C-07: Login screen address matches the browser address bar

The observation this rests on

Everything visible about a page can be copied, because it is served to whoever requests it. The stylesheet, the images, the wording, the captcha design. What cannot be copied is the address the page actually lives at, because that is reported by your browser rather than by the page.

Why a copy cannot pass

A clone has to be reachable somewhere, and that somewhere is what your address bar displays. It can print the genuine address on the page to reassure you, in which case the page contradicts the bar. It can print its own, in which case the mismatch is obvious. There is no configuration where a copy sits at its own address, shows the real one, and stays consistent.

Where the address appears

Nexus prints its onion inside the anti-phishing image on the login screen and again in the page header. Both are checked against the bar. The image matters because it is harder to alter dynamically than page text.

Why partial comparison is graded down

Checking the first six characters and the last four feels thorough and is not. Prefix generation is cheap, and clone addresses are produced specifically so the opening matches. The comparison has to cover the whole string, which is why copying rather than typing matters upstream of this item.

Required action on failure

1. Close the tab without entering anything
2. Do not reuse the history entry that led there
3. Start again from a source held before the session
4. If credentials were already typed, treat them as compromised and change them from a verified address

Frequency

Every session. A check performed only on a first visit is not a control, because the case it defends against is precisely the session where you arrived by an unfamiliar route.