Logging in and registering

Three things, at most: username, password, and a two-factor code if you have 2FA on. That is the whole list. If a page that looks like AWazon asks for anything more, or asks for the password a second time 'to confirm', you have found your problem.

Nothing on this page asks for your password. The market asks for it on the market, at the .onion address, in the address bar of your Tor Browser. Keep that distinction in mind; it is the one the fakes rely on you forgetting.

You register with a username, an email and a password. The email is for notifications and for recovery: order updates, and the way back in if you lose your 2FA device. Choose one you will still be able to open in two years. Turn on two-factor as soon as the account works, not later. Later is when people skip it, and a market account with money in it is not the place to skip. The security page goes through it properly.

You can browse the public pages without an account. What needs the login is the wallet, orders, feedback and anything where your name and your money are on the screen.

The login page lives inside the .onion address. It has never been on a .com domain, so a page on a normal domain that looks like the AWazon login, especially one that says 're-login to verify your account', is a collection box. It is built to look exactly like the real thing because it screens the real thing. Same for the queue page: the real one is inside the .onion. If you got the 'login' from a link in a private message, check the address bar character by character against the list above before typing anything.

One more, because it costs people accounts: the market will not ask for your password in a chat. When a counterparty in an order asks for it 'to speed things up', the order is not what is happening anymore.