'Silk Road Reloaded' Just Launched on a Network More Secret Than Tor | Hacker News Reader

'Silk Road Reloaded' Just Launched on a Network More Secret Than Tor

motherboard.vice.com

83 pointsdigisth27 comments

To put this in perspective:

- 'Silk Road Reloaded' is just one of many blackmarkets; there were something like 50 openings in 2014 alone (see http://www.gwern.net/Black-market%20survival#data & https://www.reddit.com/r/DarkNetMarkets/comments/2r58vs/2014... ). There is nothing new or interesting about a new blackmarket opening.

- It's not even the first site to be called 'Silk Road Reloaded'. The name is also a blatant effort to fool newbies and claim unearned credit.

- Heck, it's not even the first site to be run on I2P. I believe that was pioneered December 2013 by the late lamented The Marketplace (which also introduced multisig escrow). A few other markets tried afterwards, but the problem with I2P is that it's slow and doesn't seem to reliably work for users with all sorts of configs, and they all either closed quickly or set up a Tor hidden service. Thus far, the potential security advantage of I2P has not justified the hassle. And it's not like blackmarkets are often busted.

- Likewise, not a pioneer in the use of Litecoin, Dogecoin, or Darkcoin. Might be for Anoncoin, but I suspect it will find like past marketplaces that there's just not a lot of interest in those by users. The problem for blackmarket sellers is not 'my coin is only pseudonymous', the problem is cashing out to fiat safely and efficiently; Bitcoin currently offers the most scope for cashing out, and it will be a long time (if ever) for those others to match it.

- The admin is a raging asshole, if you check out his Reddit comments. Anyone want to trust him with a few thousand bucks in anonymous e-cash...?

- On top of that, he supposedly began coding the site after SR1 was busted. How does it take over a year to set up a simple e-commerce site when almost 60 other clones were able to set up in that time? To me, that reads like it's a hobby, at best, or that he's completely incompetent, at worse. In neither case does one want to use his site.

>>- The admin is a raging [expletive], if you check out his Reddit comments. Anyone want to trust him with a few thousand bucks in anonymous e-cash...?

To add to this, http://www.reddit.com/r/SilkRoad/comments/2rp0aw/silkroadrel... , Notice that all his comments are downvoted and check out what he says. Do you agree with any of it? Here's a particularly "nice" thread: http://www.reddit.com/r/SilkRoad/comments/2rp0aw/silkroadrel...

...and this.. http://www.reddit.com/r/SilkRoad/comments/2rp0aw/silkroadrel...

> [expletive]

Is that really necessary? Profanity is part of the English language. :\

So is euphemism-based censorship. :P

Everything we say is part of the a language. Do you conclude that it's appropriate to say anything on here?

Yep. We're mostly adults here, right?

Even if we weren't, it's not like there are kids who don't know and use curse words.

In Florida, it's actually a crime (though never enforced) to utter profanity in the presence of women or children. I was obtusely referencing this sort of mentality.

And you can say any ol' thing to an adult and it's always fine, right?

You must be loads of fun to work with, live with, or otherwise interact with in any way.

> And you can say any ol' thing to an adult and it's always fine, right?

Yep.

> You must be loads of fun to work with, live with, or otherwise interact with in any way.

I dunno, I'm too self-centered to think about that.

Probably. Some feel uncomfortable/less-professional repeating profanity.

It's not. People doing this makes me sad - the "expletive" is right there in the parent, you're not doing anyone any favors. It's just a word – a combination of letters. Noone should be offended by words.

I'm not sure what I should agree with? (I don't agree with the LE/infiltration argument against this dude; he obviously has no connection to any SR1 staff, that's part of the problem with using the name. The problem is entirely that he's stealing reputation and misleading everyone, which is something you can see for yourself on the Diabolus forums and elsewhere; after it renamed itself 'Silk Road 3', it got more traffic and people apparently think it really is more trustworthy than it is (which is 'not at all').) You should also note that I'm one of the /r/DNM mods and have criticized him for a long time now.

If he'd just come up with a new name like everyone else, my only real beef would be that no one needs a new market, I2P is probably sabotaging himself, and he's an asshole.

My comment was simply to support your view. I agree with you and was just adding specific comment-threads from reddit that support what you said.

