nexus-approach.shop

Front › The operator approach › The operator approach: what a request tells the market

The operator approach: what a request tells the market

When I open one of the three addresses at the top of this article, a request arrives on the operator's side. What can they read off it, and what can they not.

Operator approach 4 min read why no author line

The three addresses

Nexus Market publishes these three onion addresses. Present as supplied, in no order, with no ranking. This site does not probe them and shows no uptime figure.

nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

The shape of a request arriving on the market

A request to the onion arrives from a Tor circuit. The market sees an HTTP request, with headers, a method, a path, a body if there is one. What it does not see is where the request came from at the network layer, because Tor removes that.

The absence of a source address at the network layer is the whole point of Tor for the reader. The operator does not know where the request came from geographically or in terms of any IP address.

This is what I imagine the operator sees. I do not know what they see specifically because I am not the operator. But this is what a reasonable operator of any Tor site would see.

What the headers plausibly carry

Tor Browser standardises headers, on purpose. User agent, language, screen sizes, all the small things that would otherwise identify a browser are made uniform across Tor Browser installs. That is not perfect, but it is a lot.

From the operator's side, a header from my Tor Browser looks like a header from every other Tor Browser. That means they cannot tell me apart from anybody else who is running the same version of the browser.

What the account layer adds, if I sign in

If I sign in, the account exists and the operator knows the account is being used. The account has whatever history it has. The visit is now tied to the account for whatever the operator logs about the account.

The account tie is independent of the browser and network anonymity. Tor still hides where I am; the account still tells the operator which account is looking.

A read only visit avoids adding the account layer at all. That is why a read only visit is a smaller visit from the operator's side.

What the operator likely does not see

My real name. My city. My internet service provider. Whether I am on a phone or a laptop, precisely. Whether I am on my own network or a cafe network. Whether I am the same person who signed in last week from a different circuit, unless the account ties us.

A lot. The absence is real. What is left is what the account layer adds and what patterns emerge from repeated visits.

What repeated visits let them notice

They can notice that an account signs in at similar times of day. They can notice that an account tends to look at similar sections. They can notice that an account's behaviour is different from the average visitor's.

None of that identifies me. It builds a profile of the account. The profile is the account's to defend against, and the way to defend against it is not to have the account do the same thing every day.

The routine article about consistency covers the reader side of this. The operator side is that a well behaved reader from the operator's perspective is a slightly less predictable one.

What the operator would not learn from a captcha

The captcha protects the operator from automated traffic. It does not identify the reader. Completing a captcha proves that a human was in front of the screen. It does not prove which human.

From the reader side the captcha is a small inconvenience. From the operator side it is a filter. From either side it is not an identifier.

A short list of what the operator sees vs does not

  • Sees: that a Tor request came in, at what time, to what path.
  • Sees: if signed in, which account is doing what.
  • Does not see: where the reader physically is.
  • Does not see: which real person is behind the reader.

Why an operator side article helps the reader

Because I approach the market more sensibly when I have a plain sense of what my visits look like from the other side. If I know the operator does not see my city, I do not need to invent extra layers of obscuring the city. If I know they can see the account, I take the account seriously as the thing that carries the visit.

The operator side is not scary. It is a set of things worth knowing. Knowing them lets me spend my attention on the things that matter and not on the things that do not.

The opposite approach

The routine approach on a normal evening, the same visit from my chair only

What this article is not. This is not a claim to speak for the operator. It is an outside description of what a Tor request plausibly looks like from the receiving end.

Read another in this approach

The operator approach: what a mirror does and does not shareThree mirrors are three doors into the same house. From the operator side they are shared; from the reader side they are equivalent. The operator approach: what the inbox tells themThe inbox is the market. Anything I send through it lives with them, not with me. The operator approach: what I cannot know and choose not to guessSome things about the operator I cannot know. Guessing about them is worse than admitting I do not.
Every page on this site
All approaches on this siteHow to read this siteThe words people searchThe three nexus market addressesWhat this site is notThe first-time approachThe cautious approachThe impatient approachThe rebuild approachThe verify approachThe routine approachThe secondary approachThe helper approachThe journalistic approachThe operator approachThe first-time approach when a friend sent me a noteThe first-time approach out of a forum threadThe first-time approach starting on a search pageThe first-time approach after reading a news articleThe first-time approach after hearing it on a podcastThe cautious approach before I touch the keyboardThe cautious approach when the network is not mineThe cautious approach with a second machineThe cautious approach to what I copy and what I typeThe cautious approach that never signs inThe impatient approach that goes straight to the address barThe impatient approach from a tab I already had openThe impatient approach inside a five minute windowThe impatient approach when a mirror is slowThe impatient approach that skips the second checkThe rebuild approach after losing the phoneThe rebuild approach after losing every noteThe rebuild approach after losing the passwordThe rebuild approach after a clean installThe rebuild approach when one mirror has gone quietThe verify approach with two lists side by sideThe verify approach for a friends messageThe verify approach against this site aloneThe verify approach that reads the string itselfThe verify approach across two visitsThe routine approach on a normal eveningThe routine approach with one eye on a newer mirrorThe routine approach when nothing has changedThe routine approach that reads the front page firstThe routine approach with one eye on my own consistencyThe secondary approach coming from another marketThe secondary approach that keeps two markets separateThe secondary approach during a move between marketsThe secondary approach that eventually stops being secondaryThe secondary approach that reads one market and uses anotherThe helper approach at one desk with two readersThe helper approach for questions coming through a chatThe helper approach on paper, for laterThe helper approach and the things I refuse to doThe helper approach that only points at this siteThe journalistic approach for a story I am not going to nameThe journalistic approach for a story that names peopleThe journalistic approach when I interview somebodyThe journalistic approach and what not to publishThe journalistic approach in a shared CMSThe operator approach: what a request tells the marketThe operator approach: what a slow visit looks like from thereThe operator approach: what the inbox tells themThe operator approach: what a mirror does and does not shareThe operator approach: what I cannot know and choose not to guess