DrugHub Market Security Architecture

Passwordless PGP Authentication

Traditional passwords create vulnerabilities through weak choices, reuse, phishing, database breaches, and keylogger attacks. DrugHub's passwordless system requires users to prove identity by decrypting challenge messages with their PGP private key. No password database exists to breach, no credentials to phish, no weak passwords to crack. Each login generates a unique encrypted challenge that only the legitimate private key can decrypt, proving possession without transmitting secrets over the network.

The private key never leaves your device, and challenge messages change with every login attempt. Intercepted challenges are useless without the corresponding private key, which should be protected by a strong passphrase known only to you.

PGP-Based Two-Factor Authentication

DrugHub's 2FA implementation uses PGP encryption rather than TOTP apps or SMS messages. When enabled, login requires decrypting two separate challenge messages. The first proves you possess the private key, the second confirms active authentication attempt timing. This cryptographic 2FA prevents replay attacks and ensures even compromised private key passphrases don't grant immediate access without the time-based second factor.

Unlike TOTP apps that can be compromised through device theft or backup cloud exposure, PGP-based 2FA uses the same secure infrastructure already protecting your account. No additional devices or phone numbers required - just your existing PGP keypair and passphrase.

Recovery Token System

DrugHub generates a unique recovery token during registration, displayed only once. This cryptographic token serves as emergency account access if you lose your PGP private key. Store the token offline in multiple secure locations - encrypted USB drives, paper wallets in safes, or memorized if possible. Never store recovery tokens in cloud services, unencrypted digital storage, or email.

Recovery tokens use 256-bit entropy making brute-force attacks computationally infeasible. The token can restore account access but DrugHub requires additional verification steps (security questions, order history validation) to prevent token theft from granting full access. Losing both your private key and recovery token results in permanent, irreversible account loss.

Session Management & Timeout

DrugHub implements aggressive session timeout policies to reduce exposure windows. Default timeout occurs after 30 minutes of inactivity, but users can configure shorter durations (10-15 minutes) for enhanced security. Sessions are cryptographically signed and verified on every request, preventing session hijacking through cookie theft or man-in-the-middle attacks.

Always manually log out when finished rather than relying on timeout. Active sessions remain vulnerable to browser exploitation or physical device access until explicit destruction. DrugHub never implements "remember me" functionality - every session requires fresh authentication to maintain maximum security posture.

Transaction PIN Protection

A 6-digit PIN code adds a final confirmation layer before sensitive actions like finalizing escrow, withdrawing funds, or changing security settings. This PIN prevents attackers with temporary session access from completing damaging operations without additional authentication. Choose a PIN not used elsewhere and never share it with vendors or support staff.

DrugHub never stores PINs in plaintext. The system uses bcrypt hashing with per-user salts, making rainbow table attacks ineffective. Multiple failed PIN attempts trigger progressive rate limiting (30 seconds after 3 failures, 5 minutes after 6 failures, 1 hour after 10 failures) to prevent brute-force attacks.

Account Activity Monitoring

DrugHub logs all significant account actions: successful logins, failed authentication attempts, password recovery requests (which shouldn't occur), escrow finalizations, disputes opened, and security setting changes. Users can review activity logs to detect unauthorized access attempts or suspicious patterns indicating account compromise.

Enable notification settings to receive PGP-encrypted messages for critical events. While DrugHub doesn't collect email addresses for privacy reasons, on-platform notifications provide immediate alerts about account activity when you next log in. Regular activity log reviews help identify security incidents early.

END GAME DDoS Protection

DrugHub uses END GAME DDoS mitigation technology maintaining 92% uptime during sustained attack campaigns. While competitors experienced complete outages during 2024's intense DDoS waves, DrugHub remained accessible through defensive measures filtering attack traffic while allowing legitimate users through. END GAME combines rate limiting, challenge-response protocols, and distributed infrastructure to absorb massive attack volumes without service disruption.

Dynamic Mirror Rotation

Multiple mirror URLs distribute load and provide redundancy if specific onion addresses face targeted attacks. DrugHub rotates mirrors regularly, retiring old URLs and launching new ones. This dynamic infrastructure prevents adversaries from maintaining long-term surveillance of specific onion addresses. Always obtain current mirrors from PGP-signed lists on Dread rather than relying on outdated bookmarks.

Data Minimization Policy

DrugHub collects minimal user data by design. No email addresses, no phone numbers, no IP addresses logged. PGP public keys and usernames represent the only persistent identity markers. Messages auto-delete after 90 days. Order histories retain transaction hashes but not content details after completion. This data minimization reduces exposure if servers are seized - there's simply less information available to compromise users.