EDIT: Oh, I see. The "you" in "Do you agree with any of it" was actually directed towards all the other HN readers, not you specifically.

>- On top of that, he supposedly began coding the site after SR1 was busted. How does it take over a year to set up a simple e-commerce site when almost 60 other clones were able to set up in that time? To me, that reads like it's a hobby, at best, or that he's completely incompetent, at worse. In neither case does one want to use his site.

It could also mean the opposite. You ever pentest those other markets?

> You ever pentest those other markets?

No, but consider this: the biggest two markets, Agora and Evolution, started within months of the SRR first nattering on Reddit about how he was going to start a site someday. Which would you bet is more secure, a site which is ~a year old and a major target most of the while, or a brand-new site? (Hint: before answering, you may want to look at the competing-risk chart in my Reddit post to see what the empirical estimate of risk of being hacked over time currently is.)

This is the good place to ask

Is, in your opinion, i2p really a good alternative to tor?

What I can personally think as positives/negatives:

* Tor is trivial to install (just download the bundle)

* Tor is working on TCP-level, i2p on IP level, which allows it to be used for BitTorrent (but it's really slow for that)

* Tor is usable for "normal" web browsing, i2p not really (it has one outwards proxy that you can use but that's it)

* Nobody uses i2p so it's really slow, and I am not sure if it doesn't decreases the actual anonymity

> Nobody uses i2p

This is the problem. Anonymity networks are based on the idea of "blend in with the crowd". If there is no crowd, even an iron-clad protocol isn't much benefit.

Yes, some people use i2p, but its adoption rate is much lower than Tor.

Yes and no

i2p and Tor is different in this. Tor has relays, and there are far fewer of them than its users.

I am not sure though, that's why I am asking

> Nobody uses i2p

Here is an analysis that was done less than a week ago. https://thetinhat.com/articles/2015/i2p-survey.html

TL;DR ~25,000 constant nodes, mostly in Russia and United States. With Russia having a lot of short lived connections.

An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway.

When evaluating, it's important to look at past vulnerabilities. The following links are to posts from Exodus Intelligence about a vuln they found in i2p in July, 2014. - http://blog.exodusintel.com/2014/07/23/silverbullets_and_fai... - http://blog.exodusintel.com/2014/08/25/tails-from-the-cri2p/

On the one hand you could say it is more secure now because Exodus Intelligence reviewed it, and said "I2P had many cross-site scripting vulnerabilities" of which all were fixed. Also the way in this could be exploited is a little unique (by using XSS to hit the internal I2P router configuration intranet), so it's hard to fault the developers too much for overlooking those XSS problems originally.

On the other hand, there is the view that the more vulns that are found, the more likely it is there are more as yet undiscovered vulns.

Disabling JS would be a good start to avoiding those issues.

> Nobody uses i2p so it's really slow, and I am not sure if it doesn't decreases the actual anonymity

From what I remember (many years since I used it) it's faster than Tor as all nodes are participating in the routing by default.

I have not run i2p or otherwise paid much attention to the project for more than a year, but I did notice it had a remote code execution vulnerability discovered last summer or so (stemming from its default-on web admin interface: http://blog.exodusintel.com/2014/07/23/silverbullets_and_fai...). Just because of that I would not consider it an alternative to Tor. However it's not true that "nobody uses i2p". The network is somewhat lively. Another thing is that relay mode is the norm rather than the exception (unlike with Tor), meaning your relay going down can be correlated with your i2p torrent client going down etc.

I'd look to GNUnet (https://gnunet.org/) as the future. It is more than just a Tor alternative, since it also has non-realtime features. Unfortunately it also has few or no users. A neat feature for any aspiring network would be capability to run over Tor, so you don't start with an empty anonymity set.

There is money to be made in i2p, people. Time to start creating eepsites.

Hopefully this ends up making i2p a stronger alternative to Tor, by having more crypto guys taking a look at it and finding bugs or bad designs in it.

Quite. It's been around for many years but I don't think it ever got the crypto attention that Tor has received, mostly because it was (and is) very little used. A few Russian sites toyed with using it when they started blocking sites for piracy over there but it was never adopted - too slow, not user friendlh enough.

Reply on news.ycombinator.com