign that the string has drifted from its source.
The confusion is a screen problem before it is a keyboard problem. On many fonts the round shape of a lowercase o and the round shape of a zero are close enough that the eye does not stop to check which one it is looking at. A reader who copies down an address from a screenshot or a slide chooses one of the two shapes without meaning to, and the wrong shape carries into the paste.
Where the shape comes from
A print out of an onion on a page that uses a font with a narrow zero is one origin. A support message where the sender typed the address on a mobile keyboard that autocorrected round shapes toward the digit is another. A password manager note where the reader has kept the address next to a password of numbers and letters is a third, because the eye habituates to digits in the neighbouring field and reads the letter as a digit.
A paste from an OCR pass on a printed page is a fourth origin. Optical character recognition often prefers the digit over the letter in a run of otherwise mixed alphanumeric characters, and a nexus market onion string looks mixed to an OCR pass even though it is not.
Lifeline
- A round shape on a small screen
- The wrong letter or wrong digit in a paste
- Caught by the alphabet rule
How to catch it
The check for this trap is a rule about the alphabet. If a copy of a nexus market onion contains a zero, the copy is wrong. If a copy contains a one, the copy is wrong. Both digits are outside the v3 alphabet. A reader with the copy in hand can scan across the string for either shape and stop the paste before the paste happens. The rule is a hard rule, not a probability.
- On a screenshot
- Zoom until the round shape is large enough to see the slot inside it. A slitted or narrow zero shows as a slit at the top of a large view. A lowercase o does not.
- On paper
- The digit zero is often slightly taller than the lowercase o on the same line. Compare the height with the letters on either side.
- In a password manager
- Copy the address into a plain text field with a monospace font, then look for either shape at a glance. Password fonts often obscure the difference on purpose.
What this card does not claim
- It does not print a wrong nexus market onion in full. The card describes only the shape of the confusion.
- It does not say which OCR engines produce this trap most often. Any general purpose engine can.
- It does not say the digits two through seven are safer than the letters. Any character in the alphabet can carry a typo.
Why the rule reads clean
The rule reads clean because the alphabet of a v3 onion is small. Twenty six letters, six digits, one label. A reader who has held the rule once can apply it on any nexus market onion address on any page, without a lookup and without a probe. The rule is the same for every string on the panel above.
The digit one and the letter l
The digit one shares the same problem in a shifted key. It is not in the v3 alphabet either, and it sits close in shape to the lowercase letter l. A paste of a nexus market onion that contains a one has a one where a lowercase l was meant to sit, and the rule catches it in the same way. The two rules, no zero and no one, together cover both round and upright shapes the digit alphabet can steal from the letter alphabet.
A reader with the two rules held together can walk any nexus market onion top to tail once and stop on either character. The rules do not tell the reader which letter was meant. They tell the reader the paste is wrong. That is enough to keep the wrong paste out of the address bar, which is what the trap needed to fire.
The panel above and the alphabet
Every character on every nexus market onion on the panel above sits inside the small alphabet the format allows. A reader who wants to see the alphabet at work can scan the strings on the panel from left to right and find only lowercase letters and digits from two to seven. No zero, no one, no uppercase. The panel above is a demonstration of the rule, in three lines.
A reader who has done the scan once trusts the panel a little more, because the panel has passed the alphabet rule under their own eye. Trust here is a quiet thing. It is not a claim about uptime. It is a claim about the string being at least in the shape of a valid v3 onion. The rest, the reader can carry away for their own check on the tor network.