The verify approach across two visits

One check is a snapshot. Two checks a day apart are a shape. This is about the second one.

Why two visits catch things one does not

A one off substitution has to be in place at the moment I look, and only then. If I look now and again in six hours, whatever tried to substitute the address has to be in place twice, from wherever my two visits come from. That is a higher bar than being in place once.

This is not a proof against long running compromises, which by design are in place the whole time. But a lot of what goes wrong in the address space is short and transient, and two visits weeds those out.

What the two visits look like

The first visit is a normal check. I open this site, I read the three addresses at the top of any article, and I write down or remember what I saw.

The second visit is another normal check, from the same machine or a different one, later in the day or the next day. I read the addresses again. I compare to what I remember from the first.

If they match, the check has held across time. That is a small extra confidence over a single check.

How I remember the first result

The addresses are fifty six characters each. I do not memorise them by heart. I remember the first three and the last three of each, and I write them down on paper. That is enough to catch a substitution and small enough to be safe on paper.

I do not save the addresses to a note that syncs anywhere. Paper is the friend of the verify approach across two visits.

The paper goes in a drawer between the two visits.

What matching means

If the first three and last three characters of each of the three addresses match across the two visits, the addresses are the same. That is what matching means. The middle is proven by construction, because the first and last together fix the whole string.

If any of the first three or last three characters have changed between the visits, one of the visits saw a different address. That is a signal to slow way down and not act on either address today.

What causes changes to be genuine, not sinister

This site can update its address list if the market publishes new addresses or retires old ones. That is a genuine change and it is not sinister. If the change is on the site, I look at whether the change makes sense in the context of what I know about the market recently. If it does, I accept the change and my next verify is against the new baseline.

That means the verify approach across two visits is not a rigid one. It is a check, and the check is calibrated against a source that itself changes over time. Both are fine.

What I do when the visits disagree in a way I cannot explain

I do not use any of the addresses that visit. I close the browser. I come back another day and do the two visit check again from a fresh state.

If the two visits keep disagreeing across multiple days, something is wrong with my visits, not with the addresses. It is time to change my machine, my network, or my source.

This is rare. Naming it makes it survivable when it does happen.

When the two visit check is worth doing

• Before any visit that will move money.
• After a period away from the market long enough that I do not remember when I last checked.
• When the machine I usually use has been out of my sight, even briefly.
• When something else about the visit feels off, and I want to slow down without knowing exactly why.

What the check does not cost

It does not cost much time. The second visit is a two minute read of the same page.

It does not cost any extra software. It uses the same browser, the same site, and a piece of paper.

It is a proportional check. It costs a little bit and it removes a whole shape of one off failures.

What this article is not. This is not a claim that two checks catches every kind of compromise. It is a claim that a lot of the shorter kinds do not survive being asked twice.