Osiris Schedulehow often, not just how Everything this involves, sorted by how frequently you actually do it
Schedule › Every time

Check the signature

under a minute

The one task here that answers a question nothing else can, and the one most likely to fall off the routine.

Osiris addresses

Three published addresses for the same market. Copy rather than retype.

osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion
osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion
osirisydmlx47esm6ylhzhtnjrucgnymi7beqoyzze5jn3opbr3zy4id.onion

This list is published, not monitored. An address that opens is not an address that is genuine, and the check that settles it belongs to the every time list.

How often
Every session, before typing anything.
How long
Under a minute, assuming the fingerprint is pinned.
What it prevents
A copied login page, which is the most common attack in this whole subject and the least sophisticated.
If you skip it
Nothing, for months. Then one evening, everything.
How you notice you stopped
You will not, which is the problem. Put it before the password field rather than after, so skipping it requires a decision.

The procedure

  1. Find the signed block. It begins and ends with the armour lines. No signed block means you are finished and the answer is no.
  2. Copy all of it. Nothing trimmed, no whitespace altered, no quotation marks converted. A partial copy fails in a way that looks identical to tampering.
  3. Check against your pinned fingerprint. Not a key the page offers, and not one you fetched because the check complained.
  4. Read the output. Both which key signed and the date inside the signed text.

The four results

ResultMeaningWhat to do
Bad signatureText altered after signing, or fabricatedLeave. Unambiguous, no judgement needed.
No public keySigned by a key you do not hold. A gap in your keyring.Import the right key after checking its fingerprint. Never one the page offers.
Good, unexpected keyThe maths works against a key that is not yoursLeave. The word good appears, which is why this catches people.
Good, old dateVerifies, statement is months oldTreat as unconfirmed. Signatures never expire, so genuine old ones get replayed.
The habit inside the habitThe last two rows are what catch experienced readers, and one habit defeats both. Read which key signed and when, rather than stopping at the word good. Two seconds.

What it does not tell you

Whether the signer is honest, whether your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely and no others at all. That narrowness is exactly why it is worth doing and why the rest of the schedule exists.