Silk Road forums
Discussion => Security => Topic started by: Heyenezz on January 20, 2012, 07:09 am
-
Buy bitcoins at https://get-bitcoin.com/.
The only personal info they require is an e-mail address, name, bitcoin address, and a scanned image of the cash deposit (which I e-mailed).
Use tormail for your e-mail address. You can sign up for one at http://jhiwjjlqpyawmpjx.onion/. Sign into Squirrel Mail Webmail when sending and receiving e-mail since it uses no javascript.
Give get-bitcoin.com a fake name, and use a bitcoin address at https://www.instawallet.org.
After the order's placed purchase the bitcoins using a cash deposit at Chase bank. Sign the deposit slip with the same fake name you gave get-bitcoin.com. Keep the receipt of the cash deposit, scan the receipt, strip all metadata from the image using the program stripper (get this program at http://www.steelbytes.com/?mid=30), then e-mail the image from your tormail account as get-bitcoin's instructions require.
Once the bitcoins are in your instawallet account, send them to a few more instawallets, and then finally to your SR bitcoin address.
You're done!
GENERAL NOTES:
----Total transaction fees will be 5% of the cash deposit.
----Bitcoins will usually be in the bitcoin address you gave them in less than 24 hours.
----Access each of the above sites using a different Tor identity. Your Tor identity is the IP address you hide behind when using the Tor network. You can change your Tor identity by clicking "Use a new identity" on the Vidalia Control Panel.
----Use a different Tor identity each time you visit a site even f you've been to that site before.
-----Use a different Tor identity for each site visit, including each and every time you visit an instawallet account.
----Use Tor to visit one and only one site at a time.
-----Never use the same Tor identity twice or for more than one site.
-
Hi thanks for that - when I try to go to https://www.instawallet.org. using TOR I get warnings that it isn't secure.
I even get warnings using IE. What is that all about - anything to worry about? Do lots here use it?
-
There's a review thread of this service here:
https://bitcointalk.org/index.php?topic=34812.0
Seems legit. No complaints anywhere. I'm about to try them out.
If you want to add an extra layer of untractability, they also accept things like Visa gift cards and money orders, which you could you buy with cash.
-
Yeah, but Get-Bitcoins sometimes takes 24 hours before you get your bitcoins. I've found an even easier, faster and more anonymous way. See my other post for details. But it's through BitInstant.com. You deposit cash at a local bank, it goes to any of 3 exchanges (Mt. Gox, TradeHill or CryptoXChange), usually within the hour, buy your bitcoins there and send them here. I guess there may be a trail from the exchanges since you need to have an account there but if you set up a fake name you should be clear. And everyone hear should have a tormail account anyway.
-
Hi thanks for that - when I try to go to https://www.instawallet.org. using TOR I get warnings that it isn't secure.
I even get warnings using IE. What is that all about - anything to worry about? Do lots here use it?
Probably because the IP address is traceable to exit nodes, which are public. I wouldn't worry so much though since the bitcoins won't be there long and it's not traceable back to you.
-
Yeah, but Get-Bitcoins sometimes takes 24 hours before you get your bitcoins. I've found an even easier, faster and more anonymous way. See my other post for details. But it's through BitInstant.com. You deposit cash at a local bank, it goes to any of 3 exchanges (Mt. Gox, TradeHill or CryptoXChange), usually within the hour, buy your bitcoins there and send them here. I guess there may be a trail from the exchanges since you need to have an account there but if you set up a fake name you should be clear. And everyone hear should have a tormail account anyway.
That's less anonymous because those exchanges require things like picture, address, bank account number, etc.
Make things more complicated doesn't always make you more anonymous.
-
Heyenezz, that's not true. You can set up a MT. Gox account with any name and a tormail email address. You make a cash deposit with no ID or signature necessary. There are no photos except for the security cameras which are at any bank. The cash goes right to Mt. Gox. You buy your bitcoins and send it straight to SR. The only weak link is that you're doing it from your computer and Mt. Gox is sometimes hard/impossible to access through Tor. I don't know if that's also true for TradeHill or CryptoXchange. And it's fast, too.
