The Hidden Layer
A hunt for people who verify
onsecret sells hardware to people who check things themselves. So we built an exercise that rewards exactly that. Each stage below teaches a transferable privacy skill; the whole chain is solvable in Tor Browser, Safest mode, with JavaScript switched off — using nothing but curl, view-source, gpg, steghide and a plain form. No account, no tracking, no JavaScript required.
The core chain
- S1Read what the site leaksWhere sites keep things: response headers, HTML comments, robots.txt, security.txt. The meta-lesson: "disallow" ≠ "secret", and a serious site advertises its key (see the Link: rel="pgpkey" header).
- S2The door is a fingerprintTrust-on-first-use; gpg --verify; that a valid signature by the expected key is what matters. Success releases S3’s steghide passphrase — you cannot skip this stage.
- S3An image can hide textImages carry hidden data; how to detect it (steghide info, binwalk, zsteg) and extract it; and the defensive corollary — strip metadata, be wary of images. That is the hygiene this audience needs.
- S7The chain was the pointDefense-in-depth as a felt experience. The final prize is capped and dated, honestly: codes leak — by design they burn out and expire. No fake urgency.
The advanced track
Harder stages, better codes — and each rotates on its own. No sign-up, still Tor-solvable.
- S4Some things only live on TorWhat a v3 onion service actually is: a full cryptographic origin (not a proxy), self-authenticated by its address, able to serve exclusive content. And concretely: read the Onion-Location header, switch to the .onion.
- S5What matters is what changedThe real "canary" skill: verify a signature BEFORE reading the content, then compare versions over time. A canary only protects the person who verifies and tracks it — not the one who skims it.
About the prizes — plainly
Keys unlock real discount codes, applied by the same checkout engine as any other code. They are honestly limited: each code is capped (a real use-count) and expires. Codes will be posted to forums — that is expected and fine; a leaked code simply burns out. There is no countdown, no “N left” pressure, no fake scarcity. The scarcity is real and stated: a fixed number of uses, an expiry date.
A gift, no strings
Whether or not you play: here is a clean lockscreen wallpaper. It carries no hidden payload — verify that yourself.
