Silk Road forums
Discussion => Newbie discussion => Topic started by: gn0ssos on September 20, 2013, 03:51 pm
-
Got another newbie question: How important is it to encrypt your address on SR? I'm having trouble with PGP and am curious if it is an absolute necessary measure or if I can get by without it? If PGP is absolutely necessary, is there PGP software (for Mac) that I can download and run rather than installing, like the Tor bundle? Thanks.
-
If you knew someone was going to shoot you, would you wear a bullet-proof vest, or leave it up to fate???
-
You should never trust your information with a 3rd party, ever.
For the extra few seconds it takes to encrypt your details you would be stupid not too. If you are having trouble getting to grips with PGP there are some really good threads on here where you can get help and useful information. Do not give up because it is proving to be a challenge, it's a challenge worth persevering with, possible the most important challenge of them all.
Encryption should be used for the transmission of all identifiable information.
-
While I'm able to use PGP I personally haven't bothered. AIUI, addresses are held on the SR servers and are deleted when the vendor confirms shipment, by which point the vendor will have decrypted the address to plaintext for shipping (and then, if obeying the rules, destroyed any copy of it). I feel that the extra security may be worth it for some people but for myself, purchasing personal amounts, I think it unnecessary.
-
While I'm able to use PGP I personally haven't bothered. AIUI, addresses are held on the SR servers and are deleted when the vendor confirms shipment, by which point the vendor will have decrypted the address to plaintext for shipping (and then, if obeying the rules, destroyed any copy of it). I feel that the extra security may be worth it for some people but for myself, purchasing personal amounts, I think it unnecessary.
There are other ways your information can be hacked, just because you are on SR doesn't mean you are immune to a man in the middle attack. Just look at the recent Atlantis phishing link that caught a shit load of people out, that phishing link still created an account on the real Atlantis site.
Each to their own of course but I would still recommend encrypting all identifiable information.
-
This is true. My behaviour is nowhere near as secure as it could be but it's sort of calculated against managing my own psychological difficulties. The risks I take are my own and I accept that any problems I encounter as a result are on my own head. What I do for myself is indeed not to be recommended to others.
-
I dont know why anyone who understands pgp wouldnt use it. An extra 5 seconds is totally worth my freedom.
-
Thanks for the advice. I'm working on the whole PGP thing right now. I was just on a computer I couldn't install programs to, now I'm not. Better safe than sorry...
-
thanks for the advice mate
-
