Silk Road forums
Discussion => Security => Topic started by: Santander on September 26, 2012, 03:41 pm
-
PGP (or GPG in Linux land) can be frustrating to grasp for new users and we've seen vendors saying only 10% of messages they receive are encrypted as such. The case for using it is so blatantly obvious that I can't believe that I myself have failed to do so in the past.
That Tor, bitcoins and SR themselves require some degree of technical ability (and dare I say, a sensible level of intelligence) seems to successfully weed out your typical low life junkie and it'd surely be safe to say most people that use SR are at least mildly educated ;)
I make a conscious effort to make sure my security is ever evolving, I am always working on the next step to improve my privacy and anonymity.
I think the users of SR should be forced to encrypt all messages, and all vendors should be forced to display their public key (and privnote should be banned).
It is easy to validate whether a piece of text is in fact a valid PGP message or key, or whether it's some other text. If it is not validated, the SR system simply responds to the sender explaining that their message was not encrypted, was not delivered, and links to advice on how to use PGP.
SR security should also be ever evolving and I think the users have the intellect to go a step further in their security and ensure they're using encrypted messages in all communications.
Thoughts?
-
While I agree that encryption should always be used, I don't think SR should be a babysitter. customers should be able to choose if they want to buy from a dumbass vendor who doesn't use pgp, and vendors should be able to decide if they only want to do business with dumbass customers who don't know how to use encryption or if they want to deal with those of us who value their freedom, but it shouldn't be DPR's burden to force people to act in a way that they don't want to.
-
I agree with the end, but not the means. Yes, everybody should use PGP. A common and stupid misconception on here is that decrypting messages takes lots of time. If a vendor has a problem decrypting multiple messages to their public key, then they are uneducated about the use of such things as the wildcard character, and so the real problem is their ignorance of a simple terminal/command line instruction as opposed to PGP being the problem. Similarly, thinking that some messages should be encrypted, but not others, is insane, and betrays a shallow understanding of how the entire concept of encryption is supposed to work, that the larger the anonymity set, the better for us all (LE doesn't know which messages to attempt to decrypt, so even if they had a method to break messages, they fall short thanks to economics).
My intention with PGP Club isn't to reach all the buyers, but I would like to reach most of the vendors. That way they can set a good example to the buyers, who will ultimately follow suit.
I think that although we cannot force people to use PGP, we should gently bully people into using it. E.g. a message that appears on the webpage when you don't send a message encrypted with PGP, encouraging you to encrypt it with PGP instead of sending as plaintext. This is not coercion, it is a helping hand. It is at this pivot point that a user may choose to research PGP instead of assuming it is some geeky hoopla extra.
I mean, many people are simply ignorant of the reason SR offers security. They think if the FBI busts down a door somewhere and finds a bunch of SR servers, that SR will have encrypted everything somehow and that this will protect them. This is dumb on a number of levels. It also ignores the possibility that the LE agents might just monitor everything, hunting for juicy bits of info, that in fact they have no real incentive to shut down the servers. If the vendor can read your message as plaintext, then it is not encrypted. Worse yet, it implies the responsibility is on SR servers to protect you, which is the exact opposite of how SR is supposed to function. You're supposed to assume SR is literally run by the FBI and they can see everything. There should be no trust in the abilities of a human actor anywhere in the system. We should be relying on cryptographic trust instead, and the best way to do that is to use PGP to encrypt messages back and forth to vendors.
The strength of a darknet market has to be in the Network itself, not in any specific member or node in that network. This is the way forward.
If you do not use PGP, you are going to get into trouble. This is no prediction, this is a scientifically observable fact from the history of previous internet drug forum busts, which if you've studied the case studies, you'll know that they tend to have repeated patterns, again and again.
My aim, is to make not using PGP socially unacceptable. Anybody who disagrees should be viewed as a potential LE agent at worst, or an especially ignorant newblet at best. I think with the help of my excellent helpers I am half way there to achieving PGP as an institutional idea, but it will take more help and more work to install it proper in the community's ethos. The main problem is that some users don't read the forums.
Learn PGP or die.
