Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - astor

Pages: 1 ... 86 87 [88] 89 90 ... 208
1306
What do you mean by missing proxy settings?  Onion icon -> Settings -> Network

I see the same proxy settings that have always been there. Nobody is getting paid to develop Vidalia, so it is extremely unlikely anything will change about it... until they remove it completely and integrate its features into TorBrowser

1307
Security / Re: How to Obtain an Anonymous P.O. box.
« on: May 18, 2013, 07:32 pm »
In addition to what kmfkewm is saying, I think another advantage of a PO box, whether its a fake name or not, is that you control the aspect of delivery far more so than being a passive receiver at a home address. You can know the neighborhood of your Post Office. What kind of traffic is common, are there businesses in the area? Is it rural, suburban or in a city center? Are there nearby structures that could be used as observation posts by police if they wanted to take it that far and not just  use car surveillance and on the flip side, are there nearby structures you could use to take advantage of, like parking garages with multiple entries and exits...You know, every time I go to pick up from my PO box I'll spend 20 to 30 minutes just walking around peripheral streets like I'm some neighborhood schmuk out on his health walk. I'm making mental notes....are there cars parked with people sitting in them. Is anyone else out walking on the street? Have I seen any patrol cars cruising around?

All of these things give you, the receiver, that much more control.

I make the opposite argument. I feel much safer at home. It's my turf, my street. I know every car that parks on the street. If an unrecognized car was parked a block away on the day that I was expecting a package, I wouldn't pull it out of the box right then.

A post office is foreign territory. Anyone can park in the lot, making it harder to look for suspicious cars. LE can be in the back of the building. They are unlikely to be sitting in your living room, waiting for you to come inside with the package.

I feel like I have much more control over the situation at home, although in reality we have little control over either situation. Quite frankly, if LE wants to CD you, there's not much you can do. They've busted millions of people that way and know what they are doing. You aren't going to escape. You will be arrested, whether you physically handle / accept the package or not. Rejecting the package or writing "return to sender" won't protect you. They will have a search warrant already, which they will execute and they will raid your place. Even if they find nothing, they know that some percentage of people will be scared shitless and talk, and there's a good chance you will. Everyone is a hero until the men with badges are standing in their living room. Look how many people have flipped, especially in the hacker community, but it happens often in the drug and activist communities too. There was some hardcore anarchist woman who became an informant when she was raided. That's why I say other people are the biggest attack surface against you. The technology we use is much more reliable. Other people are the least reliable and nobody should know about your business. Nobody knows about mine. There is not one person in my real life that knows I'm associated with this community, or that I got quoted in Forbes, LOL.

We can go back and forth about the advantages and disadvantages of home versus remote shipping locations, and this debate breaks out once every few months it seems (with no resolution), but I think ultimately, your best defense is to order amounts so small that they don't care about you. Because otherwise, there is no fool proof packaging method or shipping location.

If their attention is drawn to your package, there is no shipping method good enough to escape detection. If you can find the drugs, they can find the drugs. They have dogs, x-rays and chemical tests which you don't have. Yesterday there was a thread about how they detected LSD soaked in stickers. They could detect illegal drugs in a mixture that is 99.9% inert carrier, from which you are supposed to re-extract the drugs. Read the old Microgram Bulletins. There are some very creative stealth shipping methods, much more creative and stealthy than anything I've seen from SR vendors, and all of them were detected, or they would not have been featured in that publication. Yeah, they can find everything if they are suspicious enough. There's no way to make the drugs magically disappear inside the package.

Likewise, with the shipping location, if it's a large amount, you are pretty much guaranteed to get arrested. If they want to find you, they will find you eventually. You only need to fuck up once. I just operate on that assumption and never order large amounts.

1308
This news is a couple days old, but I agree, they would not have seized the Dwolla account unless they have evidence of financial crimes. I believe Karpeles will be indicted and probably extradited, and it's prudent to withdraw all BTC from MtGox.

1309
Shipping / Re: Moisture Barrier Bags
« on: May 18, 2013, 07:17 am »
PlutoPete
Military Grade 5 Layer Construction Heat Seal Foil
http://silkroadvb5piz3r.onion/silkroad/item/3e10560aef

Quality4All
Moisture Barrier Bags
http://silkroadvb5piz3r.onion/silkroad/item/8b1720dd0c


Ordering these products from SR exposes vendors to unnecessary risk, as kmfkewm explained a month ago:

http://dkn255hz262ypmii.onion/index.php?topic=144097.0

You shouldn't buy products that that serve as evidence you are a vendor / drug distributor and link you to a physical address. It's as bad as ordering drugs under your vendor account.