Remember, you can run your pgp program off a usb drive so it's not just sitting on your computer where a keylogger or something could really make it useless.
-
I figured it all out. Using GPG Keychain Access. Anyone can feel free to send me a message if they like, I'm having fun with it now that I figured it out. It really wasn't that hard, took me less than an hour to get it sorted out.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG/MacGPG2 v2.0.20 (Darwin)
Comment: GPGTools - https://gpgtools.org
mQENBFI8jewBCADvNRkux3JBkC9gmHHBL+LmcSlqcXP9chzxtoQ4agFNj/Tjwwg+
qyGryxibN8lJJn/pxvmN1kgJybq22YbF+NquiHTosTLpMwDLaeB0mdyumjAjOTIq
n2j+lRWrW+VNGtYSbu+g5Fryx3D5rLVcsZLRMGRhqSX9m62jEKcD/DnyRJGaAvS3
l9+FJXcUGRMGnPkcoNEA3KQknvRlJbhRtkjgp5r5+oauzz1axcPGSGGZqMRurzWo
SP1wqCSMcbxYVNFQtU4m1orsduzw2Fi2mEhrw3lCKWHp+yJ883SGWO7uaQkF7vme
GQmUVDjXjQATB5W6B1O94PxoP5n1ue4xaM65ABEBAAG0JEJvYiBXaGVlbGVyIDxi
MGJ3aGVlbGVyMjRAZ21haWwuY29tPokBPQQTAQoAJwUCUjyN7AIbLwUJB4YfgAUL
CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCPNU5isvcin2tPB/0UIMl6jhLgQWx7
uIhmGx5UxrdFxJ6sIX7nxaQt5SuT4PrgqMpGeJ7KFkIcMVJ7icoE3WzQIxwQnIig
jt8Y1U+otH0+qDznA/pRKXO8RnAyNCeD7RSdufD8FaqZfWSwo775gSJTJYcMsDz6
LXChGgkHii0HjzIxOQc16vf664UvcQJ0/uVfK/pfhGouc6mMY0tEMr9HVyTSILuO
nfTWMddP6xRDAFisj0kl/Tsms/1/A5ZdjaJMCySRdpaF+yQk7FPwbh2h/tRCgvoN
3R9ozo5LgRM0pscqogRQOVqUHttiyUi8oAdDgveyVgg6l2Q3+DN+PFGB30Lr/W3U
T/PFuD6muQENBFI8jewBCAD1x+lfAAFfXL5woBSNtj7ySxjICxYTt1T67ie+xhvq
vlszpKEm6QmWFTteLsw0x95quMmLcuz9tFz3/nEj7o3bePX4R4HNi0GWczSBQeKW
wT0BmFDwwUHQGxFnZUR7ioEFvSAusitfCxDv+nHPQH8NHLWalzidBsAm+0QsfTqU
ythlosLNuqFwV+vujhevLwQfAYHqyGFcwE1GQqSdPlFW/etUtH1cVOkc1cvuMjgB
VH+RUgNFU3gy0M00dyVxXat3KYdIa7jam6pqwAOCpP7IOYSixdiCvjoM0rWkvX2P
LFy3EHBQoZR5y8O9nnGebsAlDOqRrIJeoH2dSVRK/ZdfABEBAAGJAkQEGAEKAA8F
AlI8jewCGy4FCQeGH4ABKQkQjzVOYrL3Ip/AXSAEGQEKAAYFAlI8jewACgkQTPBZ
yAYQEBYkVAf/XQ4FNtxc4PsOqRaNo63gOJi23FRWpAVLJDhbmK9nUOPzr9y1R9Xd
Ybo8XRSwOR+uPf8OzzCjIQ9sg8VkBqj0mtYUSb6NNO+wziCoJYmH5NCIo/iFa8/3
J3mWUbX6xuGsJBYQFKvdP5xqepKDE60UXPQNg2myvW95gHhTeilFLIP5cOoedyyv
BJ6FSB8Kg/pTFiOphLODNj+FaSaCVn96H0oOENB3r5JVtcwGEDUFCSRV43Ow15C/
E3/4dd3RrBQbM1mywHT9v7gLpmmlAtBfaQvFQ8kWbxj18tdGWihMcP8Z6DCK1uAd
r76y/hxoYqjw+2aT7lwB/E9Ls/e45MJdSFuGB/0VypFhcB9R+kHhhysVr6TRn157
WJ62JuBkTNalFgqugAzZJW0GyB4OfG9QfL1hFxHLzXD9lsCA8kFsA4SC+JD5Co08
HGeuy0FjU/gqQdftt+vyCxRRdyOUWnmfWO4SyS8ab04JiPH0IKBLSU4jw0IC+83I
ImOes4AZcn9AmLjA4UalNITItqfqTSGLXaLpABp4V3qXj7tuoiFPLomkqCknKbzt
eTh/EM1jqGw0GO53Jg5JolmgBbBYZXjtHTKD8n1h/sOuPtEhiwQG22+58cYSXb9B
GRezExkYnwhqeT99hPW3f0yhB94D6m3SGFEJyC17kpLwPVnZ/jJ7iFVnV9HK
=Q9ZT
-----END PGP PUBLIC KEY BLOCK-----
-
I dont know why anyone who understands pgp wouldnt use it. An extra 5 seconds is totally worth my freedom.
There was one vendor that didn't have a PGP key, I asked if he could send me a PGP key and he said it's "not possible at the moment" so I ordered my 2C-B at a more professional vendor that provides a PGP key in his profile just like anyone else. Now some clever people will maybe figure out who it is, and maybe even who I bought the 2C-B from. Because the guy still has no PGP key.
