Silk Road forums

Discussion => Security => Topic started by: Safety First on June 21, 2012, 11:02 pm

Title: Maximizing Security as a vendor
Post by: Safety First on June 21, 2012, 11:02 pm
•••• READ "I would like to apologize for this vague thread but my head is such a mess, full of questions, constantly looking for things to improve making it difficult to fully express myself"••••

My dear anonymous friends,

I'm a starting vendor which has been a longtime OVDB member and has been a member of SR since 2011. I have made an fresh account for an obvious reason "security"  and i would like ask to ask the community kindly to help me with the same reason.

I want to maximize the security from any angle possible as my conscience doesn't allow me to vend before the safety of the customer is safe and of course my own security.

I did not want to work on a system that possibly could have flaws so i purchased a brand new notebook, i also was in possession of a bootable usb with ubuntu installed on it.

So here i am with a clean laptop, label printer, usb, software*, among with other items
* Tor, truecrypt, vmware workstation etc (suggestions greatly appreciated)


My first idea was to install Truecrypt on my notebook with a hidden volume (3 passwords, 2 dummy passwords and one for the secret volume)
Code: [Select]
however even after i did some research i wasn't able to find answers to my questions and i didn't want to (excuse me) fuck shit up and mess up my notebook so i've let this idea rest until i'd found someone that could guide me through the process.

On the hidden volume i would install VMware Workstation and run Tor from there (could purchase a offshore VPN with no logs as an extra security layer).

Second idea:
Then i tried to crypt my usb so i at least had one way that i could condone business (i tried to crypt from my notebook and on my usb itself) both didn't work.

So basically i wasted some time as i can't install the label printer on the USB thus making it useless, so i'd still have to crypt my whole laptop.

All suggestions, tips are welcome!


Q:
// When encrypting your whole Hard disk (Hidden)
1: Will you lose all your data? Can you screw up in such a way that your main OS corrupts?
2: Will you need to have the 'dummy' OS burned on a CD / have the file on a USB or can you simply have it on your computer?

I'd also would like to know what the dangers are of Truecrypt, what common mistakes are that might cause vulnerability's and other info that might come in handy.

I don't want to bother you guys with these questions but i tried, and i saw SR as the best place to find skilled people, and if you want a small fee for your help that's fine too :)

Thanks guys! And let's make this a informative thread for the whole board.

- Safety First.
Title: Re: Maximizing Security as a vendor
Post by: Safety First on June 22, 2012, 05:26 pm
Where are the security experts?
Title: Re: Maximizing Security as a vendor
Post by: oscarzululondon on June 22, 2012, 05:48 pm
OK so first technically it is possible to mess up the encryption, but the worst that can happen is you have to reinstall everything, you won't permanently damage any hardware.

You should just encrypt the entire laptop hard drive and put the "naughty" operating system as a hidden operating system. (Assuming you want to use Windows):

http://www.truecrypt.org/docs/?s=hidden-operating-system

You then get two passwords, one you tell the police which takes them to a clean dummy Windows, and another you keep for yourself and never divulge. They can't prove the naughty operating system exists due to plausible denyability because it just looks like empty or unused space on the hard drive so you're safe.

Even better is to use a specialist Linux operating system such as Tails which can run off a memory stick and leaves no traces on your laptop. There's thousands of guides how to get it up and running. It's a better option for you because all the dodgy stuff is on a memory stick which is encrypted and you don't have to worry about doing anything. It also deals with all your Tor etc for you.

Your printer will work fine with Tails on memory stick, it's just a case of finding the correct Linux drivers, just like you would have to find and install drivers for Windows. Also a VPN is good idea, but use it with Tails.  :)
Title: Re: Maximizing Security as a vendor
Post by: echo_ on June 24, 2012, 05:08 pm
I recommend total fingerprint awareness when packaging your packages. Wear gloves, and don't use tape or touch anything which could retain a partial or full fingerprint without them.