WeTheNorth

13 lessons

PGP School syllabus

Four modules in order. Each lesson takes a few minutes and ends with a one-line summary you can remember.

Module 1PGP basics

  1. What PGP actually does for a WeTheNorth visitor

    PGP is how a WeTheNorth market link can be proven genuine and how private messages stay private. A plain-language starting point.

  2. Choosing a PGP tool on Windows, macOS or Linux

    Kleopatra, GPG Suite and the gpg command line all do the same job. Which one suits a first-time user and where to get it safely.

  3. Public and private keys, explained without the maths

    A short explanation of PGP key pairs using everyday comparisons, and the single rule that keeps your private key safe.

Module 2Keys and fingerprints

  1. Creating your first PGP key pair, step by step

    How to generate a modern PGP key pair in Kleopatra or gpg, which settings to choose and what to do immediately afterwards.

  2. What a key fingerprint is and why you compare it

    Key IDs can collide; fingerprints practically cannot. Why the full fingerprint is what you check before trusting a WeTheNorth signature.

  3. Importing the WeTheNorth signing key safely

    How to import a published WeTheNorth public key, confirm its fingerprint and mark it so that future signatures can be checked quickly.

  4. Verifying a signed WeTheNorth market URL message

    The exact steps to verify a signed message that contains a WeTheNorth market URL, and how to read the result your PGP tool shows.

Module 3Two-factor login

  1. How PGP two-factor login works on onion markets

    Many onion services offer PGP-based two-factor authentication. What happens during the login challenge and why it stops password thieves.

  2. Turning on PGP two-factor login without locking yourself out

    The safe order for enabling PGP two-factor login: upload the right key, test decryption and keep your backup ready.

  3. When a two-factor challenge looks wrong

    A challenge that will not decrypt or that contains unexpected instructions can be a sign of a fake WeTheNorth onion. What to do.

Module 4Mistakes to avoid

  1. Accidentally pasting a private key: what to do next

    Pasting a private key into a form or chat is a serious mistake but a recoverable one. The steps to take right away.

  2. Why unsigned WeTheNorth mirror posts should not be trusted

    Most fake WeTheNorth mirror addresses spread through unsigned posts. Why a missing signature is the most useful warning sign you have.

  3. Losing a PGP key: backups you should have made yesterday

    A lost private key means lost two-factor access. A simple backup routine that protects you against broken drives and reinstalls.