Silk Road forums

Discussion => Silk Road discussion => Topic started by: q on August 11, 2013, 04:08 pm

Title: SR STAFF: Important message about vendor security, huge security problems!
Post by: q on August 11, 2013, 04:08 pm
Every day I read new shit about vendors on SR being unbelievable insecure and stupid.

*Vendors use tor2web.com
*Vendors don't use any encryption, some vendors send tracking information and addresses unencrypted!
*Vendors selling their vendoraccounts
*Vendors keeping lists of all customer adresses
*Vendors cashing out their bitcoins through risky third partys like MT.Gox
*Vendors trading with each other from vendor accounts

Some vendors still use Tormail even thou it's compromised...

This place is such a mess full of risky vendors!
First of all, how did this people end up as vendors in the first place?
There should be a forced quality test before anyone can become a vendor.

The test should make sure vendors know how to;
*use PGP encryption properly
*avoid cashing out their bitcoins from risky sites like MT.Gox who work closely with POLICE
*delete all previous messages after an order is finished
*store their shit on their computers safe with full disk-encryption or encrypted containers
*not use risky connections to the site, like tor2web.com
*not keep lists of customers addresses and other information

If they can't do this simple shit they should not be here.
I know from legit sources many customers have been busted by the police because risky idiots have been allowed to sell here.
(and more are to come as BlueGiraffe motherfucker leaked ALL customer addresses from ALL deals he ever done to the police.)

Vendors must be forced to read and learn several guides about simple security precautions before they even think about starting up a business here.
Security should always be at a good minimum level. If they don't want or can't be minimum secure, ban them.
For example PGP should be an absolute minimum to use. No PGP = walk the plank!
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Wadozo on August 11, 2013, 04:22 pm
Every day I read new shit about vendors on SR being unbelievable insecure and stupid.

*Vendors use tor2web.com
*Vendors don't use any encryption, some vendors send tracking information and addresses unencrypted!
*Vendors selling their vendoraccounts
*Vendors keeping lists of all customer adresses
*Vendors cashing out their bitcoins through risky third partys like MT.Gox
*Vendors trading with each other from vendor accounts

Some vendors still use Tormail even thou it's compromised...

This place is such a mess full of risky vendors!
First of all, how did this people end up as vendors in the first place?
There should be a forced quality test before anyone can become a vendor.

The test should make sure vendors know how to;
*use PGP encryption properly
*avoid cashing out their bitcoins from risky sites like MT.Gox who work closely with POLICE
*delete all previous messages after an order is finished
*store their shit on their computers safe with full disk-encryption or encrypted containers
*not use risky connections to the site, like tor2web.com
*not keep lists of customers addresses and other information

If they can't do this simple shit they should not be here.
I know from legit sources many customers have been busted by the police because risky idiots have been allowed to sell here.

Vendors must be forced to read and learn several guides about simple security precautions before they even think about starting up a business here.
Security should always be at a good minimum level. If they don't want or can't be minimum secure, ban them.
For example PGP should be an absolute minimum to use. No PGP = walk the plank!

While I don't disagree with what you say in the main, I doubt DPR will set up such a policy as it's against Libertarian principles to be told what to do and how to do it. It's the individuals choice to run their account as they see fit, as long as they don't scam or interfere with others. DPR has provided a platform to sell products and vendors can sell them without him interfering, as long as they obey some basic rules and guidelines.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: q on August 11, 2013, 04:32 pm
I understand he is liberal but being so liberal people are allowed to be totally open without any security risking other peoples lives is too liberal.
This must be thought through again, minimum safety should always be priority.

We must protect ourselves to keep this freedom we have here.
Vendors especially must be educated not to risk their own and others freedom by being lazy.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Aoth14 on August 11, 2013, 04:41 pm
This is apparently how SR wants things to be. To be honest I think DPR needs a good shake and splash w cold water over this whole war on drugs, quantity over quality crap.  I thought bringing mailorder drug sales public was to eliminate the shady situations drug users often get themselves into. I was wrong, obviously.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: londonlondon on August 11, 2013, 04:52 pm
Every day I read new shit about vendors on SR being unbelievable insecure and stupid.

*Vendors use tor2web.com
*Vendors don't use any encryption, some vendors send tracking information and addresses unencrypted!
*Vendors selling their vendoraccounts
*Vendors keeping lists of all customer adresses
*Vendors cashing out their bitcoins through risky third partys like MT.Gox
*Vendors trading with each other from vendor accounts

Some vendors still use Tormail even thou it's compromised...

