nexuscheckVerification checklists for Nexus Market, with pass criteria
18 checks across 5 moments
3 verified addresses
Overview Full checklist First time setup Every session Before funding On delivery Periodic review Addresses FAQ Scope

Checks > First time setup > C-02

C-02: Security level set to Safest

IdentifierC-02
Weighthigh
AppliedFirst time setup (M1), Once, before you ever sign in
StatementThe Tor Browser security level is set to Safest and has not been lowered for any site.
Grading criteria
PASSShield control reads Safest and no exceptions have been added.
PARTIALSet to Safer rather than Safest.
FAILLeft at Standard, or lowered to make a site work.
COSTScripting stays enabled, which is the surface most browser attacks need. The market works fine without it, so the setting costs you nothing to keep.

What the setting does

Safest disables scripting across every site, along with several media formats and font handling paths that have been sources of problems in the past. It is not a privacy setting in the sense of hiding you better. It removes capability from pages, and capability is what an attack needs.

The trade, honestly

Some sites break at Safest. Nexus is not one of them, which means for this purpose there is no trade at all. You are not giving up functionality you need in exchange for protection you might not use.

A site that demands otherwise

If a page insists you lower the level before it will function, that is information about the page rather than about your configuration. A market that works for everyone else at Safest and not for you is worth a second look at the address you reached it through.

What not to do

  • Do not add per site exceptions, since the exception list becomes invisible over time
  • Do not lower the level to make pages load faster, which it does not do
  • Do not install extensions to compensate for anything the level blocks

Verification

Open the shield control and read it. That is the whole check. It takes a second and it is worth doing after any browser update, since a fresh profile starts at the default.

Verified address set

Verified address set
[1]nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
[2]nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
[3]nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

Run C-07 before you type anything. Open in Tor Browser only, then compare the onion printed on the login screen against your browser address bar. A mismatch means the page is a copy and the tab should be closed.

Other checks in this group

C-01critical
Browser obtained from the Tor Project and verified
Applies: First time setup (M1)
Passes when: Downloaded from the official site and the signature was verified before first run.
The Tor Browser you are using came from the Tor Project website and its signature was checked on first install.
C-03critical
Username exists nowhere else
Applies: First time setup (M1)
Passes when: Newly invented for this account and used nowhere else, ever.
The username on this account has never been used on any other site, market, forum or messaging service.
C-04high
Password generated, unique and stored locally
Applies: First time setup (M1)
Passes when: Generated, unique, stored in a local manager.
The account password was generated by a password manager, is used nowhere else, and is stored in that manager rather than remembered or written in a note.
C-05critical
Recovery phrase on paper, two factor with a key backup
Applies: First time setup (M1)
Passes when: Phrase on paper, two factor on, key backed up in a second location.
The recovery phrase is written on paper and stored away from the machine, PGP two factor is enabled, and the signing key is backed up offline.