Some privacy advice

[cubesquare]

Hi there.

I was putting this together as a response to someones status - turns out I write too much and it couldn't go there.
I'd appreciate any views on this as this is how I feel we can be safe as buyers.

Ok, so here are some things you can and should do.
1. Get familiar with TOR.
Install the TOR Browser, NEVER browse anywhere from other browsers. All Darknet related stuff muct be done from the TOR browser.
Do not connect to services that know you (Gmail, reddit, Facebook etc) via TOR, especially at the same time as browsing dark net material.
Always use a new private window for every new site - don't make use of tabs, you do not want some accidental cross tab leaks to happen.
2. Get familiar with PGP.
Install a PGP/GPG keyviewer, create a private/public key for yourself and NEVER send anything to someone if it contains personally identifiable info.
When you create your key - you do NOT need to have an email address in the key, do not put real names in the key. If you are using multiple markets, good idea to create a key per market, name them accordingly "HairyPoppins-BreakingBad" as an example. This way not only can vendors be sure which key to use, but disabling a key for a market that gets busted is very simple.
3. Plausible deniability is always something to keep on top of.
Just because you received a package in the post, doesn't mean you ordered it.
You should use your real name ofr addressing, otherwise postal services may decide you don't reside there and your package ends up waylaid/lost/inspected. Rather put your initial and surname (remember you are encrypting this) and then when you receive it, wait a few days before opening it. That way if someone does come to knock your door down, the item has not been opened and you can claim ignorance.
4. NEVER be in a hurry. Vendors do not ship to a tight schedule. They try to ship via different post offices, at different times, different days from your order. All of that is so that they can make it tricky for Law Enforcement to pin them to a particular transaction. If you need something fast, find a local street vendor, otherwise be patient, order early and relax.
5. Use XMR (Monero) to buy stuff, do not use Bitcoin.
XMR is untraceable, Bitcoin is traceable. Do not use BTC.
Run a local node for XMR, that way no transactions are ever exposed to the outside world.
Buy BTC using your FIAT (USD/GBP/AUD whatever) and send those BTC to a private BTC wallet on your machine. The use the services of anonymous traders like changenow.io to trade your BTC for XMR. DO THE TRADE INSIDE TOR BROWSER!
That way your XMR is 100% unlinkable to you. Good for you, good for the vendor, good for the market.
6. Be prepared.
Nothing will ever 100% guarantee that LE won't come knocking. So keep your stash secret, keep it safe. Find a hiding spot that won't be easily uncovered in a light search and put your goods there. If you are needing more than a light stash space, you are needing much more advice than this little write up.
7. If you are so inclined, consider getting a micro computer like a raspberry pi or something and running a Linux Privacy OS on it. Something like Tails which deletes all data every time it is restarted so leaves no incriminating evidence behind. Or something like Kodachi that allows you to filter all TCP sessions and encrypt all files/folders etc. You can run your XMR wallet on these platforms.

Anyway, that is a small selection of top priority things.

As with most things privacy related, if you don't TRY, you are definitely exposed.

 

[KokosDreams]

Great advise!

I'd add: work alone or in a team as small as possible

To point number 6 I would add: rather get a lawyer upfront instead of when it is too late.

Oh yeah right: And smartphones..never use them for something illegal. If illegal stuff needs to be researched online, do it in a way that can't be traced back to you.

 

[cubesquare]

I think this is extremely valuable advice. Do everything via TOR browser, using disposable OS etc, keep nothing local. A very handy trick is to run a raspberry pi in the ceiling, running Tails, connected to a light switch or a remote control somewhere. Turn the light switch off and your history etc is all gone. Use onionmail/oniondrive or something to store very small volume backup details if you need to remember things, and make sure to encrypt all of those items.
Keep a copy of your PGP key at someone you trusts home, someone not related to anything.
That way you can rebuild from the pgp key held by your friend and the encrypted data held in onionmail/oniondrive. Remember to encrypt everything you store so that the service cannot access your stuff.