It's a total no-go for me. Why should I order from someone that does not even provide a PGP key when there are plenty of alternatives, that seem to have much better product also.
-
PLEASE TAKE THE TIME AS A VENDOR AND BUYER I WOULDNT GO WITHOUT SOME SORT OF PGP! IF NOT ITS SLOPPY AND SLOPPY WONT LAST...WE MUST PROTECT ALL SELLERS AND BUYERS AT ALL COST.
IF U NEED PGP KEY ADVICE USE THE FORMS AND ASK!
FOR NEWBIES LOOKING FOR EMAIL WITH PGP PLEASE CONSIDER CMAIL!
MESSAGE US IF YOU HAVE ANY QUESTIONS
-
I figured it all out. Using GPG Keychain Access. Anyone can feel free to send me a message if they like, I'm having fun with it now that I figured it out. It really wasn't that hard, took me less than an hour to get it sorted out.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG/MacGPG2 v2.0.20 (Darwin)
Comment: GPGTools - https://gpgtools.org
mQENBFI8jewBCADvNRkux3JBkC9gmHHBL+LmcSlqcXP9chzxtoQ4agFNj/Tjwwg+
qyGryxibN8lJJn/pxvmN1kgJybq22YbF+NquiHTosTLpMwDLaeB0mdyumjAjOTIq
n2j+lRWrW+VNGtYSbu+g5Fryx3D5rLVcsZLRMGRhqSX9m62jEKcD/DnyRJGaAvS3
l9+FJXcUGRMGnPkcoNEA3KQknvRlJbhRtkjgp5r5+oauzz1axcPGSGGZqMRurzWo
SP1wqCSMcbxYVNFQtU4m1orsduzw2Fi2mEhrw3lCKWHp+yJ883SGWO7uaQkF7vme
GQmUVDjXjQATB5W6B1O94PxoP5n1ue4xaM65ABEBAAG0JEJvYiBXaGVlbGVyIDxi
MGJ3aGVlbGVyMjRAZ21haWwuY29tPokBPQQTAQoAJwUCUjyN7AIbLwUJB4YfgAUL
CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCPNU5isvcin2tPB/0UIMl6jhLgQWx7
uIhmGx5UxrdFxJ6sIX7nxaQt5SuT4PrgqMpGeJ7KFkIcMVJ7icoE3WzQIxwQnIig
jt8Y1U+otH0+qDznA/pRKXO8RnAyNCeD7RSdufD8FaqZfWSwo775gSJTJYcMsDz6
LXChGgkHii0HjzIxOQc16vf664UvcQJ0/uVfK/pfhGouc6mMY0tEMr9HVyTSILuO
nfTWMddP6xRDAFisj0kl/Tsms/1/A5ZdjaJMCySRdpaF+yQk7FPwbh2h/tRCgvoN
3R9ozo5LgRM0pscqogRQOVqUHttiyUi8oAdDgveyVgg6l2Q3+DN+PFGB30Lr/W3U
T/PFuD6muQENBFI8jewBCAD1x+lfAAFfXL5woBSNtj7ySxjICxYTt1T67ie+xhvq
vlszpKEm6QmWFTteLsw0x95quMmLcuz9tFz3/nEj7o3bePX4R4HNi0GWczSBQeKW
wT0BmFDwwUHQGxFnZUR7ioEFvSAusitfCxDv+nHPQH8NHLWalzidBsAm+0QsfTqU
ythlosLNuqFwV+vujhevLwQfAYHqyGFcwE1GQqSdPlFW/etUtH1cVOkc1cvuMjgB
VH+RUgNFU3gy0M00dyVxXat3KYdIa7jam6pqwAOCpP7IOYSixdiCvjoM0rWkvX2P
LFy3EHBQoZR5y8O9nnGebsAlDOqRrIJeoH2dSVRK/ZdfABEBAAGJAkQEGAEKAA8F
AlI8jewCGy4FCQeGH4ABKQkQjzVOYrL3Ip/AXSAEGQEKAAYFAlI8jewACgkQTPBZ
yAYQEBYkVAf/XQ4FNtxc4PsOqRaNo63gOJi23FRWpAVLJDhbmK9nUOPzr9y1R9Xd
Ybo8XRSwOR+uPf8OzzCjIQ9sg8VkBqj0mtYUSb6NNO+wziCoJYmH5NCIo/iFa8/3
J3mWUbX6xuGsJBYQFKvdP5xqepKDE60UXPQNg2myvW95gHhTeilFLIP5cOoedyyv
BJ6FSB8Kg/pTFiOphLODNj+FaSaCVn96H0oOENB3r5JVtcwGEDUFCSRV43Ow15C/
E3/4dd3RrBQbM1mywHT9v7gLpmmlAtBfaQvFQ8kWbxj18tdGWihMcP8Z6DCK1uAd
r76y/hxoYqjw+2aT7lwB/E9Ls/e45MJdSFuGB/0VypFhcB9R+kHhhysVr6TRn157
WJ62JuBkTNalFgqugAzZJW0GyB4OfG9QfL1hFxHLzXD9lsCA8kFsA4SC+JD5Co08
