Print Page - So how do you get an answer out of SR?

Discussion =3D> Silk Road discussion =3D> Topic= started by: InnocentBystander4 on July 26, 2012, 03:27 am

Title: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 03:27 am

[EDIT: This is an extension of my previous thread: http://dkn255hz262yp= mii.onion/index.php?topic=3D30774.15=C2=A0 =C2=A0]

Hi Guys

So= what's the best method to get an official response from SR? Do you need a= thread rolling above a critical mass? Should I first hassle a forum Admin?= Do you send messages on the SR Site. Do any SR techies ( other than DPR)= =C2=A0 ever answer questions on the boards. Am I just too far below anyone'= s care-factor to matter? Perhaps sr does not give official answers (how to= get an unofficial then?)?

Enlightenment would be greatly appreciate= d.
IB

Title: Re: So how do you get an answer out of SR?
Post by: 20DollarBILL on July 26, 2012, 03:30= am

Have you asked a question yet? If so how?

Title: Re: So how do you get an answer out of SR?
Post by: jameslink2 on July 26, 2012, 03:48 am=

Quote

So what's the best method to ge= t an official response from SR?

In most cases you ask a question= here on the board and users, vendors, moderators, or admins answer them.

Quote

<= /div>

Do you need a thread rolling= above a critical mass?

No, just post the question

Quote

Should I first hassle a forum Admin?

<= /div>
I would no do it before you ask the question on the forum.

=

Quote

<= blockquote class=3D"bbc_standard_quote">Do you send messages on the SR Site= .

Sometimes, but not normally.

Quote

Do any SR techies ( other than DPR)=C2=A0 ever answer questio= ns on the boards.

Yes, as do experienced users and vendors.
<= br>

Quote

Am I just too far below anyone's= care-factor to matter?

Dont know what the question is so I can= not say.

Q= uote

Perhaps sr does no= t give official answers (how to get an unofficial then?)?

What= is the deal with "Official Answers"? What do you want to know? Many are he= re to help and will answer any question you may have.

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on July 26, 2012, 04:23 am

Quote
What is the deal with "Official= Answers"? What do you want to know? Many are here to help and will answer= any question you may have.

Journalist wanting 'official' stateme= nt from DPR maybe? :P

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 04:27 am

Thanks so much to everyone :) So I should just post it here? Now? Alrig= ht Here Goes!

Why has been SR storing over 9 months of transaction= data/intel against everyone of it buyers/vendors?

Apart from the tr= ansaction data I know that every btc transfer sent to any btc address assoc= iated with any SR account was also stored. If the btc was not purchased ano= nymously then it could be used to associate a real person to an account and= then to all the transactions made under that account.

I have no ide= a whether address data was stored.

This is not supposed to create a= panic I would just like to know what possible motivation SR would have for= doing this. By holding on to such an unnecessary large amount of transacti= on data they would be seemingly not only be putting there buyers/sellers at= much higher risk, but also themselves.

Title: Re: So how do you get an answer out of SR?
Post by: 20DollarBILL on July 26, 2012, 04:31= am

Quo= te from: InnocentBystander4 on July 26, 2012, 04:27 am
Thanks so much to everyone :) So I shou= ld just post it here? Now? Alright Here Goes!

Why has been SR storin= g over 9 months of transaction data/intel against everyone of it buyers/ven= dors?

Apart from the transaction data I know that every btc transfer= sent to any btc address associated with any SR account was also stored. If= the btc was not purchased anonymously then it could be used to associate= a real person to an account and then to all the transactions made under th= at account.

I have no idea whether address data was stored.

T= his is not supposed to create a panic I would just like to know what possib= le motivation SR would have for doing this. By holding on to such an unnece= ssary large amount of transaction data they would be seemingly not only be= putting there buyers/sellers at much higher risk, but also themselves.
=

So how do you know this?

