DrugHub Passwordless PGP Login, Step by Step

Why keys instead of logins — the seizure argument

A conventional marketplace stores password hashes. A breach hands an attacker a table they can grind offline forever, and even if they cannot recover every hash, session tokens and cookies are stealable artefacts. A seized box then also yields plaintext message history between vendors and customers — usable as evidence long after anyone pretends otherwise.

DrugHub deletes both attack surfaces. The only thing the server holds for your account is your public key. Proof of identity is a signature you produce at login time with hardware only you hold. Messages are encrypted end-to-end by enforcement — the platform simply will not accept plaintext — so a seized database is ciphertext plus metadata, exactly like any other post. Staff put the backup-recovery question (“have you ever considered a recovery route if someone loses their key?”) to rest with four words: “we are not even considering that”. Which is to say: the key is the identity, the account, and the audit trail of everything you said.

What that buys you in numbers

Pre-registration requirements — read before you bother

The registration page says it and the signed post repeats it: by using the marketplace you must already know PGP and Monero. Tickets of the shape “how do I sign a message”, “how do you verify a signature”, or “how do you encrypt to multiple recipients” get ignored — that is the market’s documented policy, and the automated pages are the sanctioned answer channel (99.5 % of issues resolve there).

• Key: one keypair, ideally dedicated to market accounts (distinct from your keypair if you have one). RSA 3072+ or EdDSA are sensible choices; curve preferences aside, what matters is the passphrase on the secret key.
• Capabilities: keygen, sign (binary + detached), encrypt/decrypt, verify — against at least one real announcement before your first login challenge.
• Wallet: Monero knowledge, because payments are XMR-only. The invoice page on this site covers wallet choices and how invoices work.
• Client: a working Tor setup; see the Tor / Tails notes if you are still assembling one.

Community sentiment, for balance: people who were forced to learn PGP at sign-up largely thank the market for the friction — “forced to learn on my own and it was easy… thanks for the default-on security”, and one user called the forced PGP login exactly what they wanted because “it prevents the most problems”. The friction is the product here, not a bug.

How each login actually works

The session model is deliberately stateless-looking. Every sign-in: the market issues a challenge (a nonce-bound string), your client signs it with the private key, and the server checks that signature against the registered public key before it will hand you anything. No cookies to steal, no tokens to replay across mirrors, no password-spray surface, and no magic “remember on this device”. It is effectively a hard 2FA where the second factor is key material sitting on your chosen hardware.

The sign-in message — read it

The signed key-facts post has a line worth tattooing on: “watch your sign-in message, that is the best way to avoid phishing”. A fake mirror that cannot verify announcements to the staff key will still happily hand you a plausible login challenge; checking who you are signing for is one step and catches the whole class of mirror-swap attacks. The verification block in the banner above carries the fingerprint to check against.

Registration → first sign-in — ordered

1. Keygen: create the pair inside your protected profile. Note the passphrase; there will be no recovery.
2. Verify: grab a recent signed market announcement; verify signature + fingerprint 2gj6 w49X MbMf … jfUF AmhQ. Keep the post for reference.
3. Navigate: Tor Browser to the verified onion; let the PoW gate spin. A decent CPU solves fast; a throttled shared VM will make you wait — expected.
4. Register: submit the public key (+ passphrase hint fields where prompted). Browsing the storefront works beforehand — no account required for listings or carts.
5. Challenge: answer the signature challenge to open your first session. The welcome/sign-in message will tell you which mirror you are on — read it.
6. Private mirror (optional): vendors receive two on acceptance; customers can ticket. The link is account-bound — treat it like a secret.

Failure modes, tickets, purges

The failure modes seen in the thread, mapped to the documented answer:

• Puzzle hangs / slow first load: PoW on a weak CPU or throttled network. Different machine/profile; do not assume downtime. “99 % working, if it doesn’t work for you, the problem is on your side.”
• Login says “not a buyer” months later: inactivity purge at ~6 months. Re-register; per community confirmation, the name and key are reusable.
• Signature rejected: usually a key mismatch or a wrong-key signing. Confirm which keypair’s pubkey was registered.
• Message bounced to plaintext: enforcement doing its job — encrypt to the vendor’s key from the listing.

Tickets are support; there is no Dread desk (said explicitly, with a post permalink). An open ticket means wait, not another ticket — nothing gets expedited for withdrawals, tickets, or disputes, by policy. For account-state problems like “registered in the merge, now says not-a-buyer”, the thread shows exactly where the staff reply goes: “open a ticket, we may work it out”. The same thread carries two ban-log entries — one over a photo-alteration flag loop, another over a repeated external-contact paste — both answered in the style of “you were banned because you broke the rules, repeatedly”: the rulebook is applied with evidence, not vibes.

Staff, verbatim (login-adjacent)

• “They do. ~6 months.” — on account purges
• “No, we are not even considering that.” — on any recovery route
• “99 % are working, if yours isn’t, then the problem is on your side.” — on connection complaints
• “Open a customer account on the market and send a ticket there, we may work it out.” — on account-state problems
• “Send a ticket.” — on mirror/privilege questions

Key storage recommendations (practical)

Because login, messages, disputes and vendor correspondence all terminate on the same keypair, treat the secret key like a root password plus evidence store. A dedicated Tails LUKS volume or Whonix workstation for day-to-day signing, a passphrase you will not reuse, and an offline/encrypted backup of the secret key is the minimum that makes “lost key = no recovery” acceptable. The market ships an E2EE helper in both Python (280 lines) and Go (290 lines), a signed PGP-released reverse proxy that does the encrypt/decrypt transparently on top of supported systems (Tails, Whonix, Qubes, Debian) — compile it yourself, no binaries. If the message flow feels heavy, that is what it is for.

Registration, challenges and first-login walkthrough continue here whenever you need them; the fee numbers that follow from every order are one page away on the FAQ.