It saddens me to say that some vendors are still using 2,048 bit RSA keys.
Do yourself and your customers a favor and upgrade your deprecated key.
I could just message you all directly but I hope you come across this message.
Use ECC (ECDSA/EdDSA) or, if you have to, use a 4,096 bit RSA key.
I saw your post and I changed my PGP key. Changed to ed25519. Is this good? Sorry if this is a silly question, I am by no means a cryptographic expert. Thank you for the post.
Changed my PGP to ed25519 as well, however I also don't know too much about cryptography, is there anywhere you recommend that I can read up about the new stuff?
Absolutely. I'll provide you with links tomorrow. The Internet as a whole is shifting to ECC. Everything you make a bank transaction using SSL you are using ECC. RSA is slowly getting outdated.
I don't think so. RSA 4096 is still stronger than ECC (ECDSA/EdDSA) and will probably be for the next 20 years, depending how the development of quantum computers and their algorithms will progress. Search Stackexchange and MathOverflow for some info about it. Read this example: https://security.stackexchange.com/questions/171308/how-to-interpret-this-statement-against-4096-bit-rsa
I wouldn't be so sure about that. The world is moving toward ECC at large. RSA is just about compounding numbers. Even Kleopatra by default is now using ECC. Along with SSL/HTTPS globally.
We're using 4096 RSA currently. Do you recommend going through the hassle of establishing a new key using ECC? We'll need to look into ECDSA/EdDSA, I know nothing about it.
I guess that concludes their recent issues regarding the service. If you used DNMX for any kind of service, make sure to clean those accounts and migrate your data, possibly even burn if you can. This is also a good example of what happens to services that rely on legal loopholes to operate. Use remote infrastructure and do not rely on a single provider or service, or you risk getting raided.
For those who did not encrypt emails, let this be a major reminder of why you always should.
i hope you don't mean relying on the email provider to encrypt the messages with a provided key or etc. same thing with markets as soon as you give them control over that they can easily turn it into a malicious system of de-anonymizing everyone one by one with just a simple swap of keys on the backend if feds get control or admins go rogue and want to start a blackmail scheme.
Yeah /u/Bluefin I agree with you but DNMX Wont allow you to do any shit unless you Buy their Premium...Leave Deleting the Account they dont even allow to Change the password tho..........
Thanks Bluefin but I never used DNMX much anyhow - no regular communications - nothing.
But yes. Do encrypt your emails and even the files inside of them.
if the server hard drives were encrypted and the feds powered down the servers to take the drives surely there would be no data to recover? i've heard feds will just walk in and cut any cables that are plugged in that prevent them from physically taking the server
you will never know in this situation unless you have someone inside during the raid so its all speculation but like i've told others you shouldn't trust the admin anymore and burn anything related to DNMX. plenty of other options out there, don't risk your freedom because of loyalty to someone who could now be easily compromised.
It is a widespread misconception that the police simply seize servers and then power them off. In reality, law enforcement agencies make every effort to preserve the integrity of the data on the server. Shutting down the server can potentially cause data loss, especially if there are so-called 'wipescripts' that are active and automatically executed upon the server's startup. Such risks are unacceptable given the importance of data integrity in ongoing investigations.
Law enforcement agencies have specialized tools that allow them to connect their own power supply to the server, enabling them to disconnect the server from the data center's power source. This enables them to safely transport the server to their forensic laboratory while keeping it operational, preserving essential data and investigating potential traces of criminal activity without disruption.
Email is fundamentally insecure and requires active steps to make it secure. Active steps that people get lazy about and before they know it they're routing incriminating plain text through the clearnet and leaving a trove of info on someone else's machine.
Xmpp/jabber with OTR is all anyone needs for sensitive communications.
"Email is fundamentally insecure" — absolutely. Email is an insecure form of communication. And, just as you mentioned, it "requires active steps to make it secure". Very well stated, /u/squeaky_clean_sanchez
200GB emails backup'd sounds worrysome in and of itself.
Few other details also sound somewhat sketchy.
Just goes to show to never ever trust the source, regardless of anything.
