Everyone on obfuscating their persona with Tor and bitcoins, still had to enter their postal addresses on the website, to receive the goodies.
That database must be a wet dream for law enforcement.
Because obviously people buying a few pills of ecstasy or a tab of LSD are a serious danger to society and should be taken of the streets. /s
Because obviously it's impossible to express that one party might have viewed an outcome as favorable without agreeing with that view. /s
Calling out a commentor's statement about the police's state of mind at concluding what was undoubtedly a large project for their department doesn't effectively work as a launchpad into a critique of those responsible for the law when done through terse sarcasm that seems to target the wrong responsible parties.
You don't need a address to send mail - sellers.
Personal use can be huge amounts - buyers
I can't see many dealers using dark markets above plausible personal use amounts since you get caught importing dealable quantities you are screwed, dark market or not (And the mail system will get a % of buyers). You might have a $1000 per week habit or be a $1000 per week dealer. Who's to say?
Sometimes the state apparatus is precisely the one committing the most heinous crimes. (with impunity!)
> https://en.wikipedia.org/wiki/Allegations_of_CIA_drug_traffi...
(I have never used drugs, other then alcohol.)
I know that caffeine was a bit of competition for alcohol in the period right after it was introduced (some think that enlightenment was caused by this), but I don't think it's like that anymore.
I'm pro legalization for all drugs, but but I'm not going to dispute the fact that booze, cocaine, and heroin are just like cannabis, caffeine and nicotine because it just isn't true. If you don't acknowledge the reality of people's experience when making your semantic arguments then people are going to ignore you.
https://www.ama.org/publications/MarketingNews/Pages/feeding...
here's some BS from the AMA, though.
(Yes, I realize legalizing local drug production and distribution would undercut the market, which is one reason why I am for legalization. But that does not excuse supporting the current cartels.)
You could also order kilograms there.
Obviously.
So law enforcement has lots of encrypted text along with some clear text from users not informed enough to follow any kind of opsec.
The size of the grid makes encryption work.
I really wonder if this happened at all
Furthermore, in order to lower the risk of anyone detecting this here's something the LEO could do:
1. They seize control of the servers.
2. They make note of who is an existing user and keep serving them the real PGP keys of other pre-existing users.
3. For anyone who registers after the point in time where LEO controls the servers, replace the PGP keys of sellers and also the keys of these new users with MITM key pairs.
Then when they run the site for a month as they did and they have the influx of users they got from AlphaBay, they will have plenty of evidence on all of the sellers that are active during that period of time due to there being so many new users all of whom you are MITMing, regardless of whether the sellers are new or old because the old sellers are also being MITMed in all exchanges they have with new users.
The sellers were the primary target of interest, so the LEO got what they wanted.
All of what I said is just something they could have done though. Not saying that it's what they actually did.
Of course, I know nothing and have just heard of either of those sites this morning.
Only send messages to vendors with known "trusted" keys and don't trust new keys? So in general, use a trusted channel for key exchange separate from the communication channel so that a MITM needs to control both channels?
Yes, this is how PGP verification is supposed to take place.
Someone sends you their public key, and then you meet them in person to verify it.
Of course, nothing stops the government from sending an agent to meet you, but it does raise the effort required to MITM substantially.
In short, I doubt the police did this kind of thing because they risked blowing their cover for the sake of getting some buyers' addresses.
Also, these sites tend to have a big button labelled 'encrypt my message' - which ostensibly does all the PGP for you. I'd guess that most people are lazy and just press this instead of running PGP/GPG manually. It would be trivial for the police to capture the unencrypted messages just by subverting the auto-PGP.
Dutch Police released a statement claiming as much http://politiepcvh42eav.onion/hansafaq.html
PS. OpenBazaar seems to have received $3M funding. Interesting about change for a project started by Amir Taaki given his very anarchist professions.
PPS. Desktop client seems a bad thing to develop first (in the true tradition of Bitcoin!). Perhaps you guys could have stuck with network client daemon + API for starters. Anyway, good luck.
Maybe this was done on a case-by-case basis or Grams updated their keys to the new LE keys.
I thought this excerpt was interesting:
"The sale of small quantities of cannabis in coffeeshops is therefore technically an offence, but prosecution proceedings are only instituted if the operator or owner of the shop does not meet the criteria issued by the Prosecutor General:
no more than five grams per person may be sold in any one transaction and the coffeeshop is not allowed to keep more than 500 grams of cannabis in stock;
no hard drugs may be sold; drugs may not be advertised; the coffee shop must not cause any nuisance;
they are not allowed to sell alcoholic beverages; no drugs may be sold to minors (under the age of 18), nor may minors be admitted to the premises."
Could an implicated dealer use the legal defense that they were operating a coffee shop online? (Provided that they didn't sell > 5 grams of cannabis)
[1] http://www.emcdda.europa.eu//html.cfm//index5174EN.html?#
Also, it's also pretty much at the whim of the public prosecutor whether to close coffeeshops for not upholding the unrealistic 500 gram limit (for the amount of shops in densely populated areas other than Amsterdam).
https://krebsonsecurity.com/2017/07/exclusive-dutch-cops-on-...
"H: Yes, we called them “AlphaBay refugees.” It wasn’t the technical challenge that caused problems. Because this was a police operation, we wanted to keep up with the orders to see if there were any large amounts [of drugs] being ordered to one place, [so that] we could share information with our law enforcement partners internationally."
edit: I knew I saw something about this somewhere earlier today. Still, this proves nothing because it's source less.
https://www.politie.nl/en/news/2017/july/20/underground-hans... "Some 10,000 foreign addresses of Hansa Market buyers were passed on to Europol"
Not exactly, these sites allow you to encrypt your address with the seller's public key. Of course it's possible that the site performs a man in the middle attack, but you could test for this. The big problem is that many users do not take advantage of the encryption features and send their address in clear text.
Regardless, there is inherent risk. Even with perfect encryption, as a buyer, you still have to trust a drug dealer with your mailing address. And there's no way to tell for sure that the seller isn't LE.
Then he'd track how long the package took, whether or not it was delivered normally by the postal service and even then wait a week or so and get it in the middle of the night. Nowadays they apparently just use drones instead to deliver stuff.