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on July 26, 2012, 04:37 am

I'm curious where you got the 9 month part from? If it's that much of= an issue, just make a new SR account every few transactions

Title: Re: So how do you get an answer out of SR?
Post by: jh0000n on July 26, 2012, 04:44 am

How exactly do you know this?? If you dont say your officaially talking= shit...those are some heavy claims

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 04:54 am

Up until the new site layout was up you could simply go to account >= feedback and it would show a chronological list of=C2=A0 all of your purcha= ses (including item,vendor, price etc). For me it went 9-10 months because= that is when I made my first purchase.. That single list gives virtually= the whole thing away (transactions are never getting deleted). A fairly st= andard multi shopfront DB table layout would likely be being used. With sql= access you could get Total customers for a vendor, Total revenue by Vendor= , Select all Sales transaction from vendor Bob, etc,

Title: Re: So how do you get an answer out of SR?
Post by: masterblaster on July 26, 2012, 04:55= am

because that how we make everyone accountable. we gotta all trust the= SR admin if this is gonna work.=20

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:00 am

No that is insane. You do not want one person in control of huge amount= of incrimating data

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:01 am

Do you have his data?

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:07 am

My question is why would he have 9+ months worth? There is no reason to= keep it for say a week past finalization. It's a huge amount of data he's= gathered and adds so much unneccessary risk to buyerys/vendors and seeming= ly himself.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:11 am

Here is my thread original thread.
http://dkn255hz262ypmii.onion/ind= ex.php?topic=3D30774.15

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:12 am

So how long 'til my official answer? 8)

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:19 am

You may have seen this buts its one example of the SR database being pe= netrated
http://dkn255hz262ypmii.onion/index.php?topic=3D3295.msg28486#m= sg28486

I don't know enough about this one or if there is any chance= LE found if much earlier.

Title: Re: So how do you get an answer out of SR?
Post by: NFHC on July 26, 2012, 05:21 am

6 posts in a row? calm the fuck down and learn how to click 'modify'

Title: Re: So how do you get an answer out of SR?
Post by: jh0000n on July 26, 2012, 05:31 am

I posted this in the other thread also but id like more peoples opinion= s on my view...

Even if LE found "transactions" on your account its= still very hard for them to bust you because that isnt "proof beyond a rea= sonable doubt" that you did infact recieve drugs. Maybe your just circulati= ng coins with a vendor to leave positive feedback on their page...and in re= turn they send you the btc you gave them as cash in the mail plus some prof= it added for the service. See what im getting at? If they dont have you in= posession of the drugs or intercept the drugs coming to you then it makes= it very difficult for them to stick charges just based on account stats.= What kind of charges could they throw at you...not possesion, maybe intent= to purchase or some type of conspiracy to commit illegal activity...i dunn= o??=20

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:36 am

jh0000n: [Edit: Misread post. Retracting comment]

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 07:03 am

What are other peoples thoughts?=20

Title: Re: So how do you get an answer out of SR?
Post by: Bud on July 26, 2012, 11:42 am

Shut the fuck up you paranoid idiot lol

Title: Re: So how do you get an answer out of SR?
Post by: 20DollarBILL on July 26, 2012, 12:04= pm

So how do you get an answer out of SR?

Very carefully=20

Title: Re: So how do you get an answer out of SR?
Post by: Spunkaroo on July 26, 2012, 01:52 pm<= /strong>

Quo= te from: InnocentBystander4 on July 26, 2012, 05:36 am
jh0000n: Was really hoping for an offic= ial response or some others opinions before going down that path. It's not= my opinion at the moment and my only adgenda right now is to get my questi= on answered:

Why 9 months+ of data?

No offence, but yo= ur forum etiquette is horrible so that's probably the first reason you're= not getting responses from 'higher up.'

Can I ask, why the worry?= Is there something you're doing that can link your real life identity to= your SR account? If so I suggest you change that, and soon. SR's published= policy is that everyone should mind their own business, so if you consider= this to be 'your business' then I suggest you work out why that is and fix= it, as it's obviously a security hole in your setup/procedure.

