Hacker News Reader

Comment by asveikau | Hacker News Reader

> when you encrypt your address to the seller's public key, and send the encrypted address rather than the plaintext address, now all the FBI gets is an encrypted message they can't read.

And how can I trust that the seller isn't an FBI agent? Still seems kind of risky. Even if they aren't an FBI agent, they're going to decrypt the address, and who knows what they'll do with it in plaintext? For one, they will write it on an envelope, leaving open the potential for exactly what happened with the fake IDs.

If not these scenarios involving law enforcement, there's also the risk that the seller, who has my address, will extort me for cash or whatever.

View on HN

You can't trust that the seller isn't an FBI agent nor that they'll delete your address nor that they won't extort you, but as a basic matter of fact, the seller isn't an FBI agent and hasn't held onto your address (whatever good that would do) nor will extort you. There are thousands of sellers over time on SR, and how many turned out to be FBI agents busting a buyer? So far, it seems like maybe 1, and that was personally targeting DPR/SR staff and not any other buyers. There have been a handful of address leaks, with minimal consequences. Extortion was so rare I can't think of any examples.

And it may seem risky, but that doesn't matter: we have the numbers. We have the statistics. The FBI has kindly told us exact numbers based on the SR database they seized. You can calculate the risk pretty easily. Take the number of sellers and/or transactions, get an estimate of number of buyers busted (for example, count instances in http://www.gwern.net/Silk%20Road#safe ), divide. This is like worrying that flying on an airliner might be really risky since the plane could fall out of the sky or be hijacked - certainly, but the worry is wrong, and you can go to faa.gov and look up the exact numbers and see for yourself how risky flying on an airplane is.

I don't think it's wrong to say that reliance on street addresses and USPS is a weak link in the system. I'll repeat it, maybe phrased a little differently: PGP; Tor; Bitcoin. This is all really good stuff to cover your tracks. Writing a street address on an envelope, and sticking it in a mailbox? It sounds absurd compared to what you are doing to protect yourself on the digital side.

And it seems that I am not the only one who sees something there, as according to media reports DPR himself was extorted over the question of revealing the street addresses of users.

You're probably right that the average Joe doesn't have to worry. But for specific individuals like DPR, they should know that being involved in facilitating a large number of illegal transactions, there is much more likelihood that they specifically will be targeted by law enforcement. I would expect then that they would do more to guard access to their address.

(Even if most people are OK, that doesn't mean it's not still a weakness. In the days before SSH became common, I used to log in over telnet all the time and never once to my knowledge got compromised. I suspect many had the same experience. Does that mean I was safe? Of course not.)

> Writing a street address on an envelope, and sticking it in a mailbox? It sounds absurd compared to what you are doing to protect yourself on the digital side.

I agree, it does sound absurd. And yet...

> And it seems that I am not the only one who sees something there, as according to media reports DPR himself was extorted over the question of revealing the street addresses of users.

DPR was worried (assuming, as usual, that the indictments are reasonably accurate here and their lies, omissions, and insinuations affect only other things) about the reputation of SR as a whole: SR as a viable business was being held hostage. This is not something relevant to an individual buyer being blackmailed one on one, which was the scenario you were asking about.

> But for specific individuals like DPR, they should know that being involved in facilitating a large number of illegal transactions, there is much more likelihood that they specifically will be targeted by law enforcement. I would expect then that they would do more to guard access to their address.

Yep. The ID stuff was remarkably careless. We don't know that it was fatal - I personally suspect the Australia wire transfer may have revealed everything - but it obviously could have been.

The Silk Road and similar protect the seller. There is just no way to protect the buyer, you are buying a physical product and at some point have to take physical possession of it there is no way to avoid this.

Just as with buying drugs face to face you have to trust that the dealer is not malicious, is there a risk? definitely. But just as in the real world law enforcement have little interest in wasting their time on buyers.

No way to avoid this, so we might as well just send everything via USPS to your front door? Sounds like a bit of a copout.

It seems to me if you go out of your way to hide your identity you should, um, hide your identity. That would mean not trusting the post office just as you would not trust a sniffable network. Arrange a drop in a public place or some such. (Or do I see too many movies?)

This is harder than you think, especially with mail.

Reply on news.ycombinator.com