The DNMs can be a scary and dangerous place if you don't know what you're doing. Use this thread to ask questions or give advice on harm reduction & OPSEC!
Safety & Security Saturday!
The DNMs can be a scary and dangerous place if you don't know what you're doing. Use this thread to ask questions or give advice on harm reduction & OPSEC!
[10 Points] _PrinterPam_:
[7 Points] ForLol_Serious:
Why is the color bitch purple instead of marijuanas green?
[6 Points] None:
I have seen some step by step DNM buying guides but some people were saying that the ones in Reddit are all outdated. Maybe, taking all the things that happened in the DNM scene into account, someone could just write something NEW and comprehensive for not only starters but also for those experienced ones who'd like to expand their checklist.
[5 Points] PM_UR_DNM_TAKEDOWNS:
I like to live life on the edge. I always auto-pgp but sometimes I just straight up send my stuff in cleartext because taking the extra few minutes to open my pgp client and clicking encrypt is way to hard. Rate my OPSEC.
[6 Points] None:
If I hide my tails usb in a bottle of jergens lotion will it get messed up?
[4 Points] DestroyedByLSD25:
Do you guys think Monero is going to be the next big thing in the DNMs? For now only Wall St seems to be accepting it
[3 Points] skankhunt92:
We accept monero at TR, have just updated our phishing security. We also encourage multisig. Fuck BCC
[3 Points] batoosai:
Which market is safe aka non-compromised yet?
[1 Points] InvestInAntshares:
So there was a drug and weapons check at my countries airport. They used a couple of sniffer dogs and xrays. I mean like a BIG TIME check, with like 70 officers checking international mail and packages.
I ordered some wax and shatter in a letter, and it usually arrives in 5-6 days. Its been 7 days now. Its a flat envelope, and is usually double vac sealed with pretty good stealth. What do you guys think the odds are that dogs in Europe can smell these concentrates?
[1 Points] Giggles568644:
I run a GLiNET box with bitcoin paid VPN between my router and DNM laptop hardwired, people think a VPN is overkill..... I'm thinking Bout adding a second VPN layer XD
TAILS VS. WHONIX: A SEMI-QUICK PRIMER
In the security world, there is no 'magic pill'. Different tools exist for different jobs and 'one size does not fit all.' However, I often see "use Tails" being offered as advice, even though someone's scenario is better addressed via a different approach, namely Whonix. Now, Tails is great, don't get me wrong. But it has advantages and disadvantages, the same as anything else. So does Whonix. Many of the aspects of these two systems are complex, so this is a very quick primer rather than an exhaustive exploration of the two (which is deserving of a standalone post). It is not an all-inclusive list of the strengths/weaknesses nor is this an instruction manual of any sort. This is just my fairly quick contribution to "Security Saturday."
USE CASES:
Tails: As an 'amnesic' system, Tails is most useful for scenarios where you run a higher risk of LE physically confiscating your equipment.
Whonix: Not amnesic by default, but the baked-in stream isolation (more on this below) provides far better protection against activity-correlation in addition to preventing IP address leaks (more on this below). Ideal for scenarios where your greatest threat is 'remote' (e.g., hacking from LE or others).
LEARNING CURVE AND TECHNICAL REQUIREMENTS:
Tails: Lower
Whonix: Higher
PROS:
Tails: Amnesic - System runs in RAM by default and does not retain logs/settings upon shut-down/restart. This creates a very significant hurdle for anyone wishing to perform forensics on a captured computer.
Whonix: Stream isolation - Different protocols/ports (e.g., http(s), IRC) are isolated from each other (read: use different circuits through the Tor network) with some, like 'websites', being isolated even from other website connections. This makes 'traffic' or 'activity' correlation incredibly difficult as all your Tor traffic isn't going through the same 'pipe.' IP address leak protection - Whonix makes use of two virtual machines (VMs). One serves as the actual Tor gateway, the other is your 'workstation' whose only connection is to the gateway VM. This prevents the workstation from even knowing what its own external IP address is (because technically it doesn't have one). And what it doesn't know, it can't leak...even if the workstation is infected with malware.
CONS:
Tails: No stream isolation. No additional IP address protection.
Whonix: Not amnesic. Much higher learning curve compared to Tails (though still easy enough if one can follow the typical Linux-type directions which can be confusing to the uninitiated), and requires a little more powerful computer in order to run the host operating system and two VMs (less of a concern these days).
THREAT VECTOR:
Tails: Remote access - Higher risk vs. Whonix. Local forensics: Much lower risk vs. Whonix
Whonix: Remote access - Much lower risk vs. Tails. Local forensics: Higher risk vs. Tails.
PARTING THOUGHT: