Anubis Market Login and Registration

The login screen uses a six-tile captcha with decoy input fields whose names rotate on every page load. It is there to frustrate automated phishing kits, not to verify the address. This page is how the captcha works, how to solve it without filling the decoy fields, and how to register.

The login screen

Tile captcha

  1. Check the address before you touch the captcha

    The captcha is not the address check. The address check is holding the address in your bar against the one the login screen prints, and it happens before you enter anything. If the addresses differ, the captcha does not matter, because you are on a clone. The full method is on the verify address page.

  2. Solve the tiles in the visible field only

    The login screen shows a six-tile captcha. Solve the tiles in the visible input field. Do not fill the decoy fields, which are there to catch scripts that fill every input on the page. The decoy field names rotate on every page load, so a script that cached the field names from a previous load is already wrong.

  3. Enter your credentials

    Once the captcha is solved, enter your username and password. If you use PGP two-factor, the login presents a challenge encrypted with your public key. You decrypt the challenge offline, paste the plaintext back, and the session opens. A leaked password without your private key gets the attacker exactly nowhere.

  4. Enable PGP two-factor as the first thing after registration

    After you register, paste your public key into account settings. Every subsequent login then presents a challenge encrypted with that key. Without PGP two-factor, the account is exposed to anyone who phishes a credential, so treat enabling it as the very first thing after registration, not an afterthought.

Registration, done carefully

A fresh username you have not used on any other market, a unique password, and the recovery phrase written on paper. No login ever asks for the recovery phrase, so if a screen asks for it, that screen is not the market. The recovery phrase restores an account you have locked out of, and it is not recoverable if you lose it. The detail is on the account recovery page.

The payment PIN is non-recoverable

Separate from the password, the market uses a user-set PIN that authorizes payments and withdrawals. That PIN cannot be reset or recovered. A lost password can be recovered with the recovery phrase. A lost PIN is not something the market can replace, which is why the PIN eliminates a common account-takeover path at the cost of permanent lockout if you forget it.

Why the decoy fields rotate

The decoy input fields have names that change on every page load. A phishing kit that cached the field names from a previous load is filling the wrong fields, and the market can tell the difference between a human who solved the visible captcha and a script that filled every input. The rotation is the part that makes the decoy fields work, and it is the reason a cached form does not survive a reload.

Related

The order of operations

Check the address first, then solve the captcha, then enter credentials. The captcha is not the address check. Doing them in the wrong order is how a clone gets a password it would not have gotten otherwise.