Ok, first let me point out that you are misquoting me. You say:
"if you take a special interest in security as you say you do, you would have a current PGP Key up and would not have initially asked a buyer to purchase the item in question whilst sending their address unencrypted."
Please read back to my post. It clearly reads, with no edits:
"We don't have a PGP key up right now so if you don't use PGP you can go ahead and place your order without one (though I recommend that you do... c'mon, why take the risk?). I don't plan on there being a huge
rush for am item like this, but don't worry if you need a PGP key to place your order. If you confirm that you are going to place the order whenever I get a key up, I'll go ahead and take the listing down for you."
That last sentence was intended to mean, confirm that you are going to place the order when I get a key up using a PM in the forums or by a SR PM. I didn't specify that because I thought it would be understood. My mistake.
I did not quote you, thus I did not have the opportunity to misquote you, fable. Perhaps I could have phrased it better: "If you take a special interest in security as you say you do, you would have a current PGP Key up and would not have initially stated that it is okay for a potential buyer to purchase the item in question whilst sending their address unencrypted."
I should think that is more agreeable to you.
I would never request someone not use PGP; however, you would be surprised how many people DO NOT encrypt their addresses when placing orders on SR. When I was an active vendor, nearly 1/4th of our customers never encrypted their address, and some of my real life friends still do not despite my consistent pleas and warnings. I said people who do NOT use PGP can go ahead and place an order, and those who do don't have to worry about missing their opportunity as long as they notify me before their order is placed.
I am fully aware of how few people make use of PGP when placing orders on Silk Road. I am also fully aware of what you said, and feel I was correct in saying that the use of PGP was essential, especially if you were potentially going to be holding on to an address for months, which in itself would most likely break SR rules and result in you having your vending privileges revoked.
Then, after a little thought... well let me let you give these too scenarios a moment to sink in then tell me which you think would be more secure:
1. Buyer places order with address either encrypted or unencrypted. I save the address on my computer and wait out the estimated 2-3 months it will take before finally shipping, leaving only my password to safe guard the customers secure information.
2. Buyer places order with no address. I ask the buyer for his/her secure information and retain it only as long as required to ship the product.
Clearly the second scenario would be "more secure", but that does not address the fact that you would be asking someone to FE on a $2,764.00 order with nothing more than a promise to send something at some undetermined point in the future - something that may never even arrive - and presuming that they can contact you with their details at that point. If it never arrives, you claim you will offer a refund but having finalised the order the buyer would have absolutely zero comeback if you were to simply decide not to refund them. Even worse, you could receive the unit and decide not to send it at all, keeping both the miner and the BTC.
However, my reasoning was based on the assumption that since Silk Road has existed, besides the few outages and the recent DDOS attacks, securely for longer than I have ever imagined it to, it will not be going down within the foreseeable future.
If I receive an address I will save it in case I am wrong, otherwise I will ask for it when necessary.
Nobody knows what the future holds, nor for how long Silk Road will exist. Asking somebody to give you $2764.00 (and that is essentially what you're doing by requesting they FE) based on an assumption is ridiculous. "Past performance is no guarantee of future results", as they say.
In any event, I'm not here to argue with you. I'm here to state that this a bad idea for both buyer and vendor alike, and you will be compromising your identity should this be legitimate and you do end up shipping this miner out presuming you have not already narrowed the search down to well under 100 people by providing the first 7 digits of the 9 digit order number along with the order date.
In light of this you may wish to re-examine the reasoning behind your assertion that you take a special interest in security. This is not secure in the least which is one of the reasons I suspect it to be a scam - no vendor would be foolish enough to give themselves up like this, and if they are that foolish then I need say no more on the matter.
Libertas
Show Posts