-
Heyenezz, that's not true. You can set up a MT. Gox account with any name and a tormail email address. You make a cash deposit with no ID or signature necessary. There are no photos except for the security cameras which are at any bank. The cash goes right to Mt. Gox. You buy your bitcoins and send it straight to SR. The only weak link is that you're doing it from your computer and Mt. Gox is sometimes hard/impossible to access through Tor. I don't know if that's also true for TradeHill or CryptoXchange. And it's fast, too.
Even if that's true, it's not more anonymous. I don't see why using multiple exchanges is more secure than using multiple instawallets. Also, those transaction costs add up, and there's more hassle involved in signing up for multiple exchanges. I don't need to make an account for get-bitcoin.
It's usually best to keep things simple.
Edit: I know cryptoexchange requires a photo id for exchanges over a certain quantity.
-
If you are not using a mix for your bitcoins, they are not anonymous. Using instawallet, multiple exchanges, etc. doesn't cut it. I don't understand why people think that bitcoin is an anonymous network.
-
If you are not using a mix for your bitcoins, they are not anonymous. Using instawallet, multiple exchanges, etc. doesn't cut it. I don't understand why people think that bitcoin is an anonymous network.
It's not anonymous in the sense that all transactions can be traced to bitcoin addresses.
It is nonymous in the sense that you don't have to reveal your identity by revealing the bitcoin address, and you can still use temporary bitcoin addresses. An instawallet address is not on your computer, and no IP address is traceable to you from it if you use Tor to access instawallet.
So you are anonymous if you follow the advice listed in the first post.
Edit:
SR tumbles bitcoin transactions anyway. Again, an instawallet bitcoin address can't be traced to you unless, somehow someone bothers to get video footage from the bank, use face recognition software and Internet searches to uncover your real name, then get a warrant to find out you bought bitcoins, then find out where the bitcoins where sent to, and then follow the chain of transactions.
But, how would they come to suspect you in the first place? If you're that worried, then I guess you could wear a disguise. But, let's say you didn't, and someone bothered to investigate you in the way described, in the process discovering your true identity and raising suspicion that you planned to purchase drugs on SR.
1st, how would they even know what your SR bitcoin address was?
2nd, they still don't have enough evidence to arrest you, and could at most get a search warrant, which is unlikely.
If doing this worries you, then you shouldn't use drugs. SR is about as safe as drug purchases get.
-
SR tumbles bitcoin transactions anyway. Again, an instawallet bitcoin address can't be traced to you unless, somehow someone bothers to get video footage from the bank, use face recognition software and Internet searches to uncover your real name, then get a warrant to find out you bought bitcoins, then find out where the bitcoins where sent to, and then follow the chain of transactions.
At current levels of technology, this generally isn't possible anyway. Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
-
SR tumbles bitcoin transactions anyway. Again, an instawallet bitcoin address can't be traced to you unless, somehow someone bothers to get video footage from the bank, use face recognition software and Internet searches to uncover your real name, then get a warrant to find out you bought bitcoins, then find out where the bitcoins where sent to, and then follow the chain of transactions.
At current levels of technology, this generally isn't possible anyway. Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
So you're practically anonymous then. That's encouraging.
-
It's not anonymous in the sense that all transactions can be traced to bitcoin addresses.
It is nonymous in the sense that you don't have to reveal your identity by revealing the bitcoin address, and you can still use temporary bitcoin addresses. An instawallet address is not on your computer, and no IP address is traceable to you from it if you use Tor to access instawallet.
You are for all practical purposes correct, but without a mix, you are still vulnerable to one very severe type of financial network intelligence attack. I'm going to go into neckbeard territory for a little bit so forgive me.
It's true that the physical location of BTC clients can be hidden with tor or i2p, but the transfer topology is publicly available (and it must be to prevent counterfeiting of bitcoins). This means that although anyone can tell that account A sent money to account B, nobody can tie them to actual computers or people. This also means that an attacker who runs an exchanger, tumbling service (like SR), or non-blind mix, or owns a few bitcoin nodes can do an intersection attack like this:
Buyer B buys bitcoins from exchanger E.
Buyer B sends bitcoins to tumbler T.
