Omega Market logo Omega Market

Omega Market security & PGP

Verify before you trust

The market is only as safe as the habits around it. The technology does the heavy lifting, but a lot of losses come from small human errors: a mistyped address, an unchecked signature, a password reused from somewhere else. This page covers the pieces that matter and how to use them without thinking too hard.

The official PGP key

Announcements, support replies, and important notices are signed with this key. Before you act on anything that claims to come from Omega, verify the signature and compare the fingerprint below. It is the one check that separates a real message from a convincing fake.

6383E112 811BA4F7 147057FB 98105DD4 940CBC22

-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGenKVUBEADCOEc5GysL2cn7oq0XBSTpDWoI0mwR3rO1dbFLsE8366iwq6nS OpanMN5XW9440Rgx2H7wNPvigwrU6ajtoI97L/ki5491dcaQ/RWEb1HXgKcD1eKj 2ItTGZG4gCuckXK7xquwkiJ8L83MLBaPnEkAjHiJJM9+S7YBR1670kpcOuiwMxVE Zv0H5N2Fstm0GjJbz/NXnqSZUXhnKYKp8hO5AdnZajwnh6o70fmboKkPTC+zMjws 9pDWZRjGfoAxEbOXVfU2BgkBsQyXar1Matg1dQKfeXSMH+uJcg16DxTKsrihvlyt Ufxq5Hs9fZWfOWSB8UlgyAKqczQkjbP1J8dWPXEnlS+VRYsPPcYIGXmgQE8XOFoK lXB2ZVcB26Hj8YH84DWwQ9lIuFceMCONoU05 =G+C2 -----END PGP PUBLIC KEY BLOCK-----

Import the block into your PGP client, then confirm the fingerprint matches the line above. If it does not, you have the wrong key and nothing signed with it is trustworthy.

How to verify a signature

  1. Import the public key from this page into your client.
  2. Confirm the imported key shows the same fingerprint as above.
  3. Open the signed message. Your client tells you whether the signature is valid.
  4. A valid signature plus a matching fingerprint means the message came from the key holder and was not altered. Anything else, treat as untrusted.

Account hygiene

  • Use a password you do not use anywhere else.
  • Turn on 2-factor authentication before you fund the account.
  • Write your recovery code down on paper, not in a note on your phone.
  • Keep your private PGP key backed up and encrypted.
  • Log out when you are done, especially on a shared device.

Network and opsec

Everything below assumes you are using Tor Browser, which is the foundation. Without it, the rest is decorative.

  • Keep Tor Browser updated. Old builds leak in ways the new ones do not.
  • Never maximise the window. A fixed size stops your screen resolution from being fingerprinted.
  • Leave JavaScript off by default and only enable it where a page genuinely needs it.
  • Do not download files from the market onto your normal machine. If you must, do it on an isolated system.
  • Use a dedicated profile for the market. Do not mix it with your everyday browsing.
The honest part. None of this is a guarantee. A market can be seized, a key can be compromised, a vendor can vanish with funds still in escrow. Opsec lowers the odds and the size of the hit when something goes wrong. It does not make it impossible. People who treat it as a shield instead of a probability are the ones who get burned.

Common questions

How do I verify a message is really from Omega?
Check the PGP signature against the fingerprint on this page. If the signature verifies and the fingerprint matches, the message came from the holder of the private key. If it does not verify, do not act on it, whatever it claims.
Where do I get the public key?
From the market itself and from this page. Import it into your client, then confirm the fingerprint matches the one printed here before you trust it. Getting the key from the same place you read the announcement is the weak link, so cross-check the fingerprint.
Do I need a separate PGP program?
Not necessarily. The market has built-in tools for generating and importing keys. If you prefer a desktop client, Kleopatra on Windows, GPG Suite on macOS, and GPG on Linux all work fine.
Is my IP exposed when I browse the market?
No, not if you use Tor Browser. Your traffic exits through the Tor network, so the market sees a Tor exit address, not yours. That protection only holds if you actually browse through Tor and not through a normal browser.
What is escrow and how does it protect me?
Your payment is held by the market, not the vendor, until you confirm you received the order. If something goes wrong, you open a dispute and the market decides whether the funds go back to you. Escrow is the main reason a bad vendor is a loss you can recover instead of a loss you simply eat.
Can I use Bitcoin or only Monero?
Monero is the native currency and the cleanest option. Bitcoin and Litecoin are accepted and converted. For the least amount of trace on the public ledger, use Monero.

Know where the money goes

Security protects the account. The next thing to understand is how payments actually move through escrow. That is the payments page.

Payments Full FAQ
Copied to clipboard