Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Vendor Changed PGP Keys : OpSec | Torhoo darknet markets

Unsure of what protocol looks like for this. Did my first deal with BidenDaddy on arch at the start of the month. Custies liked it so I went to place a bigger order and all of sudden the vendor's pgp key has been changed. I was looking at the desciption and I noticed that they had a few orders not scan in a few months back. I guess I'm just a worried that there is a potential compromise. The new pgp on the profile isn't the same as the one on dread either. Just a bit sus rn ngl

/u/vitamphetamine

1 points

3 months ago

The correct procedure for changing keys is signing the new key with the old one. So if you've imported the new key (no harm in that) run gpg --list-keys, find the one you're looking for and run
gpg --check-signatures KEY_ID
(KEY_ID is the long hex-number shown before the key's name and email). If you had imported the old key you should see the number of "good signatures" in the resulting output. If you didn't, run the above command with "--show-signatures" instead of "--check-signatures". You should at least get the IDs of the signer(s) as a result. Decide yourself if you trust them.

/u/BidensWarAid

2 points

3 months ago

/u/asfaleia ⚔️ασφάλεια⚔️

2 points

3 months ago

Can you ask the vendor for his original key signature for the new key? if he is not able to provide that, it could mean compromise. This would work only if the vendor didn't have the 2-factor authentication enabled, otherwise he would not be able to get to the account without the PGP private key.

You can also try to contact the website admin and check with them for vendor's suspicious behavior.

/u/sl0sh

1 points

3 months ago

Do you mean their comms key? I know some (all?) vendors change it on a monthly basis. They may have just forgotten to update it on Dread.