BlackOps Adversary Register Who takes money off buyers, and what actually stops them No ads, no affiliates
Register › What stops them

BlackOps addresses

Three published addresses for the same market. Copy rather than retype, and verify the signature once you are through.

Mirror 1 blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onion
Mirror 2 blackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onion
Mirror 3 blackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onion

This site publishes the list and does not monitor it. An address that opens is not an address that is genuine, and the check that settles it takes under a minute.

Verify on arrival

The single highest value habit on this site. Everything else is either supporting it or covering what it cannot reach.

Before you start

You need a fingerprint established independently and stored somewhere you control. Without it this check is theatre, because a signature verified against a key taken from the page being checked proves nothing at all. See pinning a fingerprint, which is done once.

The procedure

  1. Find the signed block. It begins and ends with the armour lines. If there is no signed block, you are finished and the answer is no.
  2. Copy all of it. Nothing trimmed, no whitespace altered, no quotation marks converted. A partial copy fails identically to tampering, which causes a lot of unnecessary alarm.
  3. Verify against your pinned key. Not one the page offers, not one you fetched because verification complained.
  4. Read the output. Both the key identifier and the date inside the signed text. This is the step people skip and where the two dangerous outcomes live.

The four outcomes

ResultMeaningDo
BAD signatureText altered after signing, or the signature fabricatedLeave. Unambiguous, no judgement required.
No public keySigned by a key you do not hold. A gap in your keyring, not a verdict.Import the correct key after checking its fingerprint. Never one the page hands you.
GOOD, unexpected keyThe maths works against a key that is not yoursLeave. The word GOOD appears, which is why this catches people.
GOOD, old dateVerifies perfectly, statement is months oldTreat as unconfirmed. Signatures never expire, so genuine old ones get replayed.
The habit inside the habitThe last two rows are what catch experienced users, and one habit defeats both. Read which key signed and when, rather than pattern matching on the word GOOD. Two seconds.

Why the date is inside the signature

A signature has no expiry. A statement signed two years ago verifies exactly as cleanly today, which makes signatures excellent for archives and awkward for anything about the present. Putting the timestamp inside the signed text fixes it, because the date cannot then be changed without breaking the signature. An attacker replaying an old statement is stuck presenting an old date, and the only remaining question is whether you look.

What it cannot do

It says nothing about whether the signer is honest, nothing about whether your own machine is trustworthy, and nothing about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and nothing else available to you answers it at all. That narrowness is why it is worth doing and why the other five habits exist.