Silk Road forums

Quote from: astor on June 20, 2013, 07:15 pm

Quote from: cleansober on June 20, 2013, 06:56 pm

How many folks out there don't use this extra layer of encryption?

Surprisingly few people PGP encrypt their addresses. I've seen vendors quote numbers ranging from 50% to 95% of their customers don't encrypt their addresses, with a median probably around 80%. We have a biased view, since most SR users are not on the forum. The people who register and post on this forum are going to be more engaged and proactive about their security, and that's even more true of people who post in the Security section. Some SR users are incredibly lax with their security, using regular browsers to access SR over clearnet, through Tor in-proxies like onion.to. They probably have no security in their bitcoin practices either, sending BTC straight from exchanges (linked to their identities) to their SR addresses.

Quote

Seems conflicting information about the need to use it abounds.  Who are we attempting to evade by using PGP? NSA, FBI, or just plain cops?

Anyone who compromises the server. It would most likely be a big three letter agency, but it could be hackers who then use that information to blackmail people.

Quote

If I had the computer skill to figure it out in under two days I would not ask this question but so far even two days has not been enough for me to crack this nut.  I suppose if somehow LEO could capture everything going to SR they could put the data stream through some sort of decryption program.  But then what does SR mean above about 'fully encrypted and unreadable'? My thinking here is encrypted and I seem to have lost the key to make sense out of it all. 

It means either that the SR server uses full disk encryption, or the data is encrypted in the database. The problem is that an adversary who gains physical control of the server may be able to steal the encryption key from RAM and get access to all the data.

The way I view encrypting my address, it's like wearing a seat belt. I may not get in a car accident in the next month or the next year, but in the unlikely event that I do, having a seat belt on could be incredibly important. And it costs me nothing to wear a seat belt, so I wear one every time I'm in a car.

The SR server may not be compromised any time soon, but if it ever is, the people with plaintext addresses will be the low hanging fruit that LE will go after first, especially if they have large outstanding orders. Encrypting your address costs you almost nothing -- maybe 30 seconds of your time -- so you should encrypt your address every time.

  Sometimes, I wonder if PGP may be as counter-productive as airbags in such accidents, however.

 Isn't it possible that PGP just shifts liability?
Instead of the information being possibly retrieved on SR's server, it is now possibly retrieved from the vendor's computer as he has to save or c/p the text on his drive to decrypt. Since the vendor is at much higher risk of seizure  than SR at any point, we're just placing our bets on the vendors.  If the PGP using-customers have a file on a computer drive in which they load keys, and do not delete them, then the risk compounds.

Seems plausible.

Vendors can decrypt ciphertext entirely in RAM, the same place the plaintext will be when they view a plaintext message sent to them over SR. The difference is that when customers send a plaintext message it is in plaintext on persistent memory on the SR server, in either case it is in plaintext in the vendors RAM. Also I do not believe at all that vendors are much more likely to have their computers seized than the central SR server is be seized. Not to mention the keyword central, there are thousands of vendors but there is a single (or cluster of synchronized...) SR server. That means one thing needs to be compromised to get all addresses sent in plaintext, thousands of things need to be compromised to get all addresses that are sent encrypted. I don't understand the compounded risk of customers having vendor keys, unless you mean perhaps that it could fingerprint them as being a member of SR and working with said vendors. Regardless, that is what you use FDE and Truecrypt containers for.

Wifi signals can be traced pretty quickly? I don't think anybody has a way to get into somebodies router and then figure out the direction and distance a wifi signal is coming from, at least not to my knowledge. I have extensive experience in the internet-networking field with setting up routers for companies(in the past) and I've never heard of anything like that. I think an important key is to not linger on any one network for too long, this includes for hours at a time.

They don't even need to get into anybodies router, WiFi signals are obviously wireless and can be analyzed by anyone in the area who has an antenna. Triangulation can very precisely pinpoint where a WiFi signal is coming from. There are devices that can instantaneously pinpoint the location of all devices connecting to a certain access point.

http://www.flukenetworks.com/enterprise-network/network-testing/AirCheck-Wi-Fi-Tester

These days even local police agencies have such devices. People are constantly being busted using their neighbors WiFi in the mistaken belief that it is impossible to trace back to them. Assuming you regularly spoof your MAC address, It is very unlikely that you will be identified as the person who used a given wireless access point if you are no longer engaged in a pattern of using it by the time the police arrive. However, it is still possible to narrow in on people in such circumstances. For example, the FBI identified Petraeus's mistress despite the fact that she always used WiFi at hotels, due to the fact that her name was the only one registered at all the hotels during the time when communications were sent. This is a sort of intersection attack that could make it possible to deanonymize someone over time even if you don't get them with a live trace. However, live traces are trivial to do if you are in the area.

