ten minutes of theory

Onion addresses, in plain words

You do not need to be a security person to use Awazon Market, and you do not need to be one to understand why the address is long and why the first load is slow. Both facts fall out of one idea: the market is not at an IP address, it is at a route, and the route is rebuilt every time you connect. What follows is the ten-minute version, written for the buyer, not the cryptographer.

What a .onion actually is

A regular website sits at an IP address, a number that says where the server is, and every visit reveals that number to you and your network. An onion address replaces the number with a route. The service hides behind a chain of encrypted hops, and the address is a reference to the last hop, derived from the service’s key. There is no IP to look up, no registry to check, no map to trace. The address is the location, in the same way a combination is the location of a safe deposit box, and it is long because the combination is long.

That is why the market can sit anywhere. It is also why the address cannot be shortened without losing the property that makes it useful: a shorter reference would be easier to guess, and guessable is a word you do not want attached to the door of a marketplace. The 63 characters are not ugliness. They are the lock, and the verify page is how you check that you have the right one.

The circuit, the piece that explains everything

When Tor Browser opens an onion address, it builds a circuit: a path through three relays, an entry, a middle, and a final hop to the service. Each relay knows only its neighbor, so no single relay sees both you and the market, which is the entire point. The circuit is disposable. It is rebuilt automatically on a timer, rebuilt when you reload, and rebuildable on demand from the onion icon in the address bar.

Now the two complaints about the market explain themselves, and they are not complaints about the market:

• Why the first load is slow. A fresh circuit has to be built relay by relay, the onion handshake has to run end to end, and the market’s access queue has to place you in line. Three to five minutes on a bad day is the sum of all of those, not a malfunction of any one of them.
• Why one address can be slow and another fast. The three onion addresses are three different doors into the same service, and each door has its own set of relays leading to it. A circuit to door one can be congested while a circuit to door two is a straight shot, and nothing about the market changed between the two. This is the whole reason the mirror page lists three instead of one, and the reason switching between them is free.

A status page for an onion address would be a photograph of a road that does not exist anymore by the time you look at it, because your road is rebuilt on every click. The only measurement that describes your situation is the one you take by opening the address, which is why the down page is built from checks instead of indicators.

Where a clearnet proxy fits, and why it is a middleman

The .onion.to and .onion.watch gateways work like this: your regular browser talks to the gateway over ordinary internet, and the gateway runs the Tor part for you, fetching the onion and streaming the page back. It works, it is convenient, and the gateway now sits between you and the market with a copy of the entire conversation in both directions, including the password field. The market is not on the clearnet. The gateway is, and the gateway reads whatever passes through it. One look at a storefront, fine. A login, a payout, a password change, a different purchase, one where the buyer is the gateway and the seller did not agree to the terms.

Why Tor Browser and not a plugin

A Tor extension on a regular browser routes the browser’s network calls through Tor and leaves the rest of the browser as it is, including the parts that leak: the DNS queries, the timing, the fonts, the webgl fingerprint. Tor Browser is built the other way around, with the onion protocol and the isolation first and the browser features fitted around them. Onion sites are written for that stack, and the difference shows up as pages that simply load, styles that apply, scripts that run. If the market looks broken in your current setup, the first variable to change is the browser, before anything is concluded about the market.

The three things that are not problems

• The slow first load. A fresh circuit plus the access queue, one to five minutes, normal. The queue page with the do not refresh note means you arrived at the right address and are in line.
• The different load times on different days. The circuit is rebuilt every time and the relays in it change, so the road is different on every visit. A slow day is a bad road, not a closed one, and a new circuit is the change of route.
• The address being impossible to remember. It was designed that way. The address is a credential, and credentials are not meant to be memorable, they are meant to be copy-pasted and verified, which is what the verify page is for.