Silk Road forums

@NW Nugz

-----BEGIN PGP MESSAGE-----

hQIMA9+fz6FB1NRiAQ//bKpXl2j3N2IYZqH86vHMYTdS9P8MeFWiW2AI0LnS/YaN
pahzH4C9J/rvwINAXdRILYh67XHzsYNjFRt/chsp/dUlEfpDvYy/iH05F6q/M8Db
VRuKoxD9WG9WgKsxxii2otOBdMukhd8btk9ptsEvI2YiVYCaiLHObO994S96xm6W
sp89aa7fTQtkHyb4vjNvkuxcjmqT03Okex9bdaa19IC+pqwa2t6AE6LIKB80jgio
PEIQweLEQTblfw9Rz57oJQzHw0g1kYoZooPeCM93PryrNyok/prmTAxI/kG4DRdN
9H3m35l8DduHDYF3Uu9JELnzAVZ20+4iTHRmc++Oy8Dp+LxIcH44V3eHBDLF88MW
2Y913K+ugxPFJQZmSz8LfbmFJlwMZbpeSBdEtGyR1anMQxTOGEuocedQoWQGg7DY
plPKABI877Icn6YtjCpQzm4+3Yc+mdX4PWkJU7v4KErZOmGV+ebJNNuT/O+/nRHC
WC2h/htadVVcgbHYUfuLaJDMDdpJTC3TPObb0x9pGnIlSSHHEnrsniQcE5TALXsI
3CT1IoIDQzmgnfVf+QqdNJcoK9VY14anoIND1duSaQLayy3wYScJV+qQwaTA8MIy
/nF4JRyc/jRMRVP64efspJ/uP5H9Gxu8G2EaQc1Jm47amLPR6x7ws7BNksNuQRmF
AgwD/6flA8ySWtcBEACXE0766OBq+OBm6QmxXWy50jdo3LTIYW6oV0xpUazsRl50
lzfX2LCrMe2wwsQl4FpxkosopRsqCRi/aysqqQg6/PiQyhyFae868esrbHY/g8WC
zQ+J+QftFzA+Gbpl8gIJNNt9h11PITgOKpBYYhWX6j0x1CHBCi7KN8knvaII8UT9
qhnT/lPFgAYgsW4f5uhl5IWEV2LeLGtrRTo5C9D9Y8oYGvuhXtoAnHGTf5IQHRWX
oK12hAmFhnqobDunBGY/ad0BIKGHFKvg5WMRYNats+aJQc4ijkySZ7FF2H0PN8kW
PhC6JYL4hjjW49TSm7YDl0Tafpb1mVhVP4BM94XmU5ZVynvuaEed5VTJ3lTGGjK6
UEYXZs3iyvyWGn/Yo4lxZvjZUV8OmXglVBUxbG2c3tRhD+cDq17KRlnEbcuH50Cp
gTLxSkNSHefT63wRmRnHNC0v9ojNBz16CuwEkFj8n+ftHI4rVfD5/bJG6EzrypKX
sQ/87LCYwPskqn2JjlcVOHApICTAeIchMc0sXc07lyZXP9GM/0nRXG5CFNxtljP2
B5EVWIKRZIw+HSP7KHkJd1dNrfJsgZ2LF2yR27J0/XaZwp9x9F3Uq+prK9s9OCjK
58nee4V0apXl4/i3D10K+PBMmuskIHY0O6rbHoGf2yNfclQI2zX1x2wziEYs4dKI
ATk0vBEhJdfypRyYkjLt4pg/x6Qbkm01MQez7niBrG9t1hdGAVqMveuNjsoUWD5L
TJkJUzi5RMr16ta6HUUC0gfrbiKXqgzIUIuJpPCIuI9NwhTenGkt5sjeKe02JDOV
WM+886xyrrfZpweSybU/007Hw81x4YHmaRbkc77IjczfcRI8WqGv3A==
=MpdJ
-----END PGP MESSAGE-----

You can extract the browser bundle in 2 places and run separate TBB instances. On Windows, for one of the Tor instances, you will have to change the SocksPort and ControlPort in onion icon -> Settings -> Advanced or in ./Data/Tor/torrc. On Linux (and possibly on Mac), the SocksPort is selected randomly each time TBB starts, so you don't have to do that.

Almost 300 posts on the forum and you don't know? What have you been talking about here?

