💎AFTERPARTY💎 | ✈️FAST SHIPPING✈️ | 💎QUALITY SERVICE💎 | 🌐WORLDWIDE FAST SHIPPING🌐 : Archetyp | Torhoo darknet markets

The reason auto encrypt removal won't be a thing in my opinion at least is because it offers a better option than cleartext. You're completely right on the human psychology part least path of resistance will be taken by most. You're right it can be a double edged sword too.

But in the absence of any auto encrypt option all those addresses would be without a doubt in cleartext. It's a choice between definitely cleartext or potentially cleartext. If anyone wants to go beyond they would in both cases.

Having auto encrypt isn't inherently bad. What's actually bad is not fostering a culture of learning and improving. With the recent Archetyp situation Dread and specifically /u/HugBunter did exactly that. Made people think, learn and look at the situation on their own using their own brain cells.

You can't expect newcomers to be opsec masters on day one that's not realistic and the higher the learning curve the less people will try. But if every market promotes by popup every time you click on auto encrypt or flashing banners about the dangers of not encrypting yourself then things can change gradually. Another example to push for improvement would be markets to allow only a certain number of times of a buyer to use the auto encrypt option and give vendors ability to accept PGP encrypted messages only.

Names/addresses found in a drug drug deal will be stored on a database. And LE works very closely with the postal services. Which means not only buyers can be found easily, but also vendors can be found through many correlations.

That's another point to have auto encrypt option actually. Initial discovery of a relationship between a buyer and a vendor is very likely happen through delivery methods. The next step would be to monitor or intercept the buyer package as the vendor is a harder target. The most likely scenario would be LE to reach the buyers account first. Now let's think about it for a second.

If the buyer had made multiple purchases and he was lazy (path of least resistance per your words) he would have left it all in cleartext. LE logs into his account looks at past orders and sees vendor notes (if enabled) in clear text. They bust the vendor same again cleartext in vendor notes. They bust the market again cleartext in database.

If the market had auto encrypt the path of least resistance would apply again and the buyer would have used it to click a small box and encrypt it with PGP (at least on paper). LE logs into his accounts looks at past orders and see PGP encrypted notes. When they bust vendor if he kept his PGP key safe they would see encrypted notes only. They bust the market and in the database they see encrypted vendor notes.

Which scenario is better?

I spent over a year learning everything I possibly could about pgp/gpg/GNUPG/encryption. I learned basic commands on my terminal, practiced pgp commands, created cheat sheets of commands, familiarized myself with key servers. Spent many hours reading thru the GNU Privacy Handbook, deciphering the jargon. Refering to all kinds of data sources, Github research, reading thru so many comments. I even enthusiastically joined internet pgp chat groups and asked others to help me practice sending encrypted messages, especially in the beginning when I thought the only functional interface was via the terminal with command lines. I was not very computer literate. Just an average computer user. Didn't know shit about crypto, encryption, OPSEC, TAILS, TOR, and on and on. I studied the DNM Bible, intently.
All of that so that I could use pgp properly. I thought everyone used it the same and that I was some dumbass Gen-X freak that had a lot of catching up to do. Finally I was confident and minimally competent enough to engage with the entity of interest. Then I saw... auto-encryption? WTF?

Markets should absolutly take auto-encrypt off. Dread wont let you in if you have java enabeled, so why should markets let you send compromising info that you didn't encrypt yourself? But like you said auto-encrypt is the easier choice for uninformed or lazy buyers, so those buyers will just go to the easiest to use market, and the markets will just worry about covering their asses

How can you be sure about such poor OpSec? If I were to set up a marketplace, I would directly encrypt the user’s message or address with the receiver’s public key, without saving it to a database beforehand. If you save it to a database first, you might as well send the plaintext

I wrote a Guide to Making Small Purchases years ago. This is what I think of server side encryption.