HGeuy0FjU/gqQdftt+vyCxRRdyOUWnmfWO4SyS8ab04JiPH0IKBLSU4jw0IC+83I
ImOes4AZcn9AmLjA4UalNITItqfqTSGLXaLpABp4V3qXj7tuoiFPLomkqCknKbzt
eTh/EM1jqGw0GO53Jg5JolmgBbBYZXjtHTKD8n1h/sOuPtEhiwQG22+58cYSXb9B
GRezExkYnwhqeT99hPW3f0yhB94D6m3SGFEJyC17kpLwPVnZ/jJ7iFVnV9HK
=Q9ZT
-----END PGP PUBLIC KEY BLOCK-----
Good work mate, next project for you is how to spoof your mac address and set up VM isolation on your computer using Virtual Box ;) I'm being serious by the way.
-
I'm struggling to find an easy to use PGP for mac.Any ideas?
-
I'm struggling to find an easy to use PGP for mac.Any ideas?
https://gpgtools.org/
-
Good work mate, next project for you is how to spoof your mac address and set up VM isolation on your computer using Virtual Box ;) I'm being serious by the way.
Any more info on this? I've got PGP down, and now I want to step in up another notch.
-
Good work mate, next project for you is how to spoof your mac address and set up VM isolation on your computer using Virtual Box ;) I'm being serious by the way.
Any more info on this? I've got PGP down, and now I want to step in up another notch.
Spoofing your mac address on a mac is very easy, you just need to open the terminal box and type in some commands, a quick google search with provide you with the step by step instructions.
Re VM isolation I can highly recommend Whonix, very easy to set up and use and really takes your online security to the next level.
-
Great thanks for that advice!
-
First, always use PGP. If you're having trouble, it might be a good time to consider TAILS. The PGP applet is easy and straight forward.
-
Encrypting your address is absolutely necessary, it protects you and the vendor.
-
The more encrypted the better.. Tor might be monitored by the FEDs, who try to look for a pattern. and the more data they have the easier it becomes.
-
Wait. I was under the impression when an item is ordered from the vendor order page the address entered in the text box was somewhat secure because it is deleted when the vendor closes the page.
If this is the case why is there not a message/banner on the order page where additional information can be added re minding use of encryption?
I swear I just read that it is when messaging via - click vendor, click message that encryption should be used... but now as I think about risk..
Most vendor are using professional looking labels, these generated by a computer are likely to stay there... ugh my head hurts
So encrypt the address we provide on the order page , why isn't said that way. I know it probably is .. great! I don't hear well and now I can t see.
