Crown the first ninety minutes What this site is
The first ninety minutes /The account/The second code, and what it guards
25

The second code, and what it guards

Costs
Two minutes now, more if you enable a key
Common mistake
Treating it as a backup password

The form asks for a second short thing and does not explain it. It is not a spare password and it does not guard the login. It guards a much smaller and much more specific set of actions.

Back to minute 25

Crown market addresses

crownm5jmtbhqnoxhexx7nyiygqgqofp3wnjyyfl74gziohqqy6oq5id.onion
crownrywlm7mnohkzntlir2tlhafq6tzphgqyag5cw5en7nprchfklad.onion
crownwpaimgizxylrvrh4u6acpvk4l757cfla7xs6zjki7tdjqbnv6qd.onion

Published exactly as supplied. Nothing on this site is monitored, tested or checked, so no address here is claimed to be working. What a copied address does and does not settle.

What actually happens here

A field appears asking for a pin, a code, a withdrawal phrase or something similarly named. You invent one, type it, and move on without much thought because the form gave you no reason to think.

You then do not see it again for half an hour. It reappears at the moment you try to move value out of the account or change something structural about it, which is normally at minute 75 or later. Somebody who wrote it down carelessly at minute 25 discovers this at the least convenient point.

What it is actually for

The password protects the account against somebody logging in. The second code protects the balance against somebody who has already logged in. Those are different threats and they need different answers.

The scenario it addresses is a session left open, or a password that has leaked, where the attacker is inside and now wants to move money out. A separate code, which is never typed at login and therefore never captured by anything watching the login, blocks the profitable half of that.

The other kind of second factor

Many places also offer a stronger login protection built on an encryption key. You provide a public key, and at each login the site gives you an encrypted block of text that you have to decrypt to produce a code. Only somebody holding the private key can do that.

It is genuinely strong, because it proves possession of a key rather than knowledge of a string, and a stolen password becomes useless on its own. It is also the single most common way people lock themselves out permanently, because losing the private key means losing the ability to log in with no route around it.

What key based login gives you
  • A leaked password stops being enough on its own.
  • It cannot be phished by a copied page, since a copy cannot produce a block your key will decrypt.
  • It is the strongest thing available on an account of this kind.
What it can cost you
  • Lose the key and the account is gone. There is no override and nobody to ask.
  • Every login now needs a decryption step, which is friction at the worst moment.
  • Setting it up in a first session, before you are comfortable with the tooling, is how people lock themselves out on day one.
A defensible defaultFor a first session, set the short code and leave key based login alone until you have used the account a few times and are confident about where your key lives. Turning it on later is easy. Turning it off after losing the key is not possible.
Where people stall

The stall is a code invented on the spot and not recorded, because the field looked minor. It then blocks the first attempt to do anything with the balance, half an hour later, with money already sitting there.

The second is confusing it with the password and setting both to the same thing. That removes the entire point of having two, since anybody who learns one now has both.

The third is enabling key based login in a first session out of enthusiasm. It is the correct setting eventually and the wrong one today, and the failure mode is not an inconvenience, it is a permanently unreachable account.

How long this really takes
What people expectA few seconds, it is another box
What it usually costsTwo minutes if you just set the code, fifteen if you enable a key

The fifteen minute version is not wasted, it is just misplaced. It belongs in a later session where a mistake with the key costs you nothing because the account is empty.

Record it with everything else

Name, password and this code go together, in the same place, at the same time. Three separate strings, each of which alone can lock you out. Writing two of them down and remembering the third is the failure pattern, and the third is always this one, because it looks small.

Where they all go is settled in the next phase, which is where this run finally stops asking you to invent strings and starts asking you what happens when you lose them.

In one line

A small field guarding the money rather than the door. Set it, write it down, and leave key based login for a session where you have nothing to lose.