This place is such a mess full of risky vendors!
First of all, how did this people end up as vendors in the first place?
There should be a forced quality test before anyone can become a vendor.

The test should make sure vendors know how to;
*use PGP encryption properly
*avoid cashing out their bitcoins from risky sites like MT.Gox who work closely with POLICE
*delete all previous messages after an order is finished
*store their shit on their computers safe with full disk-encryption or encrypted containers
*not use risky connections to the site, like tor2web.com
*not keep lists of customers addresses and other information

If they can't do this simple shit they should not be here.
I know from legit sources many customers have been busted by the police because risky idiots have been allowed to sell here.
(and more are to come as BlueGiraffe motherfucker leaked ALL customer addresses from ALL deals he ever done to the police.)

Vendors must be forced to read and learn several guides about simple security precautions before they even think about starting up a business here.
Security should always be at a good minimum level. If they don't want or can't be minimum secure, ban them.
For example PGP should be an absolute minimum to use. No PGP = walk the plank!

your idea sounds truly fantastic..you should be running SR actually, don't know why DPR is doing here..

who's going to enforce these rules? how is SR staff to know if a vendor is keeping addresses? Or if he's using PGP? Or if they're deleting their messages (how to say if an undeleted message is still being used?)? or if they have bought state-of-the-art, encrypt-everything-inside-and-inaccessible-by-LE computers?

step out of your fantasy land kid. as peachy as it sounds, there's only so much SR staff can do. I don't think they will start holding auditions for each and every vendor that shows up. "uuuhh, well, lets see today Mr. Vendor #9423, demonstrate to us that you know how to use PGP encryption...goood job!...now on to packaging, show us your stealth!"

all we can to is hope for a top, anonymous service from vendors we pay and  trust with our details
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Wadozo on August 11, 2013, 04:57 pm
I understand he is liberal but being so liberal people are allowed to be totally open without any security risking other peoples lives is too liberal.
This must be thought through again, minimum safety should always be priority.

We must protect ourselves to keep this freedom we have here.
Vendors especially must be educated not to risk their own and others freedom by being lazy.

As I said, I believe your points are valid and if I'm being honest, should be implemented for both vendors and buyers alike. However, based on previous threads where this issue was discussed, I doubt anything will change any time soon, if at all. In the meantime, we as individuals should ask the relevant questions prior to placing an order with a vendor. If you like their responses, give them a go. If your skeptical of their replies, buy elsewhere.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: cirrus on August 11, 2013, 06:14 pm
Wadozo is pretty much spot on with this.  The marketplace was set up under the principles of a free market and with that it self governs itself.  All of your complaints are clearly addressed in the sites rules and sellers guides. There are certain things that the staff will act on but it is impossible and against all of the founding beliefs to police the marketplace to the point of total control.

The reason this market exists is because it allows the freedoms that make it possible for you or anyone to buy some of the items sold there.  It would be contradictory to act against it.  You have the freedom of choice because we don't control the market, and one of those freedoms include the ability to buy or not buy something.  That risk falls upon you, and the staff does not control that.  We do our best to protect you but we can't control every vendor.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: princeblack49 on August 11, 2013, 06:28 pm
Every day I read new shit about vendors on SR being unbelievable insecure and stupid.

*Vendors use tor2web.com
*Vendors don't use any encryption, some vendors send tracking information and addresses unencrypted!
*Vendors selling their vendoraccounts
*Vendors keeping lists of all customer adresses
*Vendors cashing out their bitcoins through risky third partys like MT.Gox
*Vendors trading with each other from vendor accounts

Some vendors still use Tormail even thou it's compromised...

This place is such a mess full of risky vendors!
First of all, how did this people end up as vendors in the first place?
There should be a forced quality test before anyone can become a vendor.

The test should make sure vendors know how to;
*use PGP encryption properly
*avoid cashing out their bitcoins from risky sites like MT.Gox who work closely with POLICE
*delete all previous messages after an order is finished
*store their shit on their computers safe with full disk-encryption or encrypted containers
*not use risky connections to the site, like tor2web.com
*not keep lists of customers addresses and other information

If they can't do this simple shit they should not be here.
I know from legit sources many customers have been busted by the police because risky idiots have been allowed to sell here.

Vendors must be forced to read and learn several guides about simple security precautions before they even think about starting up a business here.
Security should always be at a good minimum level. If they don't want or can't be minimum secure, ban them.
For example PGP should be an absolute minimum to use. No PGP = walk the plank!

