How does 2FA work on Fawkes Market?

With PGP two-factor authentication enabled, each login presents an encrypted challenge that only your private PGP key can decrypt. You decrypt it, enter the result, and you're in — a stolen password alone can no longer access the account.

What happens if I lose my PGP key?

Contact market support with proof of ownership, but assume the account is lost. Back up the private key and its passphrase offline to prevent this.

Fawkes Market 2FA — Two-Factor Authentication

Two-factor authentication is the difference between "a phisher has my password" and "a phisher has my password and still can't touch me". On Fawkes Market, 2FA is PGP-based: each login is a small cryptography test that only your private key can pass. This page explains how it works, how to set it up, and the backup discipline that saves you if things go wrong.

How PGP 2FA works at login

# What happens when 2FA is enabled

1. You enter your username and password

2. The market encrypts a one-time challenge with your PUBLIC key

3. You decrypt it with your PRIVATE key (passphrase required)

4. You enter the decrypted code — you're in

# An attacker with only your password is stopped at step 2

No phone number, no SMS, no authenticator app — just keys. That matters on darknet markets, where handing a phone number to anyone defeats the purpose, and where TOTP apps would still tie your login to a device you carry daily.

Why PGP beats app-based 2FA here

No identifying factor

SMS 2FA hands your phone number to the market; app 2FA ties logins to your daily-carry device. PGP keys are just files you control.

Works offline

Your private key lives on your disk (or a USB stick). Login challenges work with no internet, no phone signal, no accounts anywhere.

Survives device loss

Lose your phone with TOTP and you're locked out. Lose your laptop and your backed-up key still works from any machine.

Doubles for messaging

The same keypair encrypts and signs messages with vendors — one tool, two jobs. See the PGP guide.

Setting it up (the short version)

Generate a key pair — full instructions in the PGP guide.
Log in to Fawkes Market via a verified link (mirror list).
Account settings → paste your public key block → enable 2FA.
Decrypt the test challenge when prompted and confirm.
Do the backup steps below immediately.

Backups: the part everyone skips

1Export the private key

In Kleopatra / GPG Suite / OpenKeychain, export your private (secret) key as an armored file. It is protected by your passphrase — which is why the passphrase must be strong.

2Store two copies, offline

USB stick in a drawer, encrypted drive, password-manager attachment. Two locations, so one failure doesn't cost you the account.

3Record the passphrase separately

Password manager or memorised. The passphrase and the key file together open your account; either alone does nothing.

FAQ

What if I lose my private key?

Contact the market's support with proof of account ownership — some markets can disable 2FA after verification. But treat it as likely lost: there's no email reset on a darknet market. Backups exist so this never happens.

Can I use one key for several markets?

Yes, though separate keys per identity are cleaner — if one key leaks, only one identity is exposed. See OPSEC.

Does 2FA slow down every login?

It adds about ten seconds: copy challenge, decrypt, paste code. The phishing protection it buys is worth infinitely more.

My 2FA challenge stopped appearing at login — is that bad?

Yes, potentially. Either you're on a phishing clone that skipped the challenge, or 2FA was disabled. Verify the URL immediately against the mirror list, then check your settings from a verified link.

Next steps

The full PGP guide — key generation in detail.
Phishing defence — where 2FA saves you.
The OPSEC checklist — everything else.