Registering an account: what the form actually hands over

You pick a name, pick a passphrase, fill in whatever else the form insists on, and press the button. That is the whole transaction, and it is worth naming its parts exactly.

Registration is the first moment you give the server something it did not already have. Before it, you were a stream of page requests. After it, there is a row somewhere with a label on it, and everything you do while signed in can be attached to that row. The change is real, but it is narrower than the word "account" suggests, because the row starts out containing only what the form collected.

What the act necessarily hands over

Four things, and they are worth taking one at a time.

A chosen name

Whatever string you typed in the username field. The server holds it verbatim, because it has to display it back to you and to anyone you deal with. It is the label everything else hangs off.

A passphrase, in some form

You typed the characters, so they arrived. What is stored afterwards may be the characters themselves or a derived value that cannot be read back. Which of those it is, is a choice made by whoever wrote the software, and it is not visible from the sign-in page.

Whatever else the form asked

A second passphrase for withdrawals, a PIN, a security question, a captcha response, a referral code, a public key you pasted in. Every field on the form is a field that arrived. If it was asked for, treat it as received.

A first timestamp

The server knew what time it was when the row was made. That single value is the anchor for every later comparison of when this account is active.

Notice what that inventory is made of: things you typed, and one thing the clock supplied. Nothing on it was extracted from your machine.

What it does not hand over

An email address is not on the list unless the form asked for one and you supplied a real one. There is no mechanism by which submitting a web form reveals an address you did not type. A real name is not on the list for the same reason. A market cannot derive a legal identity from a chosen string, and the fact that the interface calls the field "username" does not make it a name in any legal sense.

The network address the server records is the far end of a Tor circuit, not your line. It does not resolve to a household, a city or an internet provider. It changes as circuits change, and it is shared with whoever else is using that path. Treating it as an identifier is a category error, which is the point of the entry guard card.

Under a default Tor Browser configuration, the browser is also not handing over a distinguishing device fingerprint. It is built so that its users look alike to a site: reported window size, fonts, time zone and language are normalised. That is a property of the browser rather than of the network, and it is the property people undo by maximising the window or installing extras. See downloading Tor Browser.

The chosen name is a reused identifier

The largest exposure at registration is not any of the four items above. It is what the name has already been used for. A string you have typed anywhere else is a link between two contexts, and the linking is done by whoever holds both halves, not by the market. A name reused from a forum, a game, an old email address or a marketplace on a different network carries every association those places built for it.

The same logic runs forwards. A name used here and then used elsewhere later ties the two together just as firmly. This is the mechanism behind two other cards: recognition across separate orders, in ordering from the same vendor again, and recognition by a person rather than a system, in telling one person.

A passphrase reused from elsewhere behaves the same way, with a worse failure mode. A name reused is a link. A passphrase reused is a link plus a key, and if it can be read back anywhere it has been typed, it opens whatever else it was used for.

What the first timestamp supports

A single creation time is nearly meaningless alone. It becomes useful beside other times: subsequent sign-ins, a deposit, a message. On its own it says an account came into existence at a moment. In a sequence it starts to describe a rhythm, which is the subject of signing in.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. A name with no history and no futureA string never typed anywhere else, before or after, carries no associations for anyone to find. This costs nothing and removes the largest item on the list. It does not affect anything you type into the account later, and it does nothing about a name you have already used.
2. A passphrase used for exactly one thingReuse is what turns one exposure into several. A passphrase confined to a single account limits the damage of that account being read to that account. It does not protect the account itself from anything happening on the server side.
3. Leaving optional fields emptyA field you did not fill in is a value the server did not receive. Where a form marks something optional, empty is a real choice. This does nothing about required fields, and it does not tell you what happens to the ones you do fill in.
4. Not carrying details across from another siteRecovery hints, security answers and profile text get copied from elsewhere out of habit. Written fresh, they say nothing about your other accounts. Copied, they repeat an answer already known somewhere else.
5. Leaving Tor Browser as it comesThe default configuration is what makes one visitor resemble another. Resizing the window or adding extensions makes the browser more distinctive to any site it visits. Leaving it alone preserves that, and changes nothing about the form.

What this card is not

This card describes what a registration form receives, not what any market stores. Whether a value is kept, for how long, and in what form is a decision made by whoever runs the platform and is not observable from the sign-up page.

Questions that come up

If I never give an email address, is the account anonymous?

It is unnamed, which is not the same thing. The account still accumulates a record of times and actions, and anything you type into it later is received in full. Withholding an email removes one identifier, not the category.

Does the market learn my IP address?

It sees the far end of a Tor circuit. That value does not lead back to your connection and changes over time. What your own provider sees is a different question, handled in the network section.