Buyer B gets bitcoins from tumbler T.
Buyer B sends bitcoins to vendor V.
If V and E or V and T are the same person, B is now fucked.
-
It's not anonymous in the sense that all transactions can be traced to bitcoin addresses.
It is nonymous in the sense that you don't have to reveal your identity by revealing the bitcoin address, and you can still use temporary bitcoin addresses. An instawallet address is not on your computer, and no IP address is traceable to you from it if you use Tor to access instawallet.
You are for all practical purposes correct, but without a mix, you are still vulnerable to one very severe type of financial network intelligence attack. I'm going to go into neckbeard territory for a little bit so forgive me.
It's true that the physical location of BTC clients can be hidden with tor or i2p, but the transfer topology is publicly available (and it must be to prevent counterfeiting of bitcoins). This means that although anyone can tell that account A sent money to account B, nobody can tie them to actual computers or people. This also means that an attacker who runs an exchanger, tumbling service (like SR), or non-blind mix, or owns a few bitcoin nodes can do an intersection attack like this:
Buyer B buys bitcoins from exchanger E.
Buyer B sends bitcoins to tumbler T.
Buyer B gets bitcoins from tumbler T.
Buyer B sends bitcoins to vendor V.
If V and E or V and T are the same person, B is now fucked.
This is why it's important to hide your identity during each transaction.
I figure:
1. I don't want the first transaction traced to me, which is why I use tormail, cash deposit, and Tor to access instawallet.
2. If any bitcoin transactions are traced to me, I want nothing to standup in court. With the way I've done things, even if an LEO knows I sent bitcoins and then somehow traces them to my SR account, there's still not enough evidence to convict me since the person I sent money to could have been laundering the bitcoins for drugs and perhaps sold something to me for exactly whatever he planned to deposit into SR.
So, they still couldn't prove I owned the SR bitcoin address.
-
Again, you are correct (and safer than most) but most people also do not go through all that trouble to buy bitcoins, I am confident that the majority of US-based noobs just do their own bank account -> dwolla -> mtgox -> maybe a proxy like instawallet -> sr, and those are the types of people that are vulnerable to attacks like this. The blind mix would mitigate some risks from buying bitcoins non-anonymously for them.
-
Again, you are correct (and safer than most) but most people also do not go through all that trouble to buy bitcoins, I am confident that the majority of US-based noobs just do their own bank account -> dwolla -> mtgox -> maybe a proxy like instawallet -> sr, and those are the types of people that are vulnerable to attacks like this. The blind mix would mitigate some risks from buying bitcoins non-anonymously for them.
I think it's less trouble to use a method like mine since you don't have to sign up for any on line accounts. But, a little extra hassle is worth it to me if it gives me a lot more peace of mind.
How do you purchase bitcoins?
-
Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
For a while longer, perhaps.
NextGov.com is reporting that the FBI will begin rolling out its Next Generation Identification (NGI) facial recognition service as early as this January [2012]. Once NGI is fully deployed and once each of its approximately 100 million records also includes photographs, it will become trivially easy to find and track Americans.
...
According to an FBI presentation on facial recognition and identification initiatives at a biometrics conference last year, one of the FBI’s goals for NGI is to be able to track people as they move from one location to another. Recent advancements in camera and surveillance technology over the last few years will support this goal. For example, in a National Institute of Justice presentation at the same 2010 biometrics conference, the agency discussed a new 3D binocular and camera that allows realtime facial acquisition and recognition at 1000 meters. The tool wirelessly transmits images to a server, which searches them against a photo database and identifies the photo's subject. As of 2010, these binoculars were already in field-testing with the Los Angeles Sheriff’s Department.
...
Private security cameras and the cameras already in use by police departments have also advanced. They are more capable of capturing the details and facial features necessary to support facial recognition-based searches, and the software supporting them allows photo manipulation that can improve the chances of matching a photo to a person already in the database....
However, there are countermeasures [ cvdazzle.com ] available to those unafraid of making a fashion statement.
-
Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
For a while longer, perhaps.
NextGov.com is reporting that the FBI will begin rolling out its Next Generation Identification (NGI) facial recognition service as early as this January [2012]. Once NGI is fully deployed and once each of its approximately 100 million records also includes photographs, it will become trivially easy to find and track Americans.
