Silk Road forums

Quote from: astor on August 23, 2013, 10:47 pm

This post by Gary Oak summed it up nicely at the time: https://dkn255hz262ypmii.onion.to/index.php?topic=94549.msg669172#msg669172

The hyper-secure astor uses tor2web? 

Anyone here not using onion.to can see that the original link I posted is straight .onion. Perhaps you only revealed your own insecure practices via a proxy rewrite.

Ok ...I will admit it. I, like StExo  do a bit of misinformation here and there myself as it is good practice since I'm terrible at adjusting my writing styles constantly if I change nicknames or whatever, So when I decided to open my vendor account I got rid of my old forum nickname...I was Guru.

We may have our disagreements, but I admire your wit.

PCs used to come with Windows installation disks. If you fucked up your computer, you could do a clean reinstall. This was the case up until about Windows Vista, I believe. Around that time they stopped shipping installation disks and put a rescue partition on the drive instead. The rescue partition only works if there's a recognizable Windows install on one of the other partitions. So you can't do a random write over the Windows partition and reinstall Windows. If you write over the whole drive, the rescue partition is gone too. If you create a backup disk, you run the risk of backing up the files that you want to destroy. So there is no way to securely reinstall the copy of Windows that you paid for (ie, with that license).

I suspect that's not an accident.

How do you point the browser at a random web proxy?

Pick one of these web proxies and enter the URL of the site you want to reach: http://www.publicproxyservers.com/proxy/list_rating1.html

Different proxies offer different features. Not all of them will proxy SSL connections, for example. Some of them will include headers that tell the destination site the connection is being proxied. You want a proxy marked as "HiAn" on that list (high anonymity, ie, the X-Forwarded-For header is not set).

You can google for other web sites that list thousands of web proxies like that.

@Psyche
Maybe this is less about forcing users to use PGP but more about preventing the FBI/NSA harrassing him. If he can't decrypt the emails there is no point in targeting him.

I believe that is exactly why they want to drop all unencrypted emails.

Quote from: fake on August 23, 2013, 06:26 am

where is the login page of http://365u4txyqfy72nul.onion/mail/ ?

From the looks of it, there's no webmail. just pop and imap.

It's the second link I posted: http://365u4txyqfy72nul.onion/wmail/notice.html


I like that they put the Postfix configuration files on Github, so anyone can run a gateway. There could be multiple gateways relaying for multiple hidden service email providers, so there isn't a central point of failure like Tormail.

There is no such thing as  a safe way to lose data by using nsa, one or 7 times, it doesn't matter.
The more the better.

There is a lot of evidence that contradicts your claim.

According to the 2006 NIST Special Publication 800-88 Section 2.3 (p. 6): "Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack."

The National Institute of Standards and Technology is a government agency that makes recommendations to government and industry. Secure data erasure is important, for example, to comply with HIPAA, the medical privacy law. Hospitals must destroy medical records when their computers are decommissioned. They must wipe their hard drives. If they threw away a bunch of computers with insecurely erased hard drives and someone was able to recover patient records, that would be a massive violation of federal law. That's why it's unlikely that NIST is lying about their recommendation in order to screw us.

According to the 2006 Center for Magnetic Recording Research Tutorial on Disk Drive Data Sanitization Document (p. 8): "Secure erase does a single on-track erasure of the data on the disk drive. The U.S. National Security Agency published an Information Assurance Approval of single pass overwrite, after technical testing at CMRR showed that multiple on-track overwrite passes gave no additional erasure."

Again, this Information Assurance Approval by the NSA is for other government agencies. They are unlikely to be lying to them.

I posted the entire CMRR white paper here: http://dkn255hz262ypmii.onion/index.php?topic=99520.msg699299#msg699299

Further analysis by Wright et al. seems to also indicate that one overwrite is all that is generally required.

http://link.springer.com/chapter/10.1007%2F978-3-540-89862-7_21


Perhaps the best evidence that the NSA doesn't have magic technology to recover files after random writes is this:

A forensics expert testified in the Bradley Manning trial that, "the hard drive on Manning's computer had been securely erased in January 2010. "Everything from early January is gone"'.

http://www.theguardian.com/world/blog/2011/dec/19/bradley-manning-pre-trial-hearing-live-updates

Bradley Manning is the highest profile person to be prosecuted by the US government in the last 5 years. If they had the ability to recover data from his computer after it was securely erased, they would have used it. They didn't use it because it doesn't exist. Or if it does exist and Manning wasn't worth the trouble of using it on, none of us are either.

I should point out that Manning tried several times to securely erase his hard drives. One of those times was a zero write and they were able to recover data from that, so we should consider zero writes to be insecure. However, one random write is sufficient to make data unrecoverable.

I posted once about it a while ago, but there in no official policy.  right now what we do is archive the data after 4 months.  archiving basically strips out all info except what is needed for the stats and keeps the database lean.  I removed the "all-time" column after reading this thread to avoid further issues.  It's kind of unimportant for judging a buyer and I think it is nicer on the eyes/mind to have 3 instead of 4 data points to look at anyway.

But the data is not stripped of identifying info as long as the account is active. That's pretty clear from the total vendors stats.

So I stand by my recommendation earlier in this thread. If you don't want to accumulate a long trail of evidence, create a new account.