7 ms·

Darknet bazaar Incognito Market is extorting former users

53 points by kryptiskt 3y ago

4gotunameagain 3y ago
What deanonymising information for the vendors could be contained in the messages ? I get that buyers need to disclose their shipping address, but what would vendors disclose ?
- wombat-man 3y ago
  Wise users would encrypt their shipping info. I guess crypto addresses could be traced to individuals.
  - deleted 3y ago
    [deleted]
  - ClassyJacket 3y ago
    But how do you know the PGP key the market gave you is really the vendors and they didn't man-in-the-middle you?
    - wombat-man 3y ago
      True I guess, some vendors have a presence outside the market where their public key may be verified.
- michaelmrose 3y ago
  Lets speculate because this is kind of fun. Crypto addresses may be inadvertently linked to their real identity if they use the same address for anything else or regularly move crypto from another address that is itself linked to something that links back to them. They could use the platform to deal with distant people and people who at the time or later obtain enough info to rat them out. The rat bites the dust and then rolls on the dealer. An example would be a customer who later established a business relationship with the dealer. One could also use the platform as a means to exchange money instead of large stacks of dirty money. You could expose where you drop the goods and be caught on film in some fashion OR just follow the same pattern and get caught dropping later. The platform could have deliberately compromised dealers location or identity in some fashion in order to facilitate more effective blackmail.
darth_avocado 3y ago
The only way to deal with this is to not pay. There is no guarantee they’ll not ask for more in 6 months. Accept that you did something wrong and deal with the consequences
- Lockal 3y ago
  Usually the right way is a life sentence. However, in some of the most successful states (in terms of life expectancy, crime rate, economy and visa-free access), such as Japan and Singapore, the right way is the death penalty.
- suddenclarity 3y ago
  Extra so considering they are already boasting about expired data not getting deleted in the past.
- amenhotep 3y ago
  > wrong *illegal
  - quickslowdown 3y ago
    A subtle but important distinction
- michaelmrose 3y ago
  Fortunately I personally deal with this by not dealing drugs but accepting the consequences doesn't make much sense from the perspective of the drug dealers either. Lets see why. - You are potentially going to go to prison for 20 to life. - Your customers are going to go to prison likely for less than 20 to life - If you go to jail your identity will cease to be secret to all the people you helped into a cell who all got out years before you. If you own up and do the right thing the most pressing question might become are they sending my customers to the same prison and how will I protect myself from a meth head with a homemade shank made out of a sharpened plastic spork. Logically if the person runs the same scam again so long as they keep asking for amounts of money you have or can get you just keep paying. Ugly but true or you know don't deal drugs in the first place. One ill deed leads to another.
deleted 3y ago
[deleted]
trallnag 3y ago
Weird. What information could they leak? I don't know this market in particular, but around a decade ago, in the times of Silk Road 2.0, all communication between vendor and customer was encrypted according to the OpenPGP standard. Vendors shared their public key and customers where supposed to use this to encrypt their messages send via the market
- Cody-99 3y ago
  Considering the usability of PGP it wouldn't surprise me if the most users didn't use it and just entered their address. Especially since there was an 'auto encrypt' button right there. Linking bitcoin transaction info + addresses of users could easily be used as probable cause by the government to justify searches and seizing of vendor/customer devices to find other evidence.
- ipqk 3y ago
  They had an “auto-encrypt” feature which, guess what, didn’t actually encrypt it or had a back door.
xbar 3y ago
Monetization always happens.
michaelmrose 3y ago
I would be tickled if it turned out that the feds took over the market or at least its storefront and had no actual info but used this as a trick to get people to give up info.

53 points by kryptiskt 3y ago

What deanonymising information for the vendors could be contained in the messages ? I get that buyers need to disclose their shipping address, but what would vendors disclose ?

wombat-man 3y ago
Wise users would encrypt their shipping info. I guess crypto addresses could be traced to individuals.
- deleted 3y ago
  [deleted]
- ClassyJacket 3y ago
  But how do you know the PGP key the market gave you is really the vendors and they didn't man-in-the-middle you?
  - wombat-man 3y ago
    True I guess, some vendors have a presence outside the market where their public key may be verified.
michaelmrose 3y ago
Lets speculate because this is kind of fun. Crypto addresses may be inadvertently linked to their real identity if they use the same address for anything else or regularly move crypto from another address that is itself linked to something that links back to them. They could use the platform to deal with distant people and people who at the time or later obtain enough info to rat them out. The rat bites the dust and then rolls on the dealer. An example would be a customer who later established a business relationship with the dealer. One could also use the platform as a means to exchange money instead of large stacks of dirty money. You could expose where you drop the goods and be caught on film in some fashion OR just follow the same pattern and get caught dropping later. The platform could have deliberately compromised dealers location or identity in some fashion in order to facilitate more effective blackmail.

darth_avocado 3y ago

The only way to deal with this is to not pay. There is no guarantee they’ll not ask for more in 6 months. Accept that you did something wrong and deal with the consequences

Lockal 3y ago
Usually the right way is a life sentence. However, in some of the most successful states (in terms of life expectancy, crime rate, economy and visa-free access), such as Japan and Singapore, the right way is the death penalty.
suddenclarity 3y ago
Extra so considering they are already boasting about expired data not getting deleted in the past.
amenhotep 3y ago
> wrong *illegal
- quickslowdown 3y ago
  A subtle but important distinction
michaelmrose 3y ago
Fortunately I personally deal with this by not dealing drugs but accepting the consequences doesn't make much sense from the perspective of the drug dealers either. Lets see why. - You are potentially going to go to prison for 20 to life. - Your customers are going to go to prison likely for less than 20 to life - If you go to jail your identity will cease to be secret to all the people you helped into a cell who all got out years before you. If you own up and do the right thing the most pressing question might become are they sending my customers to the same prison and how will I protect myself from a meth head with a homemade shank made out of a sharpened plastic spork. Logically if the person runs the same scam again so long as they keep asking for amounts of money you have or can get you just keep paying. Ugly but true or you know don't deal drugs in the first place. One ill deed leads to another.

deleted 3y ago

[deleted]

trallnag 3y ago

Weird. What information could they leak? I don't know this market in particular, but around a decade ago, in the times of Silk Road 2.0, all communication between vendor and customer was encrypted according to the OpenPGP standard. Vendors shared their public key and customers where supposed to use this to encrypt their messages send via the market

Cody-99 3y ago
Considering the usability of PGP it wouldn't surprise me if the most users didn't use it and just entered their address. Especially since there was an 'auto encrypt' button right there. Linking bitcoin transaction info + addresses of users could easily be used as probable cause by the government to justify searches and seizing of vendor/customer devices to find other evidence.
ipqk 3y ago
They had an “auto-encrypt” feature which, guess what, didn’t actually encrypt it or had a back door.

xbar 3y ago

Monetization always happens.

michaelmrose 3y ago

I would be tickled if it turned out that the feds took over the market or at least its storefront and had no actual info but used this as a trick to get people to give up info.