4 ms·

Standard OPSEC for transactions on Tor markets is to GPG encrypt all communications. If you're just a customer, you have very little risk.

curiousDog 12y ago
That still doesn't mean traffic isn't traceable right?
- duaneb 12y ago
  Yes, but if you encrypt your drug request you won't have the evidence binding you to the purchase without some kind of bitcoin trace.
  - corford 12y ago
    Surely if the feds bust the seller they'll then have access to his private key and be able to decrypt all his buyers order requests?
    - aianus 12y ago
      The sellers are supposed to delete personal information once the item has shipped. You'll have to take their word on it though.
  - MichaelGG 12y ago
    OTOH, if the encrypted request is found, and you have a key that matches, that's very strong evidence you made the request. This line of reasoning was included in the Silk Road indictment.
MichaelGG 12y ago
I was referring more to the operators of the site. LE probably isn't going to go after individual buyers all that often. But the site will have a record of Bitcoin payments made, so you can link up sellers and buyers. And most people probably don't have untraceable Bitcoin. (I tried to buy $300 of BTC anonymously, and it took hours of work, and still reveals which post office I used.)
- deleted 12y ago
  [deleted]
- math0ne 12y ago
  Cash for bitcoins are available in every major city at bitcoin meetups.
  - olefoo 12y ago
    And of course attending a black-market meetup with cash in hand is both perfectly safe and an unlikely target of surveillance by law-enforcement.
  - EGreg 12y ago
    Yeah. I am really surprised by statements like that as well as articles that "anonymity is dead" om the internet. Tell that to any pastebin. You can build any number of fake identities by using a tree of accounts, starting with services that don't track who you are (or using them to launder a tree root) and build from there. The tough part is keeping the identities from leaking, eg by stylistic analysis or other patterns. Sometimes when a network authenticates every account you have to hijack some random accounts and tunnel through that in order to communicate over that network. Like intelligence agencies texting "Pizza!" over SMS - although that was a pretty lame example.
  - MichaelGG 12y ago
    Even getting cash anonymously is dubious, at best. If I withdraw from an ATM or bank, the serial numbers are most likely recorded. (There's no technical reason they wouldn't be.) Handling the cash may leak DNA or fingerprints. After that, when I meet someone to exchange cash, that transaction links my identity as well. Making a deposit in someone's account also records my identity via video (and any other leak like fingerprints). It is prudent to assume that at every transaction, whichever adversary you're trying to remain anonymous from - assume they are the other party. And even if you assume the party is a good actor, it's not entirely out of the question that a third party could monitor things and try to correlate. It might be computationally infeasible for now, but it'd be folly to bet on that. In my experiment, I tried to get $300 into BTC. I withdrew $100 notes from the bank, then spent them at small stores to get change. (At which point I found out the bank gave me a fake note, thus losing $100.) I wore gloves during these transactions, and put the change directly into sealed bags. This is obviously super suspicious. I discovered that mailing things anonymously is also difficult. The stamp machines only accept non-cash payments. Video is recorded at all other points of sale. Priority mail appears to require larger stamps, which are custom printed. With more work, I suppose one could find a small store that sells stamp booklets without recording things. Obtaining an addressing an envelope also has information leaks. Only ~33 bits are needed to identify a specific human on earth. Geolocation alone reveals somewhere around 8 bits. Interest in Bitcoin probably reveals another 5 or so. If you're mobile and purchase in multiple cities, that could further reduce things another few bits. Before you know it, you're not that anonymous. I concluded from my experiment that most people are simply not going to be able to buy BTC and retain strong anonymity. If I was going to use BTC to perform actions critical of a government, let alone do something illegal, I would not feel overly safe. Other people seem to have a different (or missing) assessment. The best Bitcoin anonymity device I've heard of is ZeroCoin, but I haven't understood the math yet. And it's not getting any traction, it seems, and without significant traction, like Tor, it's not very anonymous.

curiousDog 12y ago

That still doesn't mean traffic isn't traceable right?

duaneb 12y ago
Yes, but if you encrypt your drug request you won't have the evidence binding you to the purchase without some kind of bitcoin trace.
- corford 12y ago
  Surely if the feds bust the seller they'll then have access to his private key and be able to decrypt all his buyers order requests?
  - aianus 12y ago
    The sellers are supposed to delete personal information once the item has shipped. You'll have to take their word on it though.
- MichaelGG 12y ago
  OTOH, if the encrypted request is found, and you have a key that matches, that's very strong evidence you made the request. This line of reasoning was included in the Silk Road indictment.

MichaelGG 12y ago

I was referring more to the operators of the site. LE probably isn't going to go after individual buyers all that often. But the site will have a record of Bitcoin payments made, so you can link up sellers and buyers. And most people probably don't have untraceable Bitcoin. (I tried to buy $300 of BTC anonymously, and it took hours of work, and still reveals which post office I used.)

deleted 12y ago
[deleted]
math0ne 12y ago
Cash for bitcoins are available in every major city at bitcoin meetups.
- olefoo 12y ago
  And of course attending a black-market meetup with cash in hand is both perfectly safe and an unlikely target of surveillance by law-enforcement.
- EGreg 12y ago
  Yeah. I am really surprised by statements like that as well as articles that "anonymity is dead" om the internet. Tell that to any pastebin. You can build any number of fake identities by using a tree of accounts, starting with services that don't track who you are (or using them to launder a tree root) and build from there. The tough part is keeping the identities from leaking, eg by stylistic analysis or other patterns. Sometimes when a network authenticates every account you have to hijack some random accounts and tunnel through that in order to communicate over that network. Like intelligence agencies texting "Pizza!" over SMS - although that was a pretty lame example.
- MichaelGG 12y ago
  Even getting cash anonymously is dubious, at best. If I withdraw from an ATM or bank, the serial numbers are most likely recorded. (There's no technical reason they wouldn't be.) Handling the cash may leak DNA or fingerprints. After that, when I meet someone to exchange cash, that transaction links my identity as well. Making a deposit in someone's account also records my identity via video (and any other leak like fingerprints). It is prudent to assume that at every transaction, whichever adversary you're trying to remain anonymous from - assume they are the other party. And even if you assume the party is a good actor, it's not entirely out of the question that a third party could monitor things and try to correlate. It might be computationally infeasible for now, but it'd be folly to bet on that. In my experiment, I tried to get $300 into BTC. I withdrew $100 notes from the bank, then spent them at small stores to get change. (At which point I found out the bank gave me a fake note, thus losing $100.) I wore gloves during these transactions, and put the change directly into sealed bags. This is obviously super suspicious. I discovered that mailing things anonymously is also difficult. The stamp machines only accept non-cash payments. Video is recorded at all other points of sale. Priority mail appears to require larger stamps, which are custom printed. With more work, I suppose one could find a small store that sells stamp booklets without recording things. Obtaining an addressing an envelope also has information leaks. Only ~33 bits are needed to identify a specific human on earth. Geolocation alone reveals somewhere around 8 bits. Interest in Bitcoin probably reveals another 5 or so. If you're mobile and purchase in multiple cities, that could further reduce things another few bits. Before you know it, you're not that anonymous. I concluded from my experiment that most people are simply not going to be able to buy BTC and retain strong anonymity. If I was going to use BTC to perform actions critical of a government, let alone do something illegal, I would not feel overly safe. Other people seem to have a different (or missing) assessment. The best Bitcoin anonymity device I've heard of is ZeroCoin, but I haven't understood the math yet. And it's not getting any traction, it seems, and without significant traction, like Tor, it's not very anonymous.