Darknet bazaar Incognito Market is extorting former users | Hacker News Reader

Darknet bazaar Incognito Market is extorting former users

infosec.exchange

53 pointskryptiskt16 comments

The only way to deal with this is to not pay. There is no guarantee they’ll not ask for more in 6 months. Accept that you did something wrong and deal with the consequences

Extra so considering they are already boasting about expired data not getting deleted in the past.

> wrong

*illegal

A subtle but important distinction

Fortunately I personally deal with this by not dealing drugs but accepting the consequences doesn't make much sense from the perspective of the drug dealers either. Lets see why.

- You are potentially going to go to prison for 20 to life.

- Your customers are going to go to prison likely for less than 20 to life

- If you go to jail your identity will cease to be secret to all the people you helped into a cell who all got out years before you.

If you own up and do the right thing the most pressing question might become are they sending my customers to the same prison and how will I protect myself from a meth head with a homemade shank made out of a sharpened plastic spork.

Logically if the person runs the same scam again so long as they keep asking for amounts of money you have or can get you just keep paying. Ugly but true or you know don't deal drugs in the first place. One ill deed leads to another.

Usually the right way is a life sentence. However, in some of the most successful states (in terms of life expectancy, crime rate, economy and visa-free access), such as Japan and Singapore, the right way is the death penalty.

Weird. What information could they leak? I don't know this market in particular, but around a decade ago, in the times of Silk Road 2.0, all communication between vendor and customer was encrypted according to the OpenPGP standard.

Vendors shared their public key and customers where supposed to use this to encrypt their messages send via the market

Considering the usability of PGP it wouldn't surprise me if the most users didn't use it and just entered their address. Especially since there was an 'auto encrypt' button right there. Linking bitcoin transaction info + addresses of users could easily be used as probable cause by the government to justify searches and seizing of vendor/customer devices to find other evidence.

They had an “auto-encrypt” feature which, guess what, didn’t actually encrypt it or had a back door.

I would be tickled if it turned out that the feds took over the market or at least its storefront and had no actual info but used this as a trick to get people to give up info.

What deanonymising information for the vendors could be contained in the messages ?

I get that buyers need to disclose their shipping address, but what would vendors disclose ?

Wise users would encrypt their shipping info.

I guess crypto addresses could be traced to individuals.

But how do you know the PGP key the market gave you is really the vendors and they didn't man-in-the-middle you?

True I guess, some vendors have a presence outside the market where their public key may be verified.

Lets speculate because this is kind of fun. Crypto addresses may be inadvertently linked to their real identity if they use the same address for anything else or regularly move crypto from another address that is itself linked to something that links back to them.

They could use the platform to deal with distant people and people who at the time or later obtain enough info to rat them out. The rat bites the dust and then rolls on the dealer. An example would be a customer who later established a business relationship with the dealer. One could also use the platform as a means to exchange money instead of large stacks of dirty money.

You could expose where you drop the goods and be caught on film in some fashion OR just follow the same pattern and get caught dropping later.

The platform could have deliberately compromised dealers location or identity in some fashion in order to facilitate more effective blackmail.

Monetization always happens.

Reply on news.ycombinator.com