Forum Advice on Onion Links: Five Ways It Fools You

Why Normal Trust Signals Break Down

Offline, you can usually tell who's talking. Someone has a face, a job, a history you can look up. On an anonymous forum, a username is free. One person can run ten of them, and an account with a long history can change hands overnight. So the usual shortcuts, like "lots of people agree" or "this account has been around for years", stop meaning what they seem to mean.

The useful question is not "how many people said this?" It's "how many of them checked it separately from each other?" One confirmation from someone who checked for themselves is worth more than fifty who repeated it.

Case 1: Everyone Points at Everyone Else

The situation

You ask where a link came from. One post says "it's listed on Site A." You go to Site A, and it says "confirmed by the folks on the forum."

Why it feels convincing

You found two sources that agree, and you even followed the trail yourself. It feels like you did your homework.

What's actually going on

Those two sources are just pointing at each other. Nobody in the loop ever checked anything against the real thing. If a scammer slips a bad link into one, the other passes it along with a clean face. The fix is to trace it back until you hit something that does not lead back to where you started, such as a signed message from the service itself. If you can't find one, treat it as unconfirmed.

Case 2: Three Accounts Vouch for It

The situation

You post a question. Within an hour, three different accounts reply saying they've used the link and it's fine.

Why it feels convincing

Three people is a crowd. Nobody makes up three witnesses just to fool a stranger.

What's actually going on

They might be one person. Or a small group, or someone paid to do it. Look at the details: were the accounts created around the same time? Do they write in the same style? Do they only ever talk about this one link? Do their answers show up suspiciously fast? Fake support is usually thin and eager. Real people tend to add small, irrelevant, oddly specific details, and they disagree with each other now and then.

Case 3: It's Pinned, So It Must Be Checked

The situation

The link sits at the top of a section, pinned, with a nice official-looking title.

Why it feels convincing

Somebody in charge put it there on purpose. Surely a moderator looked at it first.

What's actually going on

Pinning is a formatting choice. It means someone with the right button pressed it. That someone may have looked carefully, glanced at it, or just trusted a poster. Moderators can also get hacked, tricked, or replaced. A pinned post is a reason to look closer, not a reason to skip checking. It's worth asking who pinned it, when, and whether anything there is backed by a signature you can verify yourself.

Case 4: A Well-Known Account Says So

The situation

A user with years of good posts and a solid reputation recommends a link or a person.

Why it feels convincing

Years of good behavior are hard to fake, and you have no reason to doubt them.

What's actually going on

The account is not the person. Accounts get sold, stolen, or handed off. Reputation belongs to the login, and a login can be bought. Watch for a sudden change in tone, different writing habits, new topics, or a post that arrives right after a long silence. A signature is stronger here for exactly this reason: it ties a claim to a key, not to a username that anybody can pick up. There's more on that in why PGP matters on Tor.

Case 5: "Urgent, Do This Now"

The situation

A fresh post warns that the old address is compromised and everyone has to move to a new one right away, before it's too late.

Why it feels convincing

Real emergencies do happen, and nobody wants to be the person who ignored the warning.

What's actually going on

Urgency is the oldest trick there is, because it stops you from checking. A real problem will still be real in an hour, and it will usually come with proof you can verify. A fake one needs you to act before you think. If something asks you to hurry and also asks you to skip the usual checks, that combination is the warning. Slow down, look for a signed notice from the service itself, and compare it with what you already have. The PGP key and canary archive shows what a proper check looks like.

A Simple Way to Sort It Out

Whenever you read advice on a forum, ask three quick things. Where did this originally come from? Did anyone check it independently, or did they just repeat it? And would it still hold up if every username involved turned out to be fake? If the answers are "unclear", "repeated" and "no", it's an echo. That doesn't mean it's wrong. It means it's not confirmed yet.