A fingerprint
Everything in the signatures room depends on this one string, and it is the only artifact in the collection that you have to go and collect for yourself before it is worth anything.
- What it is
- A short hash of a public key, comparable by eye
- Where you meet it
- Market pages, forum posts, other directories, your own notes
- What it settles
- Which key you are agreeing to trust from now on
- Cannot tell you
- Whether the key belongs to who you think, on its own
The specimen
4A2F 91C7 0E5B 66D8 3F1A 9C40 77BE 2D15 A8E3 04FB
uid Torzon Market <…>
the middle line is the fingerprint. the rest is decoration
A key listing, with the part that matters marked. The fingerprint here is made up for this page, because printing a real one would invite people to trust a string they found on a site they know nothing about. Yours has to come from several places you gathered yourself.
Why you cannot take it from one page
A fingerprint taken from the same page you are about to check is worthless, because a forger controls both. That much is obvious once said. The less obvious version is that three pages run by the same person also count as one source, and so do three pages that all copied a fourth.
What you want is a set of places that would have to be compromised separately for all of them to agree on a wrong value. Different operators, different hosting, ideally different years.
| Source | Worth anything? |
|---|---|
| The page you are verifying | No. It is vouching for itself |
| Three directories that all copied each other | No. That is one source wearing three hats |
| A forum post from years ago plus a current market page plus an unrelated index | Yes. Those would have to be attacked separately |
| A screenshot somebody posted | Weak on its own, useful as one more agreeing voice |
Pinning it
- Collect the value from several independent places and compare them in full, not by the first and last groups.
- Write it down outside the browser. A file you control or paper. Not a bookmark, not a screenshot in a photo library that syncs.
- Note the date you pinned it. Then a future change is a change, rather than a vague feeling that it looks different.
- Do the whole thing once. About an hour, and it never needs repeating unless the key genuinely changes.
The key file is disposable
People guard the public key file and lose the fingerprint, which is backwards. The key file can be fetched from anywhere at any time, because a wrong one is caught the moment you compare its fingerprint. The fingerprint is the thing you actually hold, and it is forty characters you could write on a card.