While I don't disagree with what you say in the main, I doubt DPR will set up such a policy as it's against Libertarian principles to be told what to do and how to do it. It's the individuals choice to run their account as they see fit, as long as they don't scam or interfere with others. DPR has provided a platform to sell products and vendors can sell them without him interfering, as long as they obey some basic rules and guidelines.
Basically as a buyer I have the choice to work with a vendor or not. If my desire to stay out of jail is lower than my desire for a product maybe it would be time to seek treatment. No PGP no deal. I used privnote once long ago but never ever again. Assuming everyone here has normal to above average intelligence and care for customer security is a bad idea. In the address field I always insert my security terms and ask the vendor to cancel if they will not abide.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: DrMDA on August 11, 2013, 08:02 pm
Don't know what vendors you deal with but I don't engage in any of those things as a vendor nor can I imagine why one would.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: cactuschomper on August 11, 2013, 08:10 pm
TLDR
Free Market.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: SmokesHisBroccoli on August 11, 2013, 08:11 pm
Don't know what vendors you deal with but I don't engage in any of those things as a vendor nor can I imagine why one would.

Can you please provide us with a list of vendors that keep lists of customer addresses?  I think that would be impossible because as buyers we don't know who is doing this until it comes to light after the fact (i.e. BlueGiraffe)
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Wadozo on August 11, 2013, 08:18 pm
Don't know what vendors you deal with but I don't engage in any of those things as a vendor nor can I imagine why one would.

Can you please provide us with a list of vendors that keep lists of customer addresses?  I think that would be impossible because as buyers we don't know who is doing this until it comes to light after the fact (i.e. BlueGiraffe)

Hence the reason PGP (GPG) Encryption is so important when sending personal/incriminating information to a vendor/buyer. It's not guaranteed to save your neck as a vendor could potentially give up their Private Key to LE in a desperate attempt to help themselves should they get into trouble with the Law, but it's a precaution that everyone should use to minimize the potential risk involved.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Tessellated on August 11, 2013, 08:24 pm
While I agree what you post is fine advice to vendors, I see no way of enforcing much of that.

Making unenforcible rules did not work very well with drug laws, I doubt it will work here.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: HighStandards on August 11, 2013, 09:16 pm
I think this is why you need to read your vendors profile.   They should address enough of those issues as to not incriminate themselves, while giving you some reassurance.   

Example- You order weed, and it shows up just stuffed into a envelope in a regular baggie.   You then read on the vendor's profile - "i ship my weed in shitty plastic bags",  whose fault is it you are unhappy?   Im not trying to be a asshole. 
 
 I just think this is risky enough you should not order from someone who does not appear professional.  And have strict protocol.  After that it requires a little faith/ trust i guess.   

I hope im not just ranting.  Thx
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: HarmReduction on August 11, 2013, 09:21 pm
Every day I read new shit about vendors on SR being unbelievable insecure and stupid.

*Vendors use tor2web.com

Tor2web.com has been disabled
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: ondine on August 11, 2013, 10:31 pm
Let's be realistic for a second.

There are theoretically quite a few security holes in Silkroad, and there are plenty of vendors that use less than safe methods of shipping and communication. But this has been going on for over 3 years, and besides that arrest in Australia (that I'm not even convinced was directly traceable to Silkroad), I'm not aware of any serious legal problems resulting from SR.

The truth is, only local law enforcement will harass small time buyers, and local law enforcement does not have the ability to catch people through Tor. Those that buy and sell very large amounts are in danger from the federal government, but honestly, if they get caught, it will be because they're also selling large amounts of drugs in real life.

I'm not going to say that we shouldn't always be trying to beef up security, but at this point, it's mostly fear mongering.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: BenJesuit on August 11, 2013, 10:41 pm
@ OP,

leave SR now. You've probably just scratched the surface of potential issues.

The first thing you have to understand about SR is that it's anonymous. There is no way to enforce anything you listed. None. If you come up with something, someone will come up with a way around it. You're not comfortable with the level of risk inherent in an anonymous marketplace. Source your DOC on your own.

And it's not "liberal" it's "libertarian." There's a world of difference between the two.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: boosties on August 11, 2013, 10:50 pm
@ OP,

leave SR now. You've probably just scratched the surface of potential issues.

The first thing you have to understand about SR is that it's anonymous. There is no way to enforce anything you listed. None. If you come up with something, someone will come up with a way around it. You're not comfortable with the level of risk inherent in an anonymous marketplace. Source your DOC on your own.

