Some privacy advice

[cubesquare]

Hi there.

I was putting this together as a response to someones status - turns out I write too much and it couldn't go there.
I'd appreciate any views on this as this is how I feel we can be safe as buyers.

Ok, so here are some things you can and should do.
1. Get familiar with TOR.
Install the TOR Browser, NEVER browse anywhere from other browsers. All Darknet related stuff muct be done from the TOR browser.
Do not connect to services that know you (Gmail, reddit, Facebook etc) via TOR, especially at the same time as browsing dark net material.
Always use a new private window for every new site - don't make use of tabs, you do not want some accidental cross tab leaks to happen.
2. Get familiar with PGP.
Install a PGP/GPG keyviewer, create a private/public key for yourself and NEVER send anything to someone if it contains personally identifiable info.
When you create your key - you do NOT need to have an email address in the key, do not put real names in the key. If you are using multiple markets, good idea to create a key per market, name them accordingly "HairyPoppins-BreakingBad" as an example. This way not only can vendors be sure which key to use, but disabling a key for a market that gets busted is very simple.
3. Plausible deniability is always something to keep on top of.
Just because you received a package in the post, doesn't mean you ordered it.
You should use your real name ofr addressing, otherwise postal services may decide you don't reside there and your package ends up waylaid/lost/inspected. Rather put your initial and surname (remember you are encrypting this) and then when you receive it, wait a few days before opening it. That way if someone does come to knock your door down, the item has not been opened and you can claim ignorance.
4. NEVER be in a hurry. Vendors do not ship to a tight schedule. They try to ship via different post offices, at different times, different days from your order. All of that is so that they can make it tricky for Law Enforcement to pin them to a particular transaction. If you need something fast, find a local street vendor, otherwise be patient, order early and relax.
5. Use XMR (Monero) to buy stuff, do not use Bitcoin.
XMR is untraceable, Bitcoin is traceable. Do not use BTC.
Run a local node for XMR, that way no transactions are ever exposed to the outside world.
Buy BTC using your FIAT (USD/GBP/AUD whatever) and send those BTC to a private BTC wallet on your machine. The use the services of anonymous traders like changenow.io to trade your BTC for XMR. DO THE TRADE INSIDE TOR BROWSER!
That way your XMR is 100% unlinkable to you. Good for you, good for the vendor, good for the market.
6. Be prepared.
Nothing will ever 100% guarantee that LE won't come knocking. So keep your stash secret, keep it safe. Find a hiding spot that won't be easily uncovered in a light search and put your goods there. If you are needing more than a light stash space, you are needing much more advice than this little write up.
7. If you are so inclined, consider getting a micro computer like a raspberry pi or something and running a Linux Privacy OS on it. Something like Tails which deletes all data every time it is restarted so leaves no incriminating evidence behind. Or something like Kodachi that allows you to filter all TCP sessions and encrypt all files/folders etc. You can run your XMR wallet on these platforms.

Anyway, that is a small selection of top priority things.

As with most things privacy related, if you don't TRY, you are definitely exposed.

 

[KokosDreams]

Great advise!

I'd add: work alone or in a team as small as possible

To point number 6 I would add: rather get a lawyer upfront instead of when it is too late.

Oh yeah right: And smartphones..never use them for something illegal. If illegal stuff needs to be researched online, do it in a way that can't be traced back to you.

 

[cubesquare]

Oh yeah right: And smartphones..never use them for something illegal. If illegal stuff needs to be researched online, do it in a way that can't be traced back to you.

KokosDreamsI think this is extremely valuable advice. Do everything via TOR browser, using disposable OS etc, keep nothing local. A very handy trick is to run a raspberry pi in the ceiling, running Tails, connected to a light switch or a remote control somewhere. Turn the light switch off and your history etc is all gone. Use onionmail/oniondrive or something to store very small volume backup details if you need to remember things, and make sure to encrypt all of those items.
Keep a copy of your PGP key at someone you trusts home, someone not related to anything.
That way you can rebuild from the pgp key held by your friend and the encrypted data held in onionmail/oniondrive. Remember to encrypt everything you store so that the service cannot access your stuff.

 

[KokosDreams]

I think this is extremely valuable advice. Do everything via TOR browser, using disposable OS etc, keep nothing local. A very handy trick is to run a raspberry pi in the ceiling, running Tails, connected to a light switch or a remote control somewhere. Turn the light switch off and your history etc is all gone.

cubesquareThat is actually an incredibly crazy idea! Next level stuff

Use onionmail/oniondrive or something to store very small volume backup details if you need to remember things, and make sure to encrypt all of those items.
Keep a copy of your PGP key at someone you trusts home, someone not related to anything.
That way you can rebuild from the pgp key held by your friend and the encrypted data held in onionmail/oniondrive. Remember to encrypt everything you store so that the service cannot access your stuff.

Also very good I think having an OpSec Sub-Forum (not a group) would be a great addition to the forum

 

[cubesquare]

That is actually an incredibly crazy idea! Next level stuff

Also very good I think having an OpSec Sub-Forum (not a group) would be a great addition to the forum

KokosDreamsGlad you like the idea Simple remote esktop connection and everything is there for you.
There is some opsec support stuff - I will have a look tomorrow

 

[KokosDreams]

Glad you like the idea Simple remote esktop connection and everything is there for you.

cubesquareThat's some next level stuff for a super villain home haha
A hidden laboratory in the basement that is not showing on the construction plans of the house and you're set for life

There is some opsec support stuff - I will have a look tomorrow

There's a sub forum for Internet technologies, Data encryption, Cryptocurrencies and Legal section that do contain OpSec advice

 

[HairyPoppins]

Great write-up! This is what I was looking for.

 

[GOUPIL]

i read all of your advices and i have to admit that's quite good !
Thank you for helping the community !

 

[diogenes]

Great advice. The only thing I disagree with is using your real name. The postman does not care if something comes to an old tenant in your house or your distant cousin has ordered something to your address. If the address is correct it will be delivered. And if not, and you lose something, it is still better than trying to explain to a judge that it was not you who ordered the staff. If it is not in your name and you have some plausible explanation when questioned who that (fake) person ie. your imaginary friend, they would probably have difficulty to obtain a search warrant in your home.

Kokos mentions alone or in a small group, which is absolutely true. And never talk/boast of your chemistry successes unless it is someone who is also involved in such activitie, very close to you and you absolutely trust. The hidden base in a remote location e.g. a holiday home somewhere if you can afford one would be best. In your home it would only work if you live alone and would have to be underground somewhere at the back of your garden, otherwise dogs could in theory sniff chemicals and it could be discovered.

 

[GOUPIL]

I would like to add something :
You can do your best to have the best opsec. Using Qubes-whonix, disable javascript, never use the same password etc...

You can always get caught if you don't use a drop and if your vendor have a bad stealth knowledge.
The vendor are always the first risk factor. Choose them wisely.

 

[diogenes]

I would like to add something :
You can do your best to have the best opsec. Using Qubes-whonix, disable javascript, never use the same password etc...

You can always get caught if you don't use a drop and if your vendor have a bad stealth knowledge.
The vendor are always the first risk factor. Choose them wisely.

GOUPILWould mind sharing if you have some experience with such suppliers? Mined did use methods, but many times it was sheer luck that the content was not discovered. PM is also OK if you wouldn`t like to expose them. Especially their proper stealth which would beat the purpose of kreative stealth...