Title: Re: So how do you get an answer out of SR?
Post by: Dread Pirate Roberts on July 26, 2012= , 04:43 pm

Your thread title caught my attention because I and my staff answer alm= ost ALL incoming messages with very few exceptions.=C2=A0 I don't read ever= y word on the forum, so crying out for my attention here is not the best wa= y to get it, even though it worked in this case.=C2=A0 Since you have it,= I would be happy to spell out our current data retention policy.

ad= dresses are kept on record until your vendor has marked your item as shippe= d.=C2=A0 I encourage everyone to encrypt their address to their vendor's pu= blic key just in case.

messages are kept for two months.=C2=A0 again= , sensitive data transmitted through our messaging system should be encrypt= ed.

transaction records, including feedback are kept for 4 months.= =C2=A0 I said 3 in another thread, but upon double checking, it is 4.=C2=A0= We do this because the data contained in the transaction record, including= the buyer, is used to weight the feedback for that transaction.=C2=A0 Afte= r 4 months, the age weight has pretty much reduced the weight to zero anywa= y, so we no longer need the data.=C2=A0 If you want further explanation abo= ut this, check out the wiki page and forum thread about the feedback weight= ing system.

the accounting log is kept for 3 months.=C2=A0 Only 2 we= eks are displayed so an adversary who gains access to your account won't be= able to see all of that history.

withdrawal addresses are not kept,= but everyone should realize that the time and amount of the withdrawal cou= ld narrow down which transaction it was in the blockchain quite a bit, espe= cially if it was an uncommon amount.

deleted items are kept for 4 mo= nths.=C2=A0 this is to preserve the integrity of the link to the transactio= ns associated with the item.

user accounts with a zero balance and= no activity for 5 months are deleted.

If you experienced something= contradictory to this, please pm support on the main site and we will be= happy to investigate the situation with you and root out any possible bugs= .

These time parameters were arrived at through trial and error.=C2= =A0 They are as tight as we can make them without sacrificing the integrity= of the market.=C2=A0 Could they be a little tighter?=C2=A0 Maybe by a week= or two, but please think through the implications of policy changes before= you call for them.

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on July 26, 2012, 04:51 pm

Wow you should consider yourself lucky as fuck. I've never seen DPR rep= ly to a thread like this ???

4 months is MUCH better than the 9 you= suggested though.

Title: Re: So how do you get an answer out of SR?
Post by: deadfuture on July 26, 2012, 05:00 pm=

I think Kryptoz avatar above accurately details my face when I saw this= thread and the response from DPR.=C2=A0 There you have it, thanks DPR.

Title: Re: So how do you get an answer out of SR?
Post by: 20DollarBILL on July 26, 2012, 05:05= pm

And God said, Let there be light: and there was light

Title: Re: So how do you get an answer out of SR?
Post by: Boris Badenov on July 26, 2012, 05:05= pm

Click on support on SR and ask.

BB

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on July 26, 2012, 05:13 pm

Quo= te from: deadfuture on July 26, 2012, 05:00 pm
I think Kryptoz avatar above accurately detai= ls my face when I saw this thread and the response from DPR.=C2=A0 There yo= u have it, thanks DPR.

LOL that was my face when I first saw= this site ^-^

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:37 pm

Quo= te from: Spunkaroo on July 26, 2012, 01:52 pm
Quote from: InnocentBystander4 on July 26, 2012, 05:36= am
jh0000n: Was= really hoping for an official response or some others opinions before goin= g down that path. It's not my opinion at the moment and my only adgenda rig= ht now is to get my question answered:

Why 9 months+ of data?

No offence, but your forum etiquette is horrible so that's probably= the first reason you're not getting responses from 'higher up.'

Can= I ask, why the worry? Is there something you're doing that can link your= real life identity to your SR account? If so I suggest you change that, an= d soon. SR's published policy is that everyone should mind their own busine= ss, so if you consider this to be 'your business' then I suggest you work= out why that is and fix it, as it's obviously a security hole in your setu= p/procedure.

Sorry man, my social skills irl are pretty terri= ble too and I often don't notice when I've given offense.

If you see= my original thread you can see that many people where reporting 8+ months= of purchase data. For a site like this that either points towards gross in= competence or LE intelligence gathering.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:40 pm

Quo= te from: Dread Pirate Roberts on July 26, 2012, 04:43 pm

Thanks mate, very much app= reciated.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 26, 2012,= 05:47 pm

Quo= te from: kryptoz on July 26, 2012, 04:51 pm
Wow you should consider yourself lucky as fuck. I'= ve never seen DPR reply to a thread like this ???

4 months is MUCH= better than the 9 you suggested though.

