The three layers that keep the account intact
Two factor login, PGP on the messages, and one check of the address bar before you type a password. Each one is cheap. Together they cover the failure modes that actually take accounts down.
Two factor login
The login screen takes a username and a password, and that is the only secret it needs. Two factor adds a second check on top of it, a one time code from an authenticator app, so a leaked password is not a logged in session. Turn it on in the account settings before the first deposit, not after, because the setting is easiest to find before the wallet has a balance in it.
The backup codes the setup page lists are the only way back in if the phone that holds the authenticator is lost. They are shown once. Writing them down and keeping them somewhere that is not this browser is the whole job, and it takes about a minute.
PGP on the messages
Messages between you and a vendor travel over the market’s messaging, and PGP is the layer that keeps a third party, including the market’s own servers, from reading them. Generate a key pair, paste the public part into the account, and the market uses it to encrypt anything it sends you. The private key stays with you, which is also the part that has to be backed up, because a lost private key is a locked inbox.
The reason it is worth the setup is that the market can see that you messaged a vendor and when, even if it cannot read what you said. That is a meaningful difference when the message is a negotiation, and it is the reason the market asks vendors to have a key before they list.
The address check that catches a clone
None of the above matters if you are typing a password into the wrong page. The check is the one that costs nothing and catches the most: read the address bar before the password field. The first four characters should read mars and the final six should match the list on this site. A clone that got the prefix right but not the tail is the common one, and the tail is the part that comes from the key, not the name.
If the address in the bar does not match the one you pasted, an intermediate app rewrote it on the way. That is its own problem, worth a second look, but it is not the market being down.
What the market does on its side
The storefront runs as a hidden service, so the transport is already the onion layer rather than a bare TCP connection. The login form is the one place a script can reach, and it is the one the market keeps as plain as it can be. The escrow is the structural part, the 2 of 3 multisig that means no single key, the market’s included, can move a funded order on its own.
The honest limit is that all of this is custodial. The keys that sign the escrow are held by the market, and a market that stops answering holds the third key. The layers above keep your account and your messages intact while the market is up. What happens after it is not is on the exit page.