2FA Authentication Guide

Why 2FA is Essential

Two-factor authentication (2FA) adds a critical security layer to your darknet market accounts. Even if your password is compromised, attackers cannot access your account without the second factor. Markets like Torzon, Kerberos, and Nexus all support 2FA.

How 2FA Works

2FA requires two forms of verification:

1. Something you know - Your password
2. Something you have - Time-based code from authenticator app

The authenticator app generates a new 6-digit code every 30 seconds based on a shared secret established during setup.

Recommended Authenticator Apps

• Aegis Authenticator (Android) - Open-source, encrypted backups
• Raivo OTP (iOS) - Privacy-focused, iCloud sync
• KeePassXC - Password manager with built-in TOTP
• FreeOTP - Simple, no cloud sync

❌ Avoid: Google Authenticator (no backup), Authy (cloud-based)

Setup Process

Step 1: Enable 2FA on Market

1. Navigate to Security Settings
2. Click "Enable Two-Factor Authentication"
3. Scan QR code with authenticator app
4. Enter generated code to confirm

Step 2: Save Backup Codes

• Market provides 10-12 one-time backup codes
• Save codes offline (encrypted USB, paper)
• Never screenshot or save in cloud
• Each code works only once

Step 3: Test 2FA

• Log out and log back in
• Verify code entry works correctly
• Test one backup code to confirm they work

Security Best Practices

• ✅ Use different 2FA app than password manager
• ✅ Enable biometric lock on authenticator app
• ✅ Keep backup codes in multiple secure locations
• ✅ Use unique passwords for each market
• ✅ Enable 2FA on all accounts that support it
• ❌ Never share 2FA codes with anyone
• ❌ Don't use SMS-based 2FA (SIM swapping risk)

If You Lose Access

If you lose your 2FA device:

1. Use backup codes to regain access
2. Immediately disable and re-enable 2FA with new device
3. Generate new backup codes
4. If no backup codes: Contact market support (may take days/weeks)

Market-Specific 2FA Features

Torzon

• TOTP-based 2FA
• PGP-signed backup codes
• Optional 2FA for withdrawals

Kerberos

• Mandatory 2FA for all accounts
• PGP + 2FA dual authentication
• Hardware key support (YubiKey)

Nexus

• Optional 2FA
• Email-free 2FA setup
• QR code + manual entry option

Common Mistakes

• ❌ Not saving backup codes
• ❌ Using same 2FA seed on multiple markets
• ❌ Storing backup codes with password
• ❌ Disabling 2FA for "convenience"
• ❌ Trusting phishing sites with 2FA codes