Comment by sandworm101 | Hacker News Reader

Comment by sandworm101 | Hacker News Reader

Parent Full thread

The police don't know what they are doing. Trying to break the trust of darkweb users is a fool's errand. The system is built on mistrust. The big selling point of these markets is that you don't have to know anything about your dealer, and they need to know almost nothing about you. So there is no trust system to break.

The other big selling point is that these websites defeat all the violence. There are no turf wars online, at least not physical wars. No dealer can force users to buy from them exclusively. No low-level dealer in a neighborhood must pay homage to a local mob boss. All of that disappears. Any cop that thinks oldschool tactics like spreading distrust within the supply chain to instigate internal mole hunts has watched too many movies. Within Tor it is assumed that everyone is a mole. Each individual protects themselves with the tools available. Every dealer assumes at least some buyers are cops. Every buyer assumes the cops are running sting operations. The market functions nevertheless.

> The big selling point of these markets is that you don't have to know anything about your dealer, and they need to know almost nothing about you.

Huh? Sellers need a physical address. Sure, one can use the address of some senile neighbor, or that of someone on vacation, or an empty house, etc. But I bet that over 90% of buyers use their actual address. I mean, DPR did, when he bought fake ID from SR.

My thoughts exactly. People still have to provide some address to receive it, and if they are buying from a cop then when the package shows up the cops will be watching and when you grab it, you're busted.

Seems like you still need some level of trust, but please correct me if I've got it wrong.

Consider that if I know your address, I can order drugs delivered to you. Then you take the sting. I would think that this factor and the desire to catch the sellers more than the buyers motivates law enforcement to focus on disrupting the chain and tracking down sellers more than pursuing all but the highest volume buyers.

Also there is plausible deniability. "I don't know why drugs showed up to my house. Look! That's not even my name...clearly a mistake."

Sure. But they would use your name.

What if they just record you taking the package, follow you home, get a warrant based on probable cause, and search your house and find the package?

That's certainly a risk.

If you're using a market that's not compromised, you trust sellers' ratings. Sellers who were police honeypots would arguably not have high ratings. Unless, of course, police had created user bot armies.

From what I've read, you place a test order, shipped to your third-party address. Relying on tracking information, you anonymously hire someone to "steal" the package, with the contents as part of the payment. To get the rest of the payment, they need to message you anonymously, and you pay well-mixed Bitcoin. You never actually meet them again.

If that works out, you place a real order, shipped to the same address. And hire someone else anonymously to "steal" the package, and drop it somewhere for you. And then pay them anonymously, with well-mixed Bitcoin. But it's gotta be a decent payment, comparable to what they could get by selling the contents.

Too iffy for me.

define 'well-mixed Bitcoin' please?

Is there a threshold that you'd use? How do you judge whether a BTC tx is well-mixed?

Between my meatspace identity and Mirimir, which is my least ~anonymous persona, well-mixed means mixing successively by three different services: A, B and C. I mix via Tor, using Whonix VM instances, and Electrum wallets. So three Whonix/Electrum instances: X, Y and Z.

    source to X via A
    A to Y via B
    B to Z via C

Bitcoin in Whonix/Electrum instance Z is available to spend, or transfer to another VM.

For transfers among ~anonymous personas, I just mix once or twice, depending on the desired compartmentalization level.

Damn, I was brain-dead when I wrote that. Make it:

    source to X via A
    X to Y via B
    Y to Z via C

> What if they just record you taking the package, follow you home, get a warrant based on probable cause, and search your house and find the package?

What if you never opened the package before the warrant was executed? If you never opened it you can't possibly know what's in it. And if anything receiving a package from a sketchy sender and _not_ immediately opening it sounds totally reasonable.

Until they shoot your dogs and put you in cuffs...

https://en.m.wikipedia.org/wiki/Berwyn_Heights,_Maryland_may...