-
using pgp not only add a layer of protection for yourself- but it also says that you are serious about staying safe - i wont do business with anyone is not also serious about safety- its not that difficult- also here is a link to the whonix stuff that was menioned- this is about using a usb- but a search on the main forums reveals a ton of info- also astor and pine have made some great posts about security precautions
-
sorry forgot the link- be safe
http://dkn255hz262ypmii.onion/index.php?topic=209572.msg1518826#msg1518826
-
using pgp not only add a layer of protection for yourself- but it also says that you are serious about staying safe - i wont do business with anyone is not also serious about safety- its not that difficult- also here is a link to the whonix stuff that was menioned- this is about using a usb- but a search on the main forums reveals a ton of info- also astor and pine have made some great posts about security precautions
Bazille's tutorial is excellent but I suspect it might frighten a few people off, especially those who may not be very tech savvy. Just setting up Whonix hosted on Virtual Box is actually very straightforward and does not require a huge amount of computer knowledge and know how. Obviously if you want a high level of security it is worth the time and effort to get your head around what is required and make it happen. If however you just want to step up your security to something a lot more robust than just using the Tor Browser Bundle you might want to consider Whonix by itself, check out their website (clearnet)
https://www.whonix.org/wiki/Main_Page
You can still save the VM's on encrypted media like an SD card or USB so that they are not saved on your machine.
-
Wait. I was under the impression when an item is ordered from the vendor order page the address entered in the text box was somewhat secure because it is deleted when the vendor closes the page.
I was under a similar impression:
You and you alone will have your client's shipping address. This information must be destroyed as soon as it is used to label their package. When you click "confirm shipment," the address will be deleted forever and irretrievable.
-
Thanks again to everyone for the advice! Samesame, I will certainly look into the added security that you've suggested. You can never be too safe!
-
yes
-
Encrypting ones address is absolutely necessary. I don't deal with Vendors who don't offer encryption keys for me to do so. It shows a lack of commitment to security.
-
Well done for getting it working :)
PGP is essential to me. I've never placed an order with a vendor who doesn't use PGP, even if they were significantly cheaper than competitors. Security is paramount.
Peace,
Sugarleaf
-
Lately in searching through vendors, I go read their whole page and there is no key posted. I of course am disappointed and search on. Is the message here not only to always encrypt our info but to NEVER use a vendor that won't provide their public key?
Thanks!
-
It should always matter. Even just buying small personal amounts you should still encrypt your address, and If you want more anonymous security in the physical world, You'd get it sent to a dead drop and not your home address.
-
Lately in searching through vendors, I go read their whole page and there is no key posted. I of course am disappointed and search on. Is the message here not only to always encrypt our info but to NEVER use a vendor that won't provide their public key?
Thanks!
That's a choice you have to make.
I personally won't use anyone too lazy that they cant spend 10 minutes to learn pgp ... if they're too lazy with something as important as this, what other things are they lazy with?
-
There was one vendor that didn't have a PGP key, I asked if he could send me a PGP key and he said it's "not possible at the moment" so I ordered my 2C-B at a more professional vendor that provides a PGP key in his profile just like anyone else. Now some clever people will maybe figure out who it is, and maybe even who I bought the 2C-B from. Because the guy still has no PGP key.
It's a total no-go for me. Why should I order from someone that does not even provide a PGP key when there are plenty of alternatives, that seem to have much better product also.
I would do the same. Even ignoring the importance of PGP, it is a sure sign that the vendor is too unprofessional to be in such a sensitive, dangerous business so I wouldn't trust them with my details or money.
-
YES!!
imagine if a vendors account were compromised and your address was sitting there in plain view
i will not use vendors who do not use PGP. even vendors who do use it but allow unencrypted info as sensitive as ones address are treading on thin ice.
-
No its not absolutely necessary, some use privnote others just flat text and trust the vendors.
Personally We would anyways encourage and use encryption AT LEAST for addresses.
-
privnote is not used by many vendors. stick with pgp encryption. while as one poster said, encryption is NOT necessary, but neither is birth control or condoms. USE encryption. don't use clear text. it's stupid to do so. period.
-
No its not absolutely necessary, some use privnote others just flat text and trust the vendors.
Personally We would anyways encourage and use encryption AT LEAST for addresses.
I think I would trust you, MachineElves :)
BTW, I've just read the very informative usage recommendations on your vendor page. Am I wrong in thinking the middle of Step 6 should read, "… repeat step 5 …"?