Silk Road forums

So, it doesn't initially say you have to encrypt it, but that it is encrypted when you send it. Then it says that you can encrypt manually to be extra cautious. I would be pissed if I sent unencrypted after reading this to find it hadn't been encrypted, so I'm gonna encrypt it myself.

Thank you

Yes, I just saw that and suggested to DPR and the other mods/admins that maybe we expand on that and make it more clear, because I know for a fact that vendors still receive unencrypted addresses from buyers .... so my guess is that what they are saying is that it's encrypted on the server so it can't be intercepted, but that if you don't encrypt it to your vendor's key yourself, then it will show up unencrypted when they open your order (which you don't want).

It's best to encrypt it yourself so that ONLY the vendor with the correct PGP key can decrypt it.

I'll give you a recent example.  A vendor fell for a scam message and provided his password and PIN to a phishing site.  His account was then taken over by whoever ran the phishing site, and that person was able to see all of the vendor's current orders.  If any buyer had sent their shipping info WITHOUT encrypting it, then the scammer who was in control of the account would be able to see their shipping info, and that buyer would then have been compromised.

If, on the other hand, the scammer was looking at an order that the buyer had encrypted to the vendor's key, the scammer would not have been able to read / access any of the buyer's personal details because the scammer didn't possess the vendor's public and private keys - even though he was in control of the vendor's SR account.

Hope this makes sense - if you need me to clarify, let me know!

Any update on this problem, 5ofdiamonds?

I signed up a few hours ago to ask a question in the drug area. However i can not make  a new topic or reply. I can only do that here it seems. How long do i have to wait?

You need 50 posts in the Newbie subforum before you can post elsewhere.  Please feel free to create a new thread in the Newbie subforum to ask your question!

Thanks guys, All very helpful. Just one more thing: The buyers guide says that the name and address I put in the shopping cart IS encrypted. Is this automatically done by SR? and should I encrypt the name and address manually myself before I put it in the shopping cart?

Is this new?  I was totally unaware that SR encrypted order information automatically.  It has always been encouraged to encrypt your address, but when I was a vendor, addresses were only encrypted if the buyer themselves encrypted it.  I received several non-encrypted addresses on orders as well, which is why I was under the impression that it was not encrypted unless the person encrypted it themselves (And hence the emphasis on learning encryption and encrypting all of your sensitive order information).

Even if SR does encrypt it automatically, encrypting it yourself with the vendor's key is still safest because in those cases, there is no way for SR to view the info (which would be bad if it were ever compromised).

Everyone who might want to post in this thread should just keep in mind in doing so that LE reads these forums so you don't want to give away anything TOO specific about the secrets you might have for getting things shipped successfully.

When sending a vendor an encrypted message, make sure you use their public key to encrypt it.  Then when writing them an encrypted message just put your public key at the end of the message.  They only need your public key to respond with an encrypted message.

^ This.  You would use notepad or some other text editor to compose your message, and then after your message, paste your PGP key.  Then select ALL of that text (including your PGP key!) and encrypt the ENTIRE thing to the vendor's PGP key.

Then you'll have it all in a block of encrypted text which you can then copy and paste into the SR message field to send to the vendor.

Since you're encrypting it to their key, they will be able to decrypt your message even without your key (as long as you do not sign the message) ... so they'll decrypt it and then they'll be able to import your PGP key from your decrypted message.

lollerskates

+1 to you Scout

haha, thanks!

also, reading through goingpostal's vendor profile, they list their email as mjmuse@tormail.org ... which sounds awfully similar to MiMM ... lol