Thanks I do feel luc= ky but will try to get my responses with more decorum from now on.

I= wasn't actually suggesting 9 months, that's how long my purchases were sho= wing in my account.

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on July 26, 2012, 05:51 pm

Quo= te from: InnocentBystander4 on July 26, 2012, 05:47 pm
Quote from: kryptoz on July 26, 2012, 04:51= pm
Wow you should= consider yourself lucky as fuck. I've never seen DPR reply to a thread lik= e this ???

4 months is MUCH better than the 9 you suggested though.<= br>

Thanks I do feel lucky but will try to get my responses with= more decorum from now on.

I wasn't actually suggesting 9 months, th= at's how long my purchases were showing in my account.

Most= of the time, SR support on the site is actually pretty quick to respond (m= ax 2 days in my experiences), but you have to think of how many questions= and messages he gets EVERY day, it is a world wide market after all :)
=
Ahh my apologies, I've never noticed, as I just move on to a new accoun= t after a few purchases to avoid the problem completely :)=20

Title: Re: So how do you get an answer out of SR?
Post by: masterblaster on July 27, 2012, 01:20= am

hey DPR, in OPs defense the documentation on this site is lacking, if= you had posted all this information on the wiki people wouldnt be putting= threads like this up.=20

Title: Re: So how do you get an answer out of SR?
Post by: QwertAnon on July 27, 2012, 02:40 am<= /strong>

That's why you anonymize your bitcoins before sending them to SR and pg= p encrypt at least your address data when communicating with a vendor.
I= t doesn't matter what DPR says. If servers are compromised the FBI can chan= ge everything.

Interesting to know though!

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 29, 2012,= 03:52 pm

Quo= te from: Dread Pirate Roberts on July 26, 2012, 04:43 pm
Your thread title caught my attention= because I and my staff answer almost ALL incoming messages with very few= exceptions.=C2=A0 I don't read every word on the forum, so crying out for= my attention here is not the best way to get it, even though it worked in= this case.=C2=A0 Since you have it, I would be happy to spell out our curr= ent data retention policy.

addresses are kept on record until your= vendor has marked your item as shipped.=C2=A0 I encourage everyone to encr= ypt their address to their vendor's public key just in case.

message= s are kept for two months.=C2=A0 again, sensitive data transmitted through= our messaging system should be encrypted.

transaction records, incl= uding feedback are kept for 4 months.=C2=A0 I said 3 in another thread, but= upon double checking, it is 4.=C2=A0 We do this because the data contained= in the transaction record, including the buyer, is used to weight the feed= back for that transaction.=C2=A0 After 4 months, the age weight has pretty= much reduced the weight to zero anyway, so we no longer need the data.=C2= =A0 If you want further explanation about this, check out the wiki page and= forum thread about the feedback weighting system.

the accounting lo= g is kept for 3 months.=C2=A0 Only 2 weeks are displayed so an adversary wh= o gains access to your account won't be able to see all of that history.
withdrawal addresses are not kept, but everyone should realize that th= e time and amount of the withdrawal could narrow down which transaction it= was in the blockchain quite a bit, especially if it was an uncommon amount= .

deleted items are kept for 4 months.=C2=A0 this is to preserve the= integrity of the link to the transactions associated with the item.
user accounts with a zero balance and no activity for 5 months are deleted= .

If you experienced something contradictory to this, please pm supp= ort on the main site and we will be happy to investigate the situation with= you and root out any possible bugs.

These time parameters were arri= ved at through trial and error.=C2=A0 They are as tight as we can make them= without sacrificing the integrity of the market.=C2=A0 Could they be a lit= tle tighter?=C2=A0 Maybe by a week or two, but please think through the imp= lications of policy changes before you call for them.

DPR:= This still does not account for why myself and many others could previousl= y see their entire purchase history (mine was 8 months plus). This was clea= rly not inline with your above data retention policy. This anomaly has not= been explained nor acknowledged, but there was a near immediate modificati= on that stopped users from seeing more than a 3 month history.

This= case indicated a clear mismatch between what SR said they were storing and= what they were actually storing. I'm not claiming this should be considere= d majorly important but I would like it to be taken on board with the weigh= t people think it deserves. I would also like to encourage others to openly= post anything they notice that may appear strange or inconsistent.