http://howdoyoubuybitcoins.com/

@TheCrawlingKingSnake

-----BEGIN PGP MESSAGE-----

hQIMA/+n5QPMklrXAQ//aPSyjUYZxkHcbx0ZiEm7zZY0ddZOPnlub64uOXXG09dY
afwmGcv2CHlgmgJFe1Isf+OasvWsCkx8QdUSS6GvjFjtixrzJWLTcY9HvJ+BMmUh
jLFtTCpkF/JPeKR76ZJ+ks0iG3DViUE3gCCVZEzix7R7XmRdOuEd7eFjuZmzvktg
n7AIRTBMKQ826dA1gNlDvKmjiYdJI/sNdij5sDTlAenz8i+xdl2HfOPtNqQtXRNQ
f3b1/g4zDCQbWRpPXW5Kq0u/7vWHMPyaxmQYSvQFjipPPSVF1Lkn9eIhx6nxLaJa
5XpK4SCFHqEKM2alo+jc7bi9pHl1MpV7nTfCRLhvbuxjJI1Qfna8WWWSpu07+cG8
So4D/nSxbv3Hnj1D/w1W9ZUdkxfETkqxabxemoDoqYIFT5rhsvHi9LI2Cmms/Q6V
Un7/pccCBLHN1dluDPgz+bE8fU5IRa8FMasCkzjou77JJ/ANKq+vHp3TF/xq5Q4r
et7aGoxMEwaVIY3eZj3PmFtox3XxqSmNCHQrrZf22qtd9YhrQ2SB38weu0IM9Dl6
rtk30bIm/g+vwbPtIeIVAEIZnizp/y5bMBLhIMwwsn+BAvRLSyV44CPBRD0PvNl9
ugNPnwFkkrzY3pmpTc5iv777q6ReTDtJT1YnvtuWJ3YPdFLL69L1Y96zgPih6zOF
AgwD0SacF0SWCuQBD/9/SQpUr/TP6TtL0ecNWpiCTmGYOMO8oklwPsO4Drt3mMRX
37XnB0VFwP3PFFlwImAZ9r+eDP9glF/q5L+5bvxADx/xWdloOkQGVAWN+Xz1ZLnX
IhoP4BS/5n4jHKAbIuA/q78NB0o0POqGij1MyPXD0ELLNfgoRJP8wcy/Ku69Nysa
xNjRvplwqohVfahkCcp1/aKvAi3qyxAisFa7pnymE9QzTww/nD0QDj0sEFfDCp3O
TSbwdVqdp32O7eWirlChzxj14vBoJ+FXBfhNk/MRAz8iqOLoMLJf4fUfFkg5+AYm
GTKYks5o29aF6hyqxNQ5QqP4OzMr9poout0Hjg/LHXdkPt4KitLdMEDhfkdN2G0u
dXWZ1krGFP0bVxbn9471+NAkhb2TjZQITHhfyNUv6XnNIe5gdppMWnbLFn5eBy8Q
+/r6rFqcq3bm+ZFnjEVCshhj7IUW+GO/Cj+SFQ3J1i+OyFq5p6UM99CpRqJ0BMXl
ijRqHjMk+E6hjtYdggJ/eyGNDGJzbxO8g8YYe4x3tGwxXKK/xQd409deXfo8YqXq
8PDF7Gq/rKd8ZiWdzCYjhxH3HF6koumWaR61T6Bi0qY7HMHasn/jY/ajy5f636ML
mf368YueOOslKMo3frRqOtmMzQ3X+7AJ/4q+NBF3JSWTQ5eBvVFalq7PSVdcRtK1
AXWDrQdtvONlnZXnRcpss0iRgiUQNRKPfomp4SbG+eR73uIH6Xe+rySni9fRwwXU
YVyEeXCT+0pP+QSPuVxuziNfu8Qp8sfYwQYCNUt0MMyaRjHJBLc3oRGJCsfEcZai
fTZZgDMWw0wxA3INibDtVTXzwRIiSeEdzSG1XmrZ4PulnVjib9YW5niTK6Y84QU1
58ao40lMPqNFwCIEX7ndcPPIqkvf+gTtIxksrzhI6nnSNNZ2cA==
=8LOm
-----END PGP MESSAGE-----

There was a vendor whose SR and forum accounts got hacked about a month ago. He created a new forum account and several of us said that he had to prove his identity, because the alt account could have been the hacker too. He signed a message and we waited for some of his customers who would already have his key to verify it. I don't know what the resolution of that was, since nobody came forward after several hours and I didn't keep track of the thread.

The problem in that situation was that he wasn't a big time vendor and didn't have enough customers with his key to immediately verify his identity, but you can see that the solution is to distribute your key and trade keys with as many other people as possible. A top vendor would have been verified quickly and easily.

Thousands of people have DPR's key, so it's basically impossible to impersonate him short of stealing his private key.

I tested it with a throw away account. After entering username and pin it says:

Your password has been changed to <password>
Please log in immediately and change it via account->settings

After logging in, everything seems normal. I think it's a new feature to recover lost passwords.

That is true, which is why signing your PGP key is useless. An attacker can create his own key, sign it, and replace yours.

The solution to this problem is to distribute your key to as many places (and people) as possible and let everyone know about it. The attacker probably can't pwn every distribution channel, so majority wins.

You can find my key in these places:

http://dkn255hz262ypmii.onion/index.php?topic=174.msg668472#msg668472

http://32yehzkk7jflf6r2.onion/astor.txt

http://25vuwfdig7yt44qo.onion

If one of them is ever different, the outlier is a forgery. There are also plenty of people on the forum that you check with at this point. If an attacker pretends to be me, a few of the many people who have my key will notice. The only time you should trust a new key claimed to be mine is if it is signed with the old key.

There are two things about that.

1) NIST and CMRR recommend a random write, not a zero write.

2)

All the data that Johnson was able to retrieve from un-allocated space came after that overwrite, he said.

They also recommend using an offline program, meaning the host OS isn't running. DBAN is a program that you reboot the computer into, for example. If the host OS is running, then depending on the program, it may not write over the unallocated space (for example, running the command "secure-delete C:" won't write over the unallocated space). The article doesn't mention whether it was an online or offline program, but one interpretation is that he used a program running on the host OS, which only wrote over the allocated partitions/space, leaving the unallocated space untouched, even though he didn't cancel the job.

In fact, he may have done a zero fill of the empty space, which would be the least secure.