And it's not "liberal" it's "libertarian." There's a world of difference between the two.
Exactly! totally agree! no one is guaranteeing your safety or anything else on here. It is up to you
as a consumer to stay informed and up to date to keep yourself safe! it is still illegal
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: ondine on August 11, 2013, 10:53 pm
@ OP,

leave SR now. You've probably just scratched the surface of potential issues.

The first thing you have to understand about SR is that it's anonymous. There is no way to enforce anything you listed. None. If you come up with something, someone will come up with a way around it. You're not comfortable with the level of risk inherent in an anonymous marketplace. Source your DOC on your own.

And it's not "liberal" it's "libertarian." There's a world of difference between the two.
Exactly! totally agree! no one is guaranteeing your safety or anything else on here. It is up to you
as a consumer to stay informed and up to date to keep yourself safe! it is still illegal

He's very worried about maintaining the freedom that we all have here, but if you're obsessing about security this much, then you're not really free, are you...?
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: boosties on August 11, 2013, 10:57 pm
YOU and YOU ALONE can cover your own ass.... noones gonna do it for you! and i wouldnt trust it if they did
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Wadozo on August 11, 2013, 11:03 pm
Let's be realistic for a second.

There are theoretically quite a few security holes in Silkroad, and there are plenty of vendors that use less than safe methods of shipping and communication. But this has been going on for over 3 years, and besides that arrest in Australia (that I'm not even convinced was directly traceable to Silkroad), I'm not aware of any serious legal problems resulting from SR.

The truth is, only local law enforcement will harass small time buyers, and local law enforcement does not have the ability to catch people through Tor. Those that buy and sell very large amounts are in danger from the federal government, but honestly, if they get caught, it will be because they're also selling large amounts of drugs in real life.

I'm not going to say that we shouldn't always be trying to beef up security, but at this point, it's mostly fear mongering.

Quote
   There are theoretically quite a few security holes in Silkroad 

Such as ???


Quote
But this has been going on for over 3 years, and besides that arrest in Australia (that I'm not even convinced was directly traceable to Silkroad), I'm not aware of any serious legal problems resulting from SR. 

Silk Road, the website, hasn't been around for over 3 years at all. Let me assure you, Shadh1 was an SR vendor in Aus who was arrested as a direct result of his SR activities (all started with ordering many packages to his home address which were seized). He co-operated with the AFP and gave them full access to his SR vendor's account, even demonstrating how he used it. These details can be found here -

http://www.theage.com.au/victoria/trafficker-jailed-over-online-drug-supermarket-bust-20130206-2dxgu.html.

There have been a number of busts around the world related to selling on SR. One that comes to mind is MoveItNice, a Canadian vendor caught by using WU to do out of Escrow transactions. LE found more than 200grams packaged and ready to go at the local post office and over half a kilo of Coke at a home he shared with his family.
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: joolz on August 12, 2013, 12:54 am
snitching  :(
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: toke 100 on August 12, 2013, 01:28 am
previous experience is key !!  i received   a slab of hash from one of sr top vendors  over 300 transactions ! it was like a vhs tape in a paper envelope  i shit myself could not believe it made it !!  and then got fantastic stealth from a vendor with  only 56 transactions  so i cant see how it can be regulated?  and also on quite a lot of the vendor pages it says'  stealth now upgraded.or new stealth''  so it seems being pro comes with experience' my best security is to stick with vendors  that provide the service im happy with ;D 

or maybe a sr hit squad to fuck up  anyone who aint pro?  :o

would be nice though knowing that all details are auto destroyed straight away ?  lol

fuck there will be a union next. hahaha
Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: Lorimer on August 12, 2013, 09:22 am
SR provides the platform. You provide the security. Trusting SR to protect you from idiot/malicious vendors is as foolish as trusting any other unknown 3rd party site.

Dont get me wrong. I <3 DPR, but SR's security practices are out of my hands & thus not something I'd want to place bets on, esp if it involves my personal freedom. Plus isn't the OP's post an insult to the original principles of the site? SR is about individual freedoms, not collective security. Value collective security above individual liberty and you end up with the NSA.




Title: Re: SR STAFF: Important message about vendor security, huge security problems!
Post by: RxKing on August 12, 2013, 09:47 am
(and more are to come as BlueGiraffe motherfucker leaked ALL customer addresses from ALL deals he ever done to the police.)

The OP is clearly an idiot. I think even Astor would agree.

But the fact he say's the sentence I quoted above...just shows how nutty he is. This is simply a total false statement...and a lie. And this is the EXACT kind of bullshit that is spread in these forums that ruins all the credibility of the security guys. Not all of them. And not everything they say. But most of the shit they bring up is total bullshit.