-
pine, who are you? and how are you so incredible? self-admittedly, i only seem to find myself scouring the forums when my package is taking one or more days longer to clear customs than normal. yet, it never fails. each time i'm on here, i come across your posts in several different areas. i'm seriously SO fascinated by you. everything you write has this 'captivating' essence oozing from within the words.. sorry if i'm being too fantastical, and please excuse my lack of capitalization (it's simply the manner in which i prefer to type right now, lol.) and refrain from passing judgment on my intellectuality :-P
anyways, i'm honored at the mere fact that you might personally witness this message. know that i will follow you into the dark always.
as for PGP, i use it for my address always (self-preservation), but i do not use PGP for anything else. i will say that the main reason for this is i fear my messages will have an even lower probability of being read by the appropriate sources when encrypted, as opposed to encryption-free. it's annoying. it'd be nice if there was some sort of way around that stigma, but i think your approach is the most sound. gentle bullying/emphatically urging, etc. etc.. that's the right idea.
okay, bye :)
-
I have a question that I might as well just ask here because I don't know where else to ask it. In my early days on SR, I did not use PGP. Now I am using it every time I make an order. But I worry, does the fact that I didn't use it at one point mean that my address is now forever compromised? Like I'm going to use PGP from now on no matter what, but is there essentially no point because if LE hack in, they can get my address anyways? Or am I safe from transactions that happened a certain amount of time ago? I wish I had been smart enough to use it back then, but I'm hoping "better late than never" applies here.
-
Pine it is kind of working.
I had a wonder conversation with a potential customer, he started by sending me his key and an encrypted message. Every message was encrypted as he asked his questions and got his answers.
Then he ordered and did not encrypt his address :o
-
pine, who are you? and how are you so incredible? self-admittedly, i only seem to find myself scouring the forums when my package is taking one or more days longer to clear customs than normal. yet, it never fails. each time i'm on here, i come across your posts in several different areas. i'm seriously SO fascinated by you. everything you write has this 'captivating' essence oozing from within the words.. sorry if i'm being too fantastical, and please excuse my lack of capitalization (it's simply the manner in which i prefer to type right now, lol.) and refrain from passing judgment on my intellectuality :-P
anyways, i'm honored at the mere fact that you might personally witness this message. know that i will follow you into the dark always.
as for PGP, i use it for my address always (self-preservation), but i do not use PGP for anything else. i will say that the main reason for this is i fear my messages will have an even lower probability of being read by the appropriate sources when encrypted, as opposed to encryption-free. it's annoying. it'd be nice if there was some sort of way around that stigma, but i think your approach is the most sound. gentle bullying/emphatically urging, etc. etc.. that's the right idea.
okay, bye :)
Thank you for the compliments, but I am no special person. The majority of things I know about the darknet, I have learned here, right here, on this forum. :)
zorro pine
-
i believe that the seller's guide says that one must publish a public key on their seller page
-
I have a question that I might as well just ask here because I don't know where else to ask it. In my early days on SR, I did not use PGP. Now I am using it every time I make an order. But I worry, does the fact that I didn't use it at one point mean that my address is now forever compromised? Like I'm going to use PGP from now on no matter what, but is there essentially no point because if LE hack in, they can get my address anyways? Or am I safe from transactions that happened a certain amount of time ago? I wish I had been smart enough to use it back then, but I'm hoping "better late than never" applies here.
It is safe to send messages without GPG until it isn't. If SR properly overwrites address information, and is not malicious, then it is safe to not use GPG until the server is compromised or SR turns malicious. However you should always assume that the server is compromised and run by the feds, so it is never actually safe to not use GPG. But better late than never could apply, unless it doesn't.
-
I've been all for forcing gpg since the beginning.
But I think if it was coded into the site we would see a drop of what 75% of orders overnight?
Should have been enacted in the beginning, now its sort of too late maybe for DPR to want to force it.
But the forcing may cause a trend and even a revolution somehow, I believe the more people that understand gpg and Tor will result in bigger and bigger chunks of society that will be influenced to change it for the better.
I only raised this as an idea because it is actively used in a company I have done business with. Their message server rejects messages that are not encrypted. They introduced it gradually through various means, like initially there was automated warnings for unencrypted messages.
Then they gradually started rejecting unencrypted messages by 10%, then 20% and so on. You'd get a message back saying "you should be encrypting.. try again).
From what I saw, it worked really well. Even the senior managers are PGP experts :) Well, they know how to use it at least
-
With only a few lines of code (less than 10) pgp could be integrated into the system so that a vendor puts his pgp key into a field for it and the system auto encrypts all messages to that vendor with his pgp key before saving them into the database.
