Silk Road forums

First, Nightcrawler posted an answer in the other thread. You should read that.

What do you mean by dual-booting a USB? You want two operating systems on it? Or you want one operating system on it which you can reboot your computer into? (I suspect that's what you mean)

Others may have different opinions, but I suggest going with Tails as your distro, which already comes with security apps (including Tor) and safe configurations.

The Tails web site has documentation on installing to a USB stick.

https://tails.boum.org/doc/first_steps/usb_installation/index.en.html

Another thing is, if you are going to combine signing and encryption, you should sign a plaintext message first, then encrypt it.

It avoids this problem:

- -----BEGIN PGP MESSAGE-----

- -----END PGP MESSAGE-----

See the dash and space at the beginning of those lines? The recipient has to manually remove them in order to decrypt the message, and that's a pain in the ass, especially for a vendor who deals with dozens of encrypted messages a day.

Maybe it depends on where you live, but buying e-gold wasn't much different from buying bitcoins. You had to send money to a virtual currency exchange and then get it deposited to your e-gold account. Those exchanges were more fly by night, that's one difference. MtGox has been a very stable business so far.

Thanks. I'll have to look into intrusion detection switches.

One thing I didn't describe is how you access the servers for administrative purposes. Both the gateway and workstation would have hidden services for ssh, and the daemons would be listening only on localhost, so the gateway sshd wouldn't accept any connections from the public internet (the workstation of course doesn't face the public internet at all).

Further, the HiddenServiceAuthorizeClient option would be turned on and set to stealth, meaning that the admin has to include a "cookie" (basically a password) in his torrc to access the ssh hidden service. If the cookie is not provided, the hidden service appears not to be running, so it's deniable that these ssh hidden services exist at all. Connecting to the gateway and workstation would be a matter of pointing one's ssh client, over Tor, at the right onion domain.

It's not like the money currently being spent on drugs would disappear if they were legalized. So instead of selling illegally, you could open a shop and sell it legally, possibly make even more money that way and without the legal risk.

That was a nice, detailed overview. I remember some of those forums.

Only thing I would add is usenet. That was probably the first online place where people bought and sold drugs.

Does anybody want to brainstorm about securing hidden services? Here's my ideal setup.

You need two dedicated servers. One is the workstation and the other is the gateway. The workstation hosts the web and database servers. It runs the web site. The gateway hosts two Tor clients. One client is directed at the SOCKS port of the other client, so its Tor circuits run through the other client's Tor circuits. The gateway has two network interface cards. One is connected to the internet, the other is connected via a crossover ethernet cable to the workstation. The workstation can only access the internet through the gateway. The gateway contains iptables rules to force all connections from the workstation over Tor. That way, even if the workstation is pwned, the attacker can't determine the IP address. Running Tor over Tor makes certain attacks on hidden service entry guards harder.

Both servers run security-hardened kernels with patches like TRESOR to put encryption keys in CPU registers instead of RAM. They use full disk encryption and SE Linux or AppArmor with strict access control policies.

I haven't found a good example of how to do this, but I would prefer to booby trap the cases with a special lock. A specific key or code must be entered. If the case is opened any other way, it initiates a shut down sequence that scrambles RAM and overwrites the first gigabyte of the hard disk, destroying the encryption key. Alternatively, the key could be stored in the TPM, but I don't know how safe that is. Hardware manufacturers may provide backdoors for LE.

All of this is setup in a secure, private location and the servers are shipped to the data center. The technician simply installs the servers in a rack, connects the ethernet cables and turns them on.

What am I missing? How could this be made safer?

+1

anonman88
blueveil
typtap
JoeyGPesci007
Ballzinator
Flyerz1934
dirtybiscuitzz718
CrazyBart
samesamebutdiffernt
PrincessHIGH

Speaking of psychedelics, has anyone tried mescaline, specifically from cactus? I parachuted 2 ounces of cactus powder, farted for 6 hours, but it was a nice trip.