WTN Claim Register What people say about We The North, checked one claim at a time
Register › Reference

We The North addresses

Three published addresses for the same platform. Copy rather than retype, and verify the signature once you are through.

Address 1 hn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onion
Address 2 hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onion
Address 3 hn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onion

This site publishes the list and does not monitor it. An address that opens is not an address that is genuine, and the check that settles it takes under a minute.

Verifying

Fourteen claims in this register end here. The setup is careful work done once, and every check afterwards is mechanical.

The fingerprint comes first

A key is a large blob you cannot inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable, which reverses the usual instinct.

The key file needs no protection at all. It is public and can be fetched from anywhere including somewhere hostile, then checked against the fingerprint you hold. Only the fingerprint has to be right.

The circularity to avoidA signature checked against a key taken from the page you are checking proves nothing. The page, the key and the signature all came from one party, and internal consistency is free for a forger.

Establishing it, once

  1. Collect it from several places. Independent means they would have to be compromised separately. Three pages by one operator count as one source, and three sites that copied a fourth also count as one.
  2. Compare in full. The whole string, character by character, not the first four and last four.
  3. Write it down somewhere you control. Paper works well because it cannot be edited by anything running on your machine.
  4. If sources disagree, stop and wait. At least one is wrong and you cannot tell which. This is not a majority vote.

The check, every time

  1. Find the signed block. It starts and ends with the armour lines. No signed block means you are finished and the answer is no.
  2. Copy the whole thing, nothing trimmed, no whitespace altered, no quotation marks converted. A partial copy fails in a way that looks identical to tampering.
  3. Verify against your pinned key. Not one the page offers, not one you fetched because verification complained.
  4. Read the output. Both the key ID and the date inside the signed text.

The four outcomes

ResultMeaningDo
BAD signatureText altered or signature fabricatedLeave. No judgement needed.
No public keySigned by a key you do not holdImport the right key after checking its fingerprint, never one the page hands you.
GOOD, unexpected keyMaths works against a key that is not yoursLeave. The word GOOD appears, which is why this catches people.
GOOD, old dateVerifies, statement is months oldTreat as unconfirmed. Signatures never expire, so genuine old ones get replayed.
The habitThe last two rows are what catch experienced users, and one habit defeats both. Read which key signed and when, rather than pattern matching on the word GOOD. Two seconds.

What it cannot tell you

That the signer is honest, that your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and nothing else available answers it at all. That narrowness is exactly why it is worth doing and why it is not a substitute for the rest.