-
With only a few lines of code (less than 10) pgp could be integrated into the system so that a vendor puts his pgp key into a field for it and the system auto encrypts all messages to that vendor with his pgp key before saving them into the database.
That would be better than storing the messages in a mounted encrypted container (as I am 99.99% sure is happening now), but it is still no replacement for customers actually learning to use GPG. If the server becomes compromised in the future, newly written messages will still be vulnerable to plaintext interception. Using javascript for client side encryption in the browser would be an even better plan, but again it is no replacement for clients actually learning to use GPG and is weak to numerous attacks (plus requires javascript to be enabled).
-
Mandatory PGP will not be implemented. Silk Road is a business, and this is something we must never forget. Forcing security precautions that aren't absolutely necessary will only drive some people away. Bitcoin (or another anonymous currency) and Tor (or another anonymous network) are necessary because without them, the feds would be busting down all our doors (DPR's included. Look at the Farmer's Market). Driving people away will only hurt sales, and by extension, hurt whatever commission is gained on each sale.
I'm not sure whether or not I support mandatory PGP, but in any case it won't happen. I like the idea that SR suggests its use while someone is ordering something, maybe next to the address box:
"For maximum security, consider using PGP when sending your seller your address. More info can be found here: [links to the wiki and a forum thread]"
-
The solution lies in education, not in coercion.
I believe this is true in many areas in life, whether it's narcotics in society, or encryption here on our marketplace.
-
Mandatory PGP will not be implemented. Silk Road is a business, and this is something we must never forget. Forcing security precautions that aren't absolutely necessary will only drive some people away. Bitcoin (or another anonymous currency) and Tor (or another anonymous network) are necessary because without them, the feds would be busting down all our doors (DPR's included. Look at the Farmer's Market). Driving people away will only hurt sales, and by extension, hurt whatever commission is gained on each sale.
I'm not sure whether or not I support mandatory PGP, but in any case it won't happen. I like the idea that SR suggests its use while someone is ordering something, maybe next to the address box:
"For maximum security, consider using PGP when sending your seller your address. More info can be found here: [links to the wiki and a forum thread]"
I agree, for two reasons
A: It's not just PGP that is a security risk. There are other factors too! Factors which may require funding!
B: People learn best by making mistakes, maybe they shouldn't, but they do. So I'd prefer a consumer to do X transactions, then realize the need for PGP, than to run into a wall and give up when they realize they need to understand PGP. Not making it mandatory makes the learning curve a gentler slope.
On the other hand, I believe SR should be pushing non-coercive methods, using UI (user interface) design and behavioral psychology to tilt the balance in our favor. i.e. that prompt we mentioned, but there are also lots of other good ideas out there.
Vendors in particular, ought to be the main area of focus, maybe they should be prompted in some manner much more frequently than consumers if they aren't using PGP.
The most important thing, is that people realize this is a one-time cognitive investment and pays dividends, and secondly, that they have a civic responsibility to pass it on. This way it's not all on poor pine and guru and the other hardworking pgp helpers. We're simply security sheep dogs of a sort, we can't stop people running to the wolves. So we need to look after people but not be too paternalistic or we become a crutch. Some people think PGP Club is a paint by the numbers exercise and they are to be guided by the hand for every single thing. That is not possible, thinking like that will get you in trouble. Your first defense if an independent inquiring mind. Think of PGP Club as your secondary parachute! It makes mistakes, recoverable.
And now I return to PGP Club! I shall have to make a new thread and make synopsis of the old one. Our old thread has achieved its function admirably, but it has also been a victim of its own success by appearing too formidable to newbies due to its sheer size since almost nobody will trawl through it all.
-
You could always encourage your buyers by offering a 10% bonus for PGP encrypted orders.
-
There are two vendors in particular that I would love to place orders with, and be a very regular repeat customer of. However, neither use PGP. When contacted, both gave similar excuses (PGP caused a virus/PC broke/etc). One suggested I use privnote. I visibly cringed.
Both vendors seem to have top notch products and I genuinely would love to be a regular repeat customer, I'm sure with their current product reviews they'd receive only the best positive feedback from me... but I just can't bring myself to order when they won't use PGP. :(