Reading announcements without getting caught
Most messages claiming to come from a market did not come from it. The forgeries are not subtle once you know what to look at, and the check that settles it takes under a minute. This chapter is the practical procedure plus the patterns worth recognising before you even run it.
#Which channels can carry a real announcement
Start here, because it eliminates most of what you will encounter without any technical work at all.
| An address on the roster | The primary channel. A notice served at a current address, signed, with a timestamp. This is where real announcements live. |
|---|---|
| A signed message reposted elsewhere | Fine, with a caveat. The signature travels with the text, so a genuine notice stays genuine wherever it is pasted. The caveat is that where you found it gives you nothing. Only the signature does. |
| An unsigned post on a forum | Worth nothing regardless of the account, its age, or its reputation. Accounts are bought, borrowed, and compromised. This is not a channel. |
| Chat groups and messaging apps | Not a channel under any circumstances. No market operates support or announcements there, and anything claiming otherwise is impersonation by definition. |
| Not a channel. Nothing legitimate arrives this way. |
#The procedure
Four steps, in this order, and the order matters because each one is cheaper than the next.
- Check it is signed at all. A clear signed block starts and ends with the PGP armour lines. If those are missing, you are done. A large share of forgeries do not bother, on the correct assumption that most people do not check.
- Copy the whole block. Everything from the opening line to the end of the signature, nothing trimmed, no whitespace mangled. Verification fails on partial copies and that failure looks identical to tampering, which causes a lot of unnecessary alarm.
- Verify against your pinned key. Not a key from the same page. Not a key you fetched today because verification complained. The key whose fingerprint you checked once and stored, as described in what a signature proves.
- Read the timestamp and the key ID in the output. Both. A GOOD signature from an unexpected key, or a correctly signed notice from nine months ago, are the two failures that survive a careless check.
If it verifies against the pinned key with a recent timestamp, it is genuine. If any step fails, it is not, and no amount of context makes it genuine. There is no middle outcome here and no judgement call to make, which is exactly what makes the check worth having.
#Tells worth recognising
Verification settles it, but the forgeries have recurring habits, and noticing them early saves you from taking the bait seriously in the first place. They are all variations on manufacturing urgency, because urgency is what stops people from verifying.
- A deadline. Migrate within 24 hours, act now, addresses retire tonight. Real rotations run long overlaps precisely so nobody has to hurry. A clock is a manipulation, not a schedule.
- A brand new address and nothing else. The entire purpose of the message is to get you to a URL. Genuine notices explain a situation. Forgeries route traffic.
- An excuse for the missing signature. Key rotated, signature stripped by the forum, posting from mobile, will sign later. Every one of these is a lie, and the sophistication of the excuse correlates with how much effort is going into the rest of the scam.
- Instructions that touch credentials. Log in to confirm, re-enter your seed to migrate, verify your account. Nothing genuine ever needs any of this. Announcements inform, they do not ask.
- Perfect timing with an outage. A helpful new address appearing while the real ones are unreachable is not a coincidence, it is the plan. See anatomy of an outage for why that window is so reliably exploited.
- Emotional register. Real operational notes are dull. They describe what happened and what changes. Anything written to make you feel something is doing a different job.
#The one that is genuinely hard
A message announcing that the signing key itself has changed. It is hard because it is self undermining. The new key cannot be verified with the old one in any way that means much, since anyone able to compromise the old key can sign a handover with it. And a genuine key rotation has to happen somehow.
The honest answer is that no single message can establish this. What can is consistency across independent places over time. A real key change shows up in more than one location, persists, and is reflected everywhere the old fingerprint appeared. A forged one appears in one place, is urgent, and wants you somewhere immediately.
So the response to a key rotation notice is to slow down rather than speed up. Nothing about a key change requires you to act inside an hour. Wait several days, look in places that would have to be compromised separately, and let consistency accumulate. Anything pressuring you to skip that wait is telling you what it is.
#What genuine notices actually look like
Underwhelming, mostly. They state what happened, what it affects, and what if anything you need to do, usually nothing. They carry a timestamp inside the signed text. They do not ask for credentials, do not set deadlines, and do not explain why they could not be signed properly. Routine incidents produce no notice at all, because an hour of one address being unreachable does not warrant one.
Once you have read a couple of real ones the forgeries become obvious on tone alone, well before you get as far as running gpg. That said, run gpg anyway. Tone is a heuristic and the signature is proof, and the whole point of having proof available is not having to rely on the heuristic. If you want the mechanics from the beginning, getting started has the commands, and the FAQ covers the questions that come up most often around them.