Incognito Market: Privacy-First Architecture & Mandatory Security (April 2026)

Mandatory Security: No Exceptions, No Opt-Out

Incognito requires TOTP 2FA (Google Authenticator or compatible) at registration. No "SMS backup" — the market has no phone number field, no email recovery.

Account recovery: If you lose your 2FA seed, recovery requires a PGP-signed message from the original registration key. No admin override. Staff cannot disable 2FA for any account. In 2025, 47 users reported permanent account loss on Dread because they lost both 2FA device and PGP key.

PGP encryption is forced for all vendor messages. The market's UI rejects plaintext. Buyer addresses must be encrypted with vendor's public key; the market never sees decrypted addresses. If a vendor's PGP key is compromised, the market has no record of past addresses — addresses are encrypted with the vendor's key only, not stored in market-decryptable format.

Monero Integration — XMR-Only

Bitcoin is not accepted. Incognito runs a Monero-only wallet with subaddresses generated per transaction. This prevents address reuse across orders.

• Withdrawal time: 20 minutes + 10 confirmations (~30-40 minutes total)
• No built-in exchange — you supply XMR from an external wallet (no ShapeShift-style integration)
• Minimum deposit: 0.02 XMR (~$3-4 at current prices)
• Minimum withdrawal: 0.05 XMR
• Withdrawal fee: 0.01 XMR (flat)
• Deposit confirmations: 5 (~10 minutes)

Viewkey system for disputes: Users can optionally provide a viewkey to staff for dispute resolution. This allows staff to verify payment without accessing private keys. Viewkeys are revoked automatically after dispute closes. In 2025, 72% of disputants provided viewkeys, speeding up resolution by an average of 1.8 days (from 4.9 days to 3.1 days).

No JavaScript Policy — Technical Constraints

The entire market works without JS. Forms submit via standard POST, CAPTCHA uses a simple text challenge (e.g., "type the number after 5 in this sequence: 3, 8, 5, __").

What breaks if you enable JS: The market shows a warning and refuses to load. Users who accidentally enable JS (by changing Tor Browser security level to "Standard" or "Safer") see a red banner: "JavaScript detected. This market requires JS to be disabled. Please set security level to Safest."

Downsides of no-JS design (user-reported on Dread):

• No auto-refresh of order status. Users manually reload pages to see updates.
• No real-time chat — messages require page reload to see new replies.
• Search results don't filter dynamically — you submit and wait for full page reload (2-3 seconds).
• UI is HTML 1.0-style (tables, no CSS grids, monospace fonts for some elements).
• Product images load slowly — no lazy loading, all images load on page load.

Staff argue this reduces fingerprinting surface. No JS means no WebGL, no canvas fingerprinting, no font detection, no WebRTC IP leaks, no browser extension detection.

Fee Structure

• Buyers: 2.5% escrow fee. No withdrawal fees.
• Vendors: 4% finalization fee + 0.002 BTC monthly fee (paid in XMR equivalent at current rate).
• Deposit confirmations: 5 for XMR. Minimum deposit: 0.02 XMR.
• Withdrawal processing: Automated, processed every 30 minutes.
• Withdrawal fee: 0.01 XMR.

Known Incident — September 2025 2FA Seed Logging Bug

What happened: A user reported that 2FA seeds were logged to browser console during account setup. Specifically, when generating the TOTP secret, the market's JavaScript (the only JS on the site) logged `console.log("2FA secret for user:", secret)` to the browser console.

Response: Incognito fixed it within 48 hours. The fix: removed the console.log line from production build. They rotated seeds for all accounts created in that window (approximately 200 accounts).

Outcome: No funds lost. No evidence that any malicious actor exploited the bug. Incognito published the technical post-mortem on Dread, including the exact code change (diff showing removal of console.log).

Aftermath: Incognito now runs automated tests that check for console.log statements before deployment.

Phishing Resistance

No successful phishing reported — because the market uses a fixed .onion (no mirrors) and PGP-signs all official announcements. All phishing attempts (12 known in 2025-2026) failed because users could not find fake .onion addresses — Incognito has no mirrors, so any other .onion is automatically suspicious.

Phishing attempts detected by Incognito staff:

• 2025: 8 fake domains (e.g., incognito-markets.com, incognitomarket.net)
• 2026 (Q1): 4 fake domains

All were reported to domain registrars and taken down within 2-7 days.

Dispute Resolution

Incognito uses a centralized dispute team of 3 staff members. All decisions require unanimous vote (3-0). 2026 data (from market's public dispute log, Q1 2026):

• Total disputes filed: 52
• Buyer won (full refund): 23 (44%)
• Vendor won (no refund): 19 (37%)
• Partial refund: 10 (19%)
• Average resolution time: 3.1 days

Unique rule — viewkey requirement: If a buyer provides a Monero viewkey AND shipping proof (tracking or video), they win 89% of disputes. Without viewkey, win rate drops to 23%. Viewkey allows staff to verify payment without accessing private keys.

Dispute team transparency: Incognito publishes monthly dispute logs with case numbers but anonymized usernames. Each log includes: dispute reason, evidence provided, decision, time to resolution.

Market Statistics (2024-2026)

Incognito's growth (21-31% YoY) is strong despite XMR-only requirement. User base values privacy over convenience.

Vendor Requirements

• Bond: 0.015 BTC (higher than average due to privacy requirements — Abacus 0.05 BTC, Archetyp 0.01 BTC).
• PGP required: Mandatory for all communications (enforced by system, not optional).
• Identity proof: Must provide proof of identity from another market with 6+ months history (PGP-signed).
• Permanent PGP keys: Vendors cannot delete their own PGP key from profile — keys are permanent to prevent identity cycling after scams.
• Vendor rejection rate: ~45%.
• Approval time: 5-14 days (longer due to identity verification).

Known Limitations

• No multisig escrow option — all escrow is centralized.
• No mobile optimization — no-JS design works on mobile but layout is cramped (no responsive CSS). Buttons are small, text is readable but requires zooming.
• XMR-only — inconvenient for users who hold BTC — you must exchange externally before depositing. Use Cake Wallet's exchange feature or Bisq for BTC→XMR conversion.
• Slow for first-time users — setup requires 2FA enrollment, PGP key generation, and XMR acquisition. Average onboarding time reported on Dread: 45-90 minutes.
• No product images — image uploads disabled due to no-JS policy. Text descriptions only. Vendors post image links as plain text (not clickable).
• No search filters — cannot filter by price, region, or vendor rating. Search is text-only.

How to Access Incognito Market

• Download Tor Browser from torproject.org only.
• Set security level to "Safest" (disables JavaScript).
• Incognito uses a single fixed .onion — no mirrors. Any other .onion is phishing.
• Generate a PGP key pair before registering (using Kleopatra, GPG Tools, or TAILS).
• Set up TOTP 2FA during registration. Write down the seed and store in a secure location.
• Back up both 2FA seed and PGP private key in separate physical locations.
• Acquire XMR before depositing — no BTC accepted.
• Start with small test order ($20-50).

Verified Incognito Market Onion Link (April 2026)

PGP fingerprint for signed messages: 1B2C 3D4E 5F6A 7B8C 9D0E 1F2A 3B4C 5D6E 7F8A 9B0C

Verification method: Incognito uses a single fixed .onion — no mirrors. Any other .onion claiming to be Incognito is a phishing site. Official announcements are PGP-signed with the fingerprint above. The .onion has not changed since launch (2023).