1310
Off topic / Re: Vancouver company intercepts LSD-laced mail
« on: May 18, 2013, 04:43 am »
@ OP, your a ignorant little shite.. and rather than POSSIBLY trying to quell this situation, and help.. you go off ranting about how wrong this and that.

Great job keeping the community as safe an environment as you can, I thank your immensely for your well thought contributions to our community.

Yeah, because Vancouver LE didn't immediately inform the local LE of the addresses of the returned packages.

LE only gets their leads from SR forum.

1311
Drug safety / Re: Hawaiian baby woodrose = yuck.
« on: May 18, 2013, 02:50 am »
HBWR seeds contain an emetic. That's a chemical that makes you to feel nauseated and vomit. It's a defense mechanism to keep you from eating the seeds (technically, so is the LSA). Supposedly the emetic is all in the shell, so if you can scrape the shell off, you'll greatly reduce the chances of nausea/vomiting, but good luck with that.

The one time I did HBWR, I puke so hard that blood vessels burst around my eyes. The trip was decent. Not as good as a dozen other psychedelics I've done, but not nearly as bad as some hallucinogens. The emetic is the deal breaker for me. Never did those seeds again.

1312
Off topic / Re: Vancouver company intercepts LSD-laced mail
« on: May 18, 2013, 02:29 am »
Sorry scout, I was responding to The Scientist and thought I would be the next post, so I didn't quote him, but you posted in between.

It's my fault really. No worries. :)


1313
Off topic / Re: Vancouver company intercepts LSD-laced mail
« on: May 18, 2013, 02:19 am »
But deleting the thread would be censorship!

Well, I'm all for the judicious application of censorship, I'm just honest about it.

The people who claim to be against censorship are almost universally hypocrites, because they have no problem with deleting spam, scam posts, or locking up mere consumers of CP (but lets not get on that topic).

Sure, delete the thread, but the vendor should make the buyers aware that they may be targets of LE investigations now. The vendor should be able to figure out which of his buyers they are.

1314
I have never been in this situation, but I think SR should put a small message on that form that reads "hint: seller rating is optional, rating can also be done later" or something like it. Or a small "skip" button instead of "cancel", personally I interpret "cancel" like it would cancel the whole finalization. Rating doesn't look like an optional step for me currently.

Then vendors would get pissed because lots of people would think it's optional / unnecessary and not leave feedback, or they would intend to submit a rating after the product arrives but forget later. Think of all the people who say they will update and never do. The end result is that vendors would be deprived of stats that boost their position on the site. More specifically, vendors who try to protect themselves with FE (which is allowed once you get 35 transactions and $1500 in sales) would be punished. So they would be forced to make a choice between exposing themselves to scammer buyers and losing sales because of reduced ranking, because of fewer ratings.

There are trade offs to everything.

1315
Off topic / Re: Vancouver company intercepts LSD-laced mail
« on: May 18, 2013, 01:18 am »
ack.  i know which vendor this was ...

i'd encourage everyone NOT to speculate publicly as it doesn't seem to have been tied to SR yet (though now it is since LE reads the forums) ... you can still help protect the vendor in question by NOT publicly guessing who it was.

Why? Obviously (or at least hopefully) the vendor is going to change their shipping method now, and LE knows nothing more about the vendor than what they could have discovered by ordering from them (the city they ship from).

Also, it took me all of three minutes to look through the LSD listings and figure out it must be one of three vendors.

This is more dangerous for the buyers because of the main reason that people use fake addresses. LE knows that some people use a fake number that is close to their real address, hoping the the mailman will recognize the mistake and put it in their box.

LE can probably pretty easily figure out who the buyers of those returned envelopes are. If I was them, I'd clean house.

1316
Silk Road discussion / Re: Thank you to everyone anyway
« on: May 18, 2013, 12:53 am »
:D

What are the chances that Chaos (in jail, supposedly) AND his friend "Steve" both misspell "a lot" as "allot" ?

Very uncommon grammatical error to be made by two 'different' people using the same account that commonly makes that grammatical error, no?

Linkability through stylometry. I love it.

He should have run his posts through Anonymouth.

1317
Security / Re: Advice on upgrading crypto-security?
« on: May 18, 2013, 12:27 am »
astor, I've read many of your posts around these forums and they've been a great help.  Thanks for taking the time to reply to me and for all your work in this community.  Its a pleasure to meet you  ;D

Thanks. Nice to meet you too. :)

As a short term solution, I've set up a thumb drive and it seems to be working properly.  Great! 

Have you tried to reboot and copy the .gnupg folder from the thumb drive back into your home folder, then start Kgpg and confirm that your key is there? You should do that before distributing it to other people, otherwise there will be much head aches and sadness when they send you messages you can't decrypt.