...
According to an FBI presentation on facial recognition and identification initiatives at a biometrics conference last year, one of the FBI’s goals for NGI is to be able to track people as they move from one location to another. Recent advancements in camera and surveillance technology over the last few years will support this goal. For example, in a National Institute of Justice presentation at the same 2010 biometrics conference, the agency discussed a new 3D binocular and camera that allows realtime facial acquisition and recognition at 1000 meters. The tool wirelessly transmits images to a server, which searches them against a photo database and identifies the photo's subject. As of 2010, these binoculars were already in field-testing with the Los Angeles Sheriff’s Department.
...
Private security cameras and the cameras already in use by police departments have also advanced. They are more capable of capturing the details and facial features necessary to support facial recognition-based searches, and the software supporting them allows photo manipulation that can improve the chances of matching a photo to a person already in the database....
However, there are countermeasures [ cvdazzle.com ] available to those unafraid of making a fashion statement.
I wouldn't make a fashion statement. I raise a lot of supsicion and unwanted attention by coming to a bank looking like that. If it ever gets to the point that face recognition is a serious concern, I'd try mailing cash or money order mailing.
-
SR tumbles bitcoin transactions anyway. Again, an instawallet bitcoin address can't be traced to you unless, somehow someone bothers to get video footage from the bank, use face recognition software and Internet searches to uncover your real name, then get a warrant to find out you bought bitcoins, then find out where the bitcoins where sent to, and then follow the chain of transactions.
At current levels of technology, this generally isn't possible anyway. Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
So you're practically anonymous then. That's encouraging.
I don't buy this unfortunately because of this logic:
> image analysis isn't sophisticated enough in 2012.
> banks and post offices will have the better kind of CCTV
> video data from CCTV can now be kept permanently because of the reducing costs per byte. Petabyte HDs on the horizon etc.
Protip: It might be true now, but it probably won't be in 2022.
As such I'm paranoid about security cameras.
-
For those of us from Europe wanting to use pre-paid debit cards, do we still have to mail them the card, or can we scan them and e-mail them the picture?
-
I don't buy this unfortunately because of this logic:
> image analysis isn't sophisticated enough in 2012.
> banks and post offices will have the better kind of CCTV
> video data from CCTV can now be kept permanently because of the reducing costs per byte. Petabyte HDs on the horizon etc.
Protip: It might be true now, but it probably won't be in 2022.
As such I'm paranoid about security cameras.
In my opinion you are very right to be paranoid. Just because security cameras alone are not enough to confirm identity doesn't mean that they can't help Law Enforcement, or make a case even more convincing. I was simply trying to make the point that if camera footage is all they have to go on, they have almost nothing to go on.
A healthy amount of paranoia can be a good thing...
-
Heyenezz, that's not true. You can set up a MT. Gox account with any name and a tormail email address. You make a cash deposit with no ID or signature necessary. There are no photos except for the security cameras which are at any bank. The cash goes right to Mt. Gox. You buy your bitcoins and send it straight to SR. The only weak link is that you're doing it from your computer and Mt. Gox is sometimes hard/impossible to access through Tor. I don't know if that's also true for TradeHill or CryptoXchange. And it's fast, too.
mtgox and cryptoxchange both require id
mtgox will lock your account at random
-
you can buy them from me through western union or moneygram(max
500$ with mg) and I will send you will have the btc in your
account within an hour of you providing me the mtcn and
information I need to pick up the money. just msg me saying how
many btc you want, we agree on a rate and then i provide you
with my info and instructions on how to send 8) plus, since i
am not doing this to make moneu, just wanna liquidate my btc, i
dont charge any fees and i even sell them LESS than the rate
listed on mtgox! 8)
-
I'm a total newbie. I spent the last several days absorbing the collective wisdom of the forum. Thanks to each of you <3! My first BTC transaction was with get-bitcoin yesterday. From this noob's perspective, the transaction was painless and fast.