Treat everything like it's compromised from the get go.
by /u/HeadJanitor • 6 hours ago* in /d/OpSec
Exactly. We are, after all, dealing with the darknet. We can't forget to include our environment into the bigger picture. All things on the darknet will come and go.
unless you are an informant for them with the amount of money you are talking the IRS would love to come after you alone. we are talking illegal funds alone in proceeds of what averages out to be $11904.761904762 on a monthly basis, especially if you are low hanging fruit and didn't encrypt or launder the money properly. these government agencies are a business like any others and thats good return on investment for them.
yea i honestly wouldn't trust anything related to the admin now that they had a warrant for the servers and unless he is willing to do hard time for contempt this could involve cooperation with means if he has the keys to the LUKS encryption to hand them over and who knows what else depending on if its child porn or weapons trafficking to then transfer all ownership.
I know. sorry. I should not even post if I am not willing to explain.
Maybe it was major in their eyes? no.. maybe they just wanted to spook my associate
It's something I can't put my finger on if that is the phrase to you.
i mean its in their constitution. you have to go through courts to just get the pleasure of no most likley. and that would be news worthy imo. the have newer laws pertaining to money. but communications still afford it being mostly illegal to be shared with foreign countries. there is no we are a private company we trust america here ya go. there are exceptions however. and as i said they would require a court order. and not hidden secret court orders either.
I suppose he would have to cooperate depending on what jurisdiction he is in. We definitely will hear about it in official statements in some time. Until then, god speed to the admin. The scene is very sad if it's come to this. Another reminder of why you should not trust empty words from admins saying they will never cooperate.
Most definitely. Will likely hear it in the upcoming busts related to the compromised data. Wouldn't be surprised is this was part of a coordinated larger operation as well.
why ? i mean its not like having a service that only caters to a specific user could be a bad thing? who needs hiding in plain sight. thats why cartels keep all their money in secret banks with names like cocaine profits be fat and meth to gold bank these banks can blend so easily and would never give the feds a hard on.
it really doesn't matter the government will come for any and all as soon as its part of an investigation worth the return on their investment. like everyone else says all you need is a non-javascript email provider and PGP encrypt all material
Not surprised... nothing is safe, unless you treat it as disposable. The regime hates guerillas, snipers, and counterespionage.
The idea that you can have a persistent account that is secure is very misconceived. The most secure way of using any communication medium is to use it only once, and in only one direction, and of course, to not put traceable data inside any correspondence.
If there is a place that contains an information it can be stolen. Encryption of emails is a must.
Besides the encryption be aware that email leaks all metadata even if encrypted - who, with whom, when, how often, for how long...one communicated with others. This will be leaked to the adversary too. Depending on your security posture it can be more dangerous than the content of the messages.
Adapt properly.
For higher security requirements use more modern solutions.
1) Keeping inbox and outbox clean is not going to work if the service logs it. They can say they don't but you cannot prove it.
2) Nymservers, remailers and other solutions can help but there are some necessary attributes of the secure communication that is otherwise available - PFS, backward secrecy, no identity and others.
It can be used but one has to understand that it is limitations and have it covered in their OpSec.
There are dealers on street corners all over the world. They make their money and run and don't think of the future. Just how much they can grab in the moment and be gone in the next moment.
Where did the message originate from? Who is the admin of DNMX and how do I contact him? If you are reading this please kindly delete e-mail address johnarcher@dnmx.org, thank you
Congratulations! You just bumped your email account up in the officer's "to read" pile. By asking for it to be deleted, they'll figure there must be something good in there worth looking at!
Despite the challenges, law enforcement agencies and investigators often leverage techniques reminiscent of those employed by hackers to identify perpetrators within the dark web. These methodologies may involve meticulous analysis of traffic patterns, covert infiltration of criminal communities, or the exploitation of software vulnerabilities within darknet access tools.
or
Utilizing a BTC address for donations to cover server costs. Law enforcement simply follows the money trail.
Sorry....I sent you a stupid DM re: backed up emails. Who is the person who was overseeing DNMX? I want to reach out and at least make an attempt to see if his backup claim is true. Can you DM me his /u/ ??
I have no idea who he is but I'm sure even attempting to make contact with him at this point will not be a sound decision. Sometimes you have to learn to walk away.
Do yourself and your customers a favor and upgrade your deprecated key.
I could just message you all directly but I hope you come across this message.
Use ECC (ECDSA/EdDSA) or, if you have to, use a 4,096 bit RSA key.