2FA
Two-factor authentication: a second check after a password, often a one-time code or a PGP challenge.
A second factor protects an account when the password alone falls — through phishing, reuse, or a leaked database. In darknet contexts this matters more than elsewhere: there is usually no email-based reset, and a stolen market or forum account means a stolen identity and stolen funds.
Two different second factors
Not all second factors resist phishing equally. A one-time code can be relayed in real time: a clone site simply asks for the code and forwards it to the real service. A PGP challenge works differently — the server encrypts a message to the account’s public key, and only the holder of the private key can read and answer it. There is no shared secret to replay, which is why PGP-based 2FA became the norm on markets and forums.
Limits
2FA protects the login, not the session after it, and it cannot confirm that the site itself is genuine. Checking the Onion Address before entering anything remains the first defense against Phishing.
Category: Security