Title: Re: So how do you get an answer out of SR?
Post by: Dread Pirate Roberts on July 29, 2012= , 05:02 pm

Quo= te from: InnocentBystander4 on July 29, 2012, 03:52 pm
DPR: This still does not account for wh= y myself and many others could previously see their entire purchase history= (mine was 8 months plus). This was clearly not inline with your above data= retention policy. This anomaly has not been explained nor acknowledged, bu= t there was a near immediate modification that stopped users from seeing mo= re than a 3 month history.

This case indicated a clear mismatch betw= een what SR said they were storing and what they were actually storing. I'm= not claiming this should be considered majorly important but I would like= it to be taken on board with the weight people think it deserves. I would= also like to encourage others to openly post anything they notice that may= appear strange or inconsistent.

as I said:
"If you experi= enced something contradictory to this, please pm support on the main site= and we will be happy to investigate the situation with you and root out an= y possible bugs."

Title: Re: So how do you get an answer out of SR?
Post by: vlad1m1r on July 29, 2012, 05:10 pm

Quo= te from: Dread Pirate Roberts on July 29, 2012, 05:02 pm
Quote from: InnocentBystander4 on July 29,= 2012, 03:52 pm
DP= R: This still does not account for why myself and many others could previou= sly see their entire purchase history (mine was 8 months plus). This was cl= early not inline with your above data retention policy. This anomaly has no= t been explained nor acknowledged, but there was a near immediate modificat= ion that stopped users from seeing more than a 3 month history.

This= case indicated a clear mismatch between what SR said they were storing and= what they were actually storing. I'm not claiming this should be considere= d majorly important but I would like it to be taken on board with the weigh= t people think it deserves. I would also like to encourage others to openly= post anything they notice that may appear strange or inconsistent.

as I said:
"If you experienced something contradictory to this,= please pm support on the main site and we will be happy to investigate the= situation with you and root out any possible bugs."

Just= thought I'd say a quick hello from the UK DPR, what you have achieved here= is truly remarkable!

V.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 31, 2012,= 11:11 am

Quo= te from: Dread Pirate Roberts on July 29, 2012, 05:02 pm
Quote from: InnocentBystander4 on July 29,= 2012, 03:52 pm
DP= R: This still does not account for why myself and many others could previou= sly see their entire purchase history (mine was 8 months plus). This was cl= early not inline with your above data retention policy. This anomaly has no= t been explained nor acknowledged, but there was a near immediate modificat= ion that stopped users from seeing more than a 3 month history.

This= case indicated a clear mismatch between what SR said they were storing and= what they were actually storing. I'm not claiming this should be considere= d majorly important but I would like it to be taken on board with the weigh= t people think it deserves. I would also like to encourage others to openly= post anything they notice that may appear strange or inconsistent.

as I said:
"If you experienced something contradictory to this,= please pm support on the main site and we will be happy to investigate the= situation with you and root out any possible bugs."

Will= do. With your permission I'd like to post the resulting support conversati= on here.

Please do not think I am being deliberately malicious, I'm= simply looking for an answer. My feelings towards you and this site are ve= ry much reflected in vlad1m1rs above post.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on July 31, 2012,= 11:51 am

Posted to SR Support through the main SR site:

"Dear SR Support,=

I am sending this on the advice of DPR in the hope that someone can= determine why my data was/is being stored longer than the SR Data Retentio= n Policy indicates it should be.

Prior to the very recent visual cha= nges, it was evident that my purchase history was being stored for 8+ month= s. By going to my 'Account' =3D> 'View feedback' all purchases were visi= ble going right back to 8 or more months. I believe it included my first pu= rchase. Although this was a 'feedback' page it stronly indicated that the= full purchase/transaction record was being stored. DPR (in his Data Retent= ion Policy) later confirmed this.

Various people on the forums also= indicated that they too were experiencing this issue. You can see this in= my original thread:

http://dkn255hz262ypmii.onion/index.php?topic= =3D30774.15

DPR was nice enough to post SR's data retention policy= and this clearly showed that my own, as well as others data was being stor= ed much longer than it should have been. The Data Retention Policy can be= seen here:

http://dkn255hz262ypmii.onion/index.php?topic=3D32573.m= sg370788#msg370788

In the interest of maximizing the security of the= entire SR community, I would very much appreciate if you could investigate= the above. If any issues are identified it would be great if you could pro= vide a brief overview of what went wrong and in case the issue is ongoing= any time-frames for a resolution.

