Security

The captcha is six characters of text, case sensitive, sitting beside a couple of decoy input fields. Bots fill a honeypot and the real login is never reached. Field names rotate every page load. Mirror updates are posted with a PGP signature, which is one of the checks that qualifies a market for this directory at all.

The familiar interface is not a reason to relax the address discipline. The one rule that never bends applies here exactly as it does on the most spartan entry: verify the door before you knock. Cross-reference the security topic for the full phishing pattern.