1. Place order through get-bitcoin.com using one of my alternate personalities and associated tormail address.
2. Received confirmation e-mail from get-bitcoin with account number.
3. Make cash deposit at Bank of America.
4. Scanned deposit slip with name and order number hand written on it.
5. E-mail deposit slip after removing meta data.
6. Got BTC five hours later.
Now I'm trying to build up my stats, per the Wiki's instructions, by purchasing digital goods. I have 11 items in my cart. Only if I could remember the friggin' PIN! (The life of a noob.) Now I have to wait for 7 days for a PIN reset. On the bright side, this gives me time to read more about seller and their products rating.
Long Live SR and its members!!!
-
I've been soaking up knowledge from these forums for a while, and finally decided I know enough from a safety perspective to place an order or two :D
I used get-bitcoin.com the other day and I'm happy with their service. After completing their online form I received an order number and a bank account number to deposit the money into. I went down to a local bank and deposited cash into the business account at the teller, took a pic of the receipt and stripped the info, emailed the receipt to get-bitcoin, and received my coins into an instawallet in about 5 hours.
The fee was 5% and the coins were bought at an average market rate. I'd use them again for my next deposit. Thanks for everyone's input in this thread, it made things a lot easier!
-
SR tumbles bitcoin transactions anyway. Again, an instawallet bitcoin address can't be traced to you unless, somehow someone bothers to get video footage from the bank, use face recognition software and Internet searches to uncover your real name, then get a warrant to find out you bought bitcoins, then find out where the bitcoins where sent to, and then follow the chain of transactions.
At current levels of technology, this generally isn't possible anyway. Security cameras are rarely sophisticated enough to be able to display someone's face and have it actually be recognizable, and facial recognition software is not reliable or accurate enough to provide evidence that would be admissible in court.
So you're practically anonymous then. That's encouraging.
I don't buy this unfortunately because of this logic:
> image analysis isn't sophisticated enough in 2012.
> banks and post offices will have the better kind of CCTV
> video data from CCTV can now be kept permanently because of the reducing costs per byte. Petabyte HDs on the horizon etc.
Protip: It might be true now, but it probably won't be in 2022.
As such I'm paranoid about security cameras.
Never stated that anything would be permanent. Just because you're practically anonymous now doesn't mean you'll be later.
-
1. Place order through get-bitcoin.com using one of my alternate personalities and associated tormail address.
2. Received confirmation e-mail from get-bitcoin with account number.
3. Make cash deposit at Bank of America.
4. Scanned deposit slip with name and order number hand written on it.
5. E-mail deposit slip after removing meta data.
6. Got BTC five hours later.
The part that concerns me is the deposit at the bank. Here you are on camera. Any reason this is false concern?
-
1. Place order through get-bitcoin.com using one of my alternate personalities and associated tormail address.
2. Received confirmation e-mail from get-bitcoin with account number.
3. Make cash deposit at Bank of America.
4. Scanned deposit slip with name and order number hand written on it.
5. E-mail deposit slip after removing meta data.
6. Got BTC five hours later.
The part that concerns me is the deposit at the bank. Here you are on camera. Any reason this is false concern?
It's a risk, but a very small one. I can't think of a less risky way to buy drugs. Even if you had someone else fill out a money order for you then mail it using another's return address, there's still at least one other person who knows what you're doing.
You could try dying your hair, wearing colored contacts to disguise your eye color, using one specific pair of clothes only for that transaction, and wearing professional makeup to realistically disguise your skin color, and only deposit cash at a Chase branch far from your house. That effort doesn't seem worth it to me though.
-
Does obtaining a money order require you to give your name, and/or ID? If not I'd say mailing one would be safer than appearing on camera to make a deposit.
-
Does obtaining a money order require you to give your name, and/or ID? If not I'd say mailing one would be safer than appearing on camera to make a deposit.
You're on camera buying the money order.
-
Does obtaining a money order require you to give your name, and/or ID? If not I'd say mailing one would be safer than appearing on camera to make a deposit.
You're on camera buying the money order.
Yes but you can get money orders at grocery/convenience stores. These places only check their cameras if there is a robbery, and AFAIK they do not save video beyond a day or 2 (could be wrong). Banks are more likely to archive their videos for long-term storage.