> Prince George's County Police later arrested two men in a drug trafficking plan involving the shipment of large parcels of marijuana to addresses of uninvolved residents. After each parcel was delivered outside the addressee's home, another individual would retrieve the drugs. Police seized six packages containing 417 pounds (189 kg) of marijuana.[9]

Yep, SOP. And the police totally blew it. If they had just contacted the mayor, they could have setup an ambush for the pickup operative.

The book "Drug Interdiction: Partnerships, Legal Principles, and Investigative Methodologies for Law Enforcement" was written by law enforcement, for law enforcement. Here is an excerpt from the section about controlled deliveries:

>The undercover agent will attempt to solicit any statements in which the suspect may admit knowledge of the parcel delivery. The key to any parcel investigation is for law enforcement to prove that the subject had knowledge of the parcel’s contents. This is critical to the prosecution of the suspect in a parcel investigation. It is virtually impossible to litigate a criminal case without proving knowledge of contents.

I'll let you draw your own conclusions. Stay safe out there.

> What if they just record you taking the package, follow you home, get a warrant based on probable cause, and search your house and find the package?

If someone sends a package to my house, my taking it into my apartment is evidence of about nothing. Why you would send it somewhere without plausible deniability—say, a PO box you only use for drugs—is beyond me.

Furthermore, they also need to demonstrate you had knowledge of the contents before opening. That's damn hard.

FYI fake names is bad OpSec; it's a great way to get a 'care package', i.e. a controlled delivery.

You have just as much plausible deniability with or without a fake name.

Yeah, the postal system is watching. So you gotta have name and address match. Some post offices won't even deliver to unknown names. And some tiny post offices know every resident, by name. I know, because I've received mail addressed to my name and the five-digit postal code. It was a very small town.

That's interesting. I've always used a fake name when conducting P2P transactions online. For instance on RedditGifts, I've always used a fake name. This backfired once when a housemate sent a very expensive chess set sent from Singapore back and the sender never got it. Other than that I've had a good experience.

That's true, somewhat. If you read the history of the SR1 takedown, you see that the FBI interviewed buyers whose packages had been intercepted by Customs. And from what I've seen, there's no indication that any of them were prosecuted.

But on the other hand, someone did have heroin sent to Brian Krebs, and planned to trigger a SWAT upon delivery.[0] It was just luck that he found out about it in advance, and filed a police report. For less clueful victims, it's still arguably a substantial risk.

https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroi...

> If you read the history of the SR1 takedown, you see that the FBI interviewed buyers whose packages had been intercepted by Customs. And from what I've seen, there's no indication that any of them were prosecuted.

At least 65 SR1 buyers are known to have been arrested: https://www.gwern.net/DNM-arrests

Wow. Great work! Thanks.

I really doubt that in a country where Swatting resulting cops killing the innocent and unarmed video game players in their house.

And, due to the anonymity of the new market, there's no benefit to busting the chain if you bust a buyer. You can't get the buyer to snitch on who their supplier is.

> My thoughts exactly. People still have to provide some address to receive it, and if they are buying from a cop then when the package shows up the cops will be watching and when you grab it, you're busted.

> Seems like you still need some level of trust, but please correct me if I've got it wrong.

Is it illegal to receive drugs if you don't know it's drugs? Is merely bringing a package into your home, without inspecting its contents, illegal?

Probably not but most people who order drugs online will probably use them at some point, it's not like the drugs will remain in a sealed box forever.

If they bust you with an unopened package, they will try to get you to admit that you ordered it. And here's where it gets tricky.

If you ordered from a police honeypot seller, they have some reason to think that you did order. So if you at first deny ordering, and later admit that you did, you've just admitted to lying to them. Penalties for that can be worse than ordering illegal drugs ;)

Denial of guilt is not considered lying. Otherwise, every contested guilty verdict would have a perjury charge attached. Just say no. Or say nothing. Or one word: lawyer.