Quote from: kmfkewm on June 20, 2013, 08:08 am

Quote from: django on June 20, 2013, 07:59 am

i use bridges in my tails setup. very easy to do and from what i'm told its better than using a vpn.

i change mine quite regularly as well, dont know why just do.lol.

That is bad for your anonymity you should keep your bridges for as long as possible.

even for public bridges?

yes

well it is pretty well established that most of the 2c-x , 4-aco, 5-meo, 4-ho, dox etc drugs are extremely safe. I wonder how many of them have not been made illegal in New Zealand yet.

The problem with whonix & Qubes is that it will leave a trace when you'll be using it. So if you also want to use this machine for other stuff and if you are just a buyer, I'd recommend debian/ubuntu/whatever as main OS, and tails as an onion system.

Whonix or Qubes could be better - isolation is great, and really important. But they'd leave traces...

An option would be to have your whonix/qubes install in a truecrypt container...

I don't really care if my OS leaves traces, I would rather that it protects ME from being traced and therefor prevents forensics from ever even attempting to recover traces off of my thoroughly encrypted hard drive. Tails doesn't leave any forensic traces, but it also doesn't really offer the level of security I am interested in, and FDE prevents forensics recovering traces anyway. And if they bypass my FDE (covert cameras, hardware keyloggers, etc) then chances are they could monitor me if I used Tails anyway (covertly planted cameras, hardware keyloggers, etc). The only situation I can see Tails as being a big win is if you don't use persistence with it and if you live in a country where not turning over encryption keys can get you sent to prison.

Quote from: kmfkewm on June 19, 2013, 01:12 pm

My brain is also wired differently than most peoples. On the professional test I took (and even this one to some extent) my subscores varied by a good deal. On the verbal parts of the test I did exceptionally well with very superior scores (142+), but on the visuospatial parts I scored below average (80-90). When all of my subscores are averaged out my GIQ is in the above average range (111-121), but looking at any individual subscore would paint me as either a genius or an idiot.

Ezra Pound said that the hallmark of a genius is the fact that he can make connections where others cannot make them.
However the connections are not necessarily "diffused"; actually many very high IQ individuals are very intelligent for some particular things and very commonly almost the total opposite in some others. I guess this has to do with a sort of "selective filtering" intelligent people do, sort of unconsciously. Meaning that the things they think will never serve them (or at a profound level doesn't minimally interest them) they refuse practically to acknowledge, and this works out in practice in a seemingly ineptitude at understanding certain things while being very intelligent for the others.

This is the thing Conan Doyle talk about in the famous Sherlock Holmes stories, btw: Sherlock Holmes refuted to learn things that didn't interest him and was a genius in those that did. He also explained this thing fully in a story (but now I don't remember the name).

I do think that, at least to an extent, somebody who is particularly good at thinking in one way may be perceived as thinking poorly in another way due to thinking too good in the way they are good at thinking in. They might see patterns that are correct but obscure, in that a person who is good at thinking in the other way would immediately see a simpler pattern.

For example, on one IQ test I took I was presented with the following problem:

O[] is to []O as OO[] is to what? In symbols only:

O[] | []O
OO[] | ?

Now the answer that immediately comes to my mind is

O[] | []O
OO[] |[][]O

but the correct answer given was

O[] | []O
OO[] | []OO

The pattern that I see is one of binary inversion, where there is a circle in the first half there is a rectangle in the second half, where there is a rectangle in the first half there is a circle in the second half.  Apparently most people are much more likely to see reflection than inversion, but does that mean that inversion is less valid of a pattern? I believe it is possible that the reason I see inversion rather than reflection is because I solve this problem verbally:

circle, square | (circle?) square, (square?) circle
[okay, circle in the left half maps to square in the right half, and square in the left half maps to circle in the right half]

whereas most people solve it visuospatially.

Quote from: kmfkewm on June 19, 2013, 11:21 am

Although ADD and ADHD are likely greatly over diagnosed, they are indeed diseases.

some may argue that it is simply a behavioral characteristic with better alternative treatment for children then addictive stimulants, but I maybe cant't relate as I was clearly among the misdiagnosed.

Attention is something that can be measured with tests. People who score significantly below average have some disability causing them to score below average. It might not be a disease per-se, but it is a dysfunctional behavioral characteristic. Stimulants measurably increase a persons ability to maintain attention on such tests, leading to higher scores. If the score is heightened such that it falls within or above the average range, then the dysfunctional behavioral characteristic is essentially treated.