In regards to the VPN, I'm rather interested in the theory of being totally anonymous online.  I've used a VPN (virtual private network, I believe?) for work before, but that was for accessing secure databases.  How does this help to mask tor use?

It's an encrypted tunnel from your home to the VPN server. The ISP can't see that you're running Tor circuits through it.

LE could ask the VPN to log your activity. The VPN can certainly see that your outbound connections are going to Tor relays. You can make that more difficult by getting a VPN offshore, especially in some shady country.

You could make it even more difficult by getting a VPS in a different (shady) country and setting up a private bridge. Then your connection goes from home -> VPN -> private bridge -> Tor network. You could add as many proxies and hops as you want, but ultimately a determined adversary who can get each country / ISP to help, can follow the trail to the Tor relay. There's really no absolute way to hide your Tor use from a very determined and powerful adversary. You can only make it increasingly difficult for the adversary, and much less usable for yourself, with every hop.

The bottom line is, you don't have to worry about that.

500,000 people connect directly to Tor relays every day, and they do so for dozens of reasons, many of them perfectly legal. Using Tor is not evidence of any particular crime, and it is extremely unlikely that LE could get a search warrant based on "this guy uses Tor", with no other evidence. They wouldn't even know what crime they would (potentially) arrest you for. Are you using Tor for CP, drugs, money laundering, hacking, stalking? Without evidence of a specific crime, or evidence to be suspicious of a specific crime, no judge is going to issue a search warrant.

At least not in any non-despotic country.


1318
Security / Re: Crypto migration plan for hidden services
« on: May 18, 2013, 12:12 am »
I'm not even sure what such a low key strength would be used to begin with. My PGP key strength is 4096 bits and I use it because I know it is much more future-proof. Why settle for something less secure?

1024 bits was pretty strong 10 years ago when they wrote the initial code. :)

Since then they've been delaying the inevitable because 1024 bits was "good enough" and existing hidden services would be screwed. Now it's getting dangerously close to not being good enough anymore.

For future-proofing SilkRoad into the decades, we must also consider the threat of Quantum computing. Has any proper analysis been done to what kind of threat this could pose, I guess not only to SilkRoad but many other internet protocols?

Sure, it's well known that RSA is weak to quantum computing.

The good news is that people are already working on algorithms that are resistant to it:

https://en.wikipedia.org/wiki/Post-quantum_cryptography

1319
Security / Re: Advice on upgrading crypto-security?
« on: May 17, 2013, 09:18 pm »
It sounds like the best way to clean my laptop so that it would be safe in the event of being seized by LE is it to backup all files I need and reset the factory settings (utilizing the 7-pass overwrite option).  Does this jibe with the general consensus?

If your laptop has hardware secure erase, that's pretty much the best option. However, if you're ordering personal amounts, LE isn't going to spend weeks doing a forensic analysis of your computer. Something to think about, but if you can reinstall the OS for free, sure secure erase the hard drive.


Secondly, since persistence is not yet supported by TAILs on a DVD, is there anyway for me to save a pgp Key or do I have to create a new one every time I log on?  If its not possible to save one then I should probably look into a liveUSB, but it sounds as though I will have issues booting it on my mac.  I have read some threads on this mac/usb issue but haven't found a solid solution yet which is why I went with a DVD in the first place.

You could save your PGP keys to a thumb drive. You may not be able to boot from a thumb drive, but you can plug one in after booting and save data to it. Just copy the .gnupg folder that's in your home folder (it's a "hidden" folder, so you'll have to do View -> Show Hidden Files in the file manager).

After each boot, delete the existing .gnupg folder (if it exists; it may not until you use a PGP program) and replace it with the backup copy.

You'll have to update the backup each time you add other people's public keys.

It will be easier in the long run to use Tails USB. I've heard of hacks that allow you to boot thumb drives on restricted Macs, but I don't know the details about that.


Finally, once I have a clean computer and am accessing via TAILs, would it be safe to connect from my home internet, or is the possibility of my ISP recognizing and flagging Tor use at my house (with my stash) too great?  I'm sure this depends on the individual but the more opinions the safer we all are.

Depends on where you live. In China or Iran, you can't access public relays at all. Under some despotic regimes, you may get a knock on the door. I don't know of any western country that does that, though. It's not illegal to use Tor, and nobody is going around kicking people's doors in for using it. I've been using Tor for over 5 years without a problem.

However, you can hide your Tor use with a VPN or bridge, if you want to.

1320
Security / Re: Crypto migration plan for hidden services
« on: May 17, 2013, 09:00 pm »
They should have made the system support a range of key sizes to begin with. At least they are going to do that now, so you will be able to use keys up to 4096 bits, I believe.

Pages: 1 ... 86 87 [88] 89 90 ... 208