Say nothing. I think you can stay quiet but if you talk and lie to FBI, you will be Martha Stewart. Totally unrelated to the original case and they can prove this very easily, 2 FBI agents with detailed notes vs you.

https://en.m.wikipedia.org/wiki/Berwyn_Heights,_Maryland_may...

> Sellers need a physical address.

Still only circumstantial evidence, you can order drugs to any address you want.

Besides, I highly doubt most buyers have enough activity to justify pursuing legal action.

The seller can also perform a dead drop instead of mailing the package. Although, it seems difficult to do a dead drop in a place like NYC without getting caught on camera.

That, and presumably a seller would be nervous about using a buyer-chosen dead drop, or reusing a dead drop location buyers knew about.

This is foolish.

Vendor ratings and exchange reputations absolutely matter. It is in no way a trust-less system. Vendors forego significant profit to establish these ratings.

It is a system where you must constantly guard against malicious actors - cops, exit scams, etc. - but the nash equilibrium achieved depends deeply on trust metrics. Increasing the number of malicious agents is much like increasing parasitism in ecosystems, and has dramatic effects on how the ecosystem performs.

But how could you trust the ratings at all? Amazon, with all their resources and ML prowess, is having a very difficult time with fake reviews. These sites don’t stand a chance.

An Amazon verified purchase is a cheap thing, if I'm buying that widget anyway I could imagine accepting some kickback to let the bots review it in my stead. Why not?

But a darknet market purchase? That's different. One goes through all kinds of ridiculous gyrations to prevent third parties from being included, and with good reason. Unless you think you can compromise legit user accounts, your bots would have to spend a whole lot of money on real drugs before anybody would give credence to their fake reviews.

How do these systems do “verified reviews,” and if they can, wouldn’t it be bitcoin just going back the same person?

The system is largely the same--I'm prompted to leave a review after a transaction is completed.

In the Amazon case, it's not a big deal if both me and the shady seller communicate out of band. We can use email or whatever to orchestrate the payback for a positive review, and the penalities for our scheme being compromised are low: maybe we get banned from Amazon and frowned at by our friends, who cares.

In a darknet market scenario, we rely on the market to handle our identities, and try to stay completely anonymous otherwise. So we have to use some other identity mechanism to orchestrate the kickback, which fails in two ways:

- Either it's too disconnected from the original transaction, and there's no way for me to hold the seller accountable for the Bitcoin I was promised in exchange for a positive review (aside from buying from the shady seller a second time just for the opportunity to leave a negative review).

- Or it's too connected to the original transaction. In this case, if our side scheme is uncovered it could be used as evidence against us in court. Which is a significantly scarier outcome than being banned. Although being banned also carries more weight because some sellers won't sell to accounts without positive history, so if you need to reboot your identity you might have to risk getting ripped off a few times before the larger community of sellers trusts you again.

Also, I'd stay the hell away from any seller that approached me with such an offer, they want me to participant in a scam, which tells me something about them. Why should I trust their drugs?

It's also safer than buying it off the streets (aside from dealing with gang members), there is no telling what you are buying (they probably don't know either).

While it's true that everyone mistrusts each other. Sellers are also competing with each other to offer the best products with the best prices, putting a huge amount of effort to build the best feedback ratings. A world away from gangs using extreme violence to increase turnover (you would think that factors into the priorities). I'd feel safer buying from DreamMarket than I would Ebay.

So long as 'trust' is part of the factor for purchase, then by 'Supply and Demand' - the tactic will work.

Consider that there's an incredible number of 'regular people' who might visit these sites, not super knowledgable. They might have regular jobs, regular lives.

The thought that they could be caught up in something legal, lose their jobs etc. etc. is a very material risk.

Without getting into other aspects of this issue ... the tactic they're using is actually reasonable.

Also, I'll bet their not spending a huge amount of energy on it, it probably boils down to 'keeping an eye on it'.

As far as your comments bout 'no violence' etc. - really, it'll just move elsewhere.

Anything that starts making money will be exploited very quickly by nefarious entities for nefarious means.

Reply on news.ycombinator.com