Best Regards,
[REDACTED]"
<= br>

Title: Re: So how do you get an answer out of SR?
Post by: masterblaster on August 01, 2012, 04:= 16 am

Moderators please add this info to the wiki pending whatever the hell= OP is seeing.=20

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on August 01, 2012= , 02:03 pm

Quo= te from: masterblaster on August 01, 2012, 04:16 am
Moderators please add this info to the wik= i pending whatever the hell OP is seeing.

Thanks for your sup= port masterblaster. Please feel free to post anything you're unclear about= and I'll do my best to help.
=C2=A0
I would like to clarify though= that this isn't something only I have seen. Please see my original thread= ( http://dkn255hz262ypmii.onion/index.php?topic=3D30774.0 ) where various= people confirm they were also able to see purchase histories going back a= similar length. Also despite much debate nobody contradicts this or claims= their purchase histories were any different.

Later in the thread DP= R states that only 3 months of history is currently stored and asks if that= number should be amended. This is a strange post as it contradicts what ma= ny people have already stated .
http://dkn255hz262ypmii.onion/index.php= ?topic=3D30774.msg355479#msg355479.

Soon after this the feedback pag= e was modified so that users could only see 3 months of feedback/purchase= history.

So far SR has not acknowledged that there was ever an issu= e. They have not said why, for at least some and possibly all users, purcha= se history was being stored for much longer than necessary (possibly indefi= nitely). They have also not said if this is still happening.

The que= stion is why would a site as sensitive as SR want to keep potentially highl= y incriminating data (to vendors/buyers and SR) for any longer than absolut= ely necessary?

There is also a separate but related issue involving= old btc addresses remaining associated with accounts but I'll leave that= one for now.

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on August 01, 2012= , 03:07 pm

Quo= te from: InnocentBystander4 on July 31, 2012, 11:51 am
Posted to SR Support through the main= SR site:

"Dear SR Support,

I am sending this on the advice= of DPR in the hope that someone can determine why my data was/is being sto= red longer than the SR Data Retention Policy indicates it should be.
Prior to the very recent visual changes, it was evident that my purchase= history was being stored for 8+ months. By going to my 'Account' =3D>= 'View feedback' all purchases were visible going right back to 8 or more= months. I believe it included my first purchase. Although this was a 'feed= back' page it stronly indicated that the full purchase/transaction record= was being stored. DPR (in his Data Retention Policy) later confirmed this.=

Various people on the forums also indicated that they too were exp= eriencing this issue. You can see this in my original thread:

http:/= /dkn255hz262ypmii.onion/index.php?topic=3D30774.15

DPR was nice enou= gh to post SR's data retention policy and this clearly showed that my own,= as well as others data was being stored much longer than it should have be= en. The Data Retention Policy can be seen here:

http://dkn255hz262y= pmii.onion/index.php?topic=3D32573.msg370788#msg370788

In the intere= st of maximizing the security of the entire SR community, I would very much= appreciate if you could investigate the above. If any issues are identifie= d it would be great if you could provide a brief overview of what went wron= g and in case the issue is ongoing any time-frames for a resolution.
Best Regards,
[REDACTED]"

Quote from: Dread Pirate Roberts on Ju= ly 29, 2012, 05:02 pm
If you experienced something contradictory to this, please pm support on= the main site and we will be happy to investigate the situation with you= and root out any possible bugs.

Day 1 Update: No response fr= om SR Support (have been told it can take a while but will provide daily up= dates)

Title: Re: So how do you get an answer out of SR?
Post by: masterblaster on August 01, 2012, 08:= 12 pm

Put up some censored pics of what you're seeing so we can believe you.= =20

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on August 01, 2012= , 08:56 pm

Anybody on SR who had an account with a purchase history > 3 months= would be able to back this up. This really is not just some claim I'm maki= ng. The recent site update changed the feedback section so you can now only= see 3 months of history, This change was made during my previous thread.= The issue was visible for months, if not from the beginning. However it's= only just recently that enough people realized the potentially incriminati= ng implications of this data being there.

