The cautious approach that never signs in
The most cautious version of my approach never signs in at all. It is not the fullest version, and it is not the version I always use, but it is the version I keep in the back of my mind as the honest one.
The three addresses
Nexus Market publishes these three onion addresses. Present as supplied, in no order, with no ranking. This site does not probe them and shows no uptime figure.
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion
What is legible without an account
A surprising amount is legible on the nexus market front pages without an account at all. The captcha wall is legible. The main navigation is legible. Category headings are legible. General policy pages are legible on many mirrors most of the time. A visit that stays on those surfaces is a visit that touches nothing personal on either side.
A read only cautious approach uses this legibility deliberately. I open one of the three addresses at the top of this article, I let the captcha finish, and I read what is in front of me. When I have learned what I came for, I close the tab.
This is a very small visit and it is the version I use when I do not have a specific transaction to make.
What is not legible without an account
Vendor pages behind a login are not legible. Prices in your currency are not legible. Messages, feedback, ratings and the order interface are not legible. A read only visit gives up all of those.
The trade is real. A read only cautious approach does not let me place an order and does not let me talk to a vendor. If I need to do either of those, this is not the visit I am on.
What matters is being honest about what I am getting from a read only visit, and what I am giving up. Being honest keeps me from pretending the visit did more than it did.
What a read only visit is good for
It is good for checking that a mirror still resolves to something that looks like the market. It is good for reading policy language before I decide whether to interact. It is good for comparing the shape of the front page across two mirrors, if I want to check that both look like the same market.
It is good for a first visit, where I want to see the market before I commit to an account. It is good for a re-visit after a long absence, where I want to see whether anything has changed before I sign in with a stale password.
It is good for a friend I am walking through the site, because it lets me show what the market looks like without ever putting any of my credentials on their screen.
How I keep it read only in practice
I decide before I open the tab that this is a read only visit. That decision is what makes it read only, not the design of the browser. If I have not decided, I will drift into the login form because the login form is where the mouse ends up when I have nothing specific to do.
I do not have my password manager unlocked during a read only visit. If the manager is locked, the login form has nothing to autofill and the drift dies before it starts.
When I have read what I came to read, I close the window. I do not leave the tab open on the front page while I do something else. The window being open is the invitation to sign in that I do not want.
The captcha, in a read only visit
The captcha still runs on a read only visit. That is fine. The captcha is between the network and the front page; it is not the login. I let it finish. I do not treat completing the captcha as a commitment to anything else.
A read only cautious approach passes one captcha and stops. If the visit needs a second captcha because the first one did not stick, that is a signal to pay attention to what happened, not to plow through more captchas.
What the market sees of a read only visit
The market sees a request from a Tor circuit for the front page. It sees a captcha completed. It sees the request end. That is all it sees, because that is all I did. No account is loaded, no message is opened, no order is looked at.
This is the smallest visit the market can see me make. It is not invisible, because nothing on the internet is invisible, but it is small. Small visits are what a cautious approach is aiming for.
Why I keep the read only visit as an option
- It is the honest way to check whether one of the three addresses is what I think it is, without committing to anything.
- It is the least expensive visit I can make in terms of the amount of behaviour it produces on my end.
- It gives me a way to end the visit at the front page rather than at a page that reflects a choice.
- It gives me practice in stopping, which is the muscle a cautious approach lives or dies by.
What the read only visit is not
It is not a substitute for a signed in visit if a signed in visit is what I need. Pretending otherwise is not cautious, it is avoidant, and the two are not the same thing.
It is not proof that the address is up right now for everybody. It is proof that the address rendered a page for me, once, from where I was sitting. This site does not carry uptime figures and this article does not carry them either.
A cautious approach reads without signing in when reading is the point, and signs in when the transaction is the point. The trick is being clear which of the two the current visit is.
The routine approach on a normal evening, the same market with a normal signed-in visit
What this article is not. This is not a claim that reading without signing in gives me privacy on the market side. It is a claim that some kinds of visit are legibly smaller than others.