 

[KokosDreams]

That is actually an incredibly crazy idea! Next level stuff
Also very good I think having an OpSec Sub-Forum (not a group) would be a great addition to the forum

 

[cubesquare]

Glad you like the idea Simple remote esktop connection and everything is there for you.
There is some opsec support stuff - I will have a look tomorrow

 

[KokosDreams]

That's some next level stuff for a super villain home haha
A hidden laboratory in the basement that is not showing on the construction plans of the house and you're set for life
There's a sub forum for Internet technologies, Data encryption, Cryptocurrencies and Legal section that do contain OpSec advice

 

[HairyPoppins]

Great write-up! This is what I was looking for.

 

[GOUPIL]

i read all of your advices and i have to admit that's quite good !
Thank you for helping the community !

 

[diogenes]

Great advice. The only thing I disagree with is using your real name. The postman does not care if something comes to an old tenant in your house or your distant cousin has ordered something to your address. If the address is correct it will be delivered. And if not, and you lose something, it is still better than trying to explain to a judge that it was not you who ordered the staff. If it is not in your name and you have some plausible explanation when questioned who that (fake) person ie. your imaginary friend, they would probably have difficulty to obtain a search warrant in your home.

Kokos mentions alone or in a small group, which is absolutely true. And never talk/boast of your chemistry successes unless it is someone who is also involved in such activitie, very close to you and you absolutely trust. The hidden base in a remote location e.g. a holiday home somewhere if you can afford one would be best. In your home it would only work if you live alone and would have to be underground somewhere at the back of your garden, otherwise dogs could in theory sniff chemicals and it could be discovered.

 

[GOUPIL]

I would like to add something :
You can do your best to have the best opsec. Using Qubes-whonix, disable javascript, never use the same password etc...

You can always get caught if you don't use a drop and if your vendor have a bad stealth knowledge.
The vendor are always the first risk factor. Choose them wisely.

 

[diogenes]

Would mind sharing if you have some experience with such suppliers? Mined did use methods, but many times it was sheer luck that the content was not discovered. PM is also OK if you wouldn`t like to expose them. Especially their proper stealth which would beat the purpose of kreative stealth...

 

[frosty]

Great!

 

[Red Envelope]

This is a great write-up. I was already thinking about a Raspberry Pi or something similar solution.

 

[cubesquare]

Tails on Pi doesn't work, I sadly never could find a work around for that. So just run something like Parrot OS.
This ends up being an exercise for people who like to stuff around with tech, not an easy platform for someone who is not familiar... (Raspberry Pi is very low, low resource)

 

[SasquatchMonero]

You can even run a Monero node on your android phone. Search the internet for it, there are a few github links. Enable tor-address for your monero node on your phone, and then you can connect to your own monero node over tor using feather wallet inside WhonixOS or something like that.

 

[SasquatchMonero]

I would argue against touching btc at-all. Never use btc, not even for "exchanging" it to XMR. Btc is horribly traceable, and with its current transaction costs, it is prohibitively expensive (not to mention it is slow as fuck).

Just buy Monero directly from your local monero dealer on LocalMonero and use Monero that way.

 

[KokosDreams]

Having XMR implemented in all DNMs would make the DN more secure as a whole.
It is difficult to try to grow a business fast AND secure in an environment that is not promoting safe use of the DN.

It would be easy to make PGP & XMR mandatory

 

[SasquatchMonero]

The only safe DNMs are the ones that are XMR-only. These are the ones that manage to operate for years and then "retire" whenever they want, instead of getting busted and sent to the "pound me in the ass prison."

Tbh, any DNM that still works with btc is a honeypot imo.

 

[KokosDreams]

That's some strong words. I'd like to hear your thoughts on specific names. We could continue this public or in your DMs if you like

 

[SasquatchMonero]

>According to the court document, investigators obtained a digital copy of the servers behind the domains and also made an undercover purchase from the marketplace, both taking place around May 2020.

>Tracking the Bitcoin transaction used to make the purchase led the investigators to a wallet that had received 989 Bitcoin between August 2017 and October 2021.

http://tortimeswqlzti2aqbjoieisne4ubyuoeiiugel2layyudcfrwln76qd.onion/post/ssndob-marketplace-admin-pleads-guilty

If it acts like a honeypot, then is it a honeypot?

 

[cubesquare]

Not everyone has access to a Local Monero like service sadly, so you have to allow for methods to get the XMR safely.