Posts from others in my or= iginal thread that refer to their extended purchase history:

http://= dkn255hz262ypmii.onion/index.php?topic=3D30774.msg344919#msg344919
http:= //dkn255hz262ypmii.onion/index.php?topic=3D30774.msg344987#msg344987
htt= p://dkn255hz262ypmii.onion/index.php?topic=3D30774.msg345156#msg345156
h= ttp://dkn255hz262ypmii.onion/index.php?topic=3D30774.msg355217#msg355217http://dkn255hz262ypmii.onion/index.php?topic=3D30774.msg355479#msg355479= DPRs out of context
post
http://dkn255hz262ypmii.onion/index.php?to= pic=3D30774.msg360372#msg360372
http://dkn255hz262ypmii.onion/index.php?= topic=3D30774.msg360874#msg360874
http://dkn255hz262ypmii.onion/index.ph= p?topic=3D30774.msg365295#msg365295 First post indicating SRs changes

Title: Re: So how do you get an answer out of SR?
Post by: masterblaster on August 02, 2012, 01:= 21 am

I've read the thread you linked to and im not entirely clear on what th= e problem is. Ok, so SR retains a complete history of our purchases:
1. Unless you bought btc using a method that left a papertrail then theres= no way to link that wallet address to you.
2. Even if you did leave a= paper trail, there's no way to associate a wallet address with SR unless= the SR database gets compromised
3. Even if the SR database gets compro= mised, there's no way to legally assert that you bought drugs unless you se= nt your address in plaintext, or the seller was a cop
4. Even if all the= se things happened, they still would have to prove that you received the dr= ugs.
5. If all that shits happens, then you screwed up and are fucked.=

Yes i understand that since they store old addresses linked to you= r account it only takes one papertrail to link you to the account, if the= site gets compromised. The thing is how are we supposed to know what data= sr is storing? They can say whatever they want, or configure the site to= make it appear as if they're storing less than they are, you have no way= of knowing. Assume they work like google and save everything in triplicate= .

The thing is not to give them any data. Buy coins with cash, or= buy with a card and send it through the fog before going into SR. Encrypt= your address. Deal with the fact that its highly more likely the cops will= hunt you down after having found drugs in your mail than they will hunt SR= down and veritably demonstrate that TOR can be broken (something the highe= r ups like the NSA would rather not do). It seems like SR is a huge target,= but there's been CP sites on tor hidden services for as long as tor has be= en around and no LEO has ever taken one down (though hackers have DDOS'd th= em to death).

If you're worried about the low hanging fruit making= these mistakes then petition to have the wiki amended with an emphasis on= this info. Demanding DPR do something you can't audit in the first place= isn't going to solve anything.=20

Title: Re: So how do you get an answer out of SR?
Post by: InnocentBystander4 on August 02, 2012= , 03:53 am

Nice Answer!

Quote from: masterblaster on August 02, 2012, 01:21 am=
They can say whatever= they want, or configure the site to make it appear as if they're storing= less than they are, you have no way of knowing. Assume they work like goog= le and save everything in triplicate.

It's just that we did= all get a glimpse of what SR is storing and it does look a lot more like= google and not what SR was claiming to . This is a strong indicator that= they are actually LE.

Title: Re: So how do you get an answer out of SR?
Post by: kryptoz on August 02, 2012, 04:22 am<= /strong>

Quo= te from: InnocentBystander4 on August 02, 2012, 03:53 am
Nice Answer!

Quote from: masterblaste= r on August 02, 2012, 01:21 am
They can say whatever they want, or configure the site to make= it appear as if they're storing less than they are, you have no way of kno= wing. Assume they work like google and save everything in triplicate.
<= /blockquote>
=

It's just that we did all get a glimpse of what SR is storing and= it does look a lot more like google and not what SR was claiming to . This= is a strong indicator that they are actually LE.

If SR was= LE then they would have taken down all the vendors long ago.

Silk Road forums

Discussion =3D> Silk Road discussion =3D> Topic= started by: InnocentBystander4 on July 26, 2012, 03:27 am