hushmail safety??

[Trendsetter21]

Honestly, there's alot of uncessary paranoia in your plan. The way these labs were busted and the fact that they got their emails blows your entire plan apart as a consumer.

As far as fake addreses. How do you plan to receive your ster.oids?

If you guys read what I wrote, I've never done this and this guy at the gym was telling me what he does. I thought it was interesting so I posted it. I can't really answer any questions you have. As a tech guy I understand what he was saying. If you create an email account with a fake name and address to order the stuff. Then use fake name an address on WU form how could it be traced to you. When you send the WU information thats when you send real shipping address. Thats what I was told. Just posting it as a means of how to minimize getting caught. Personally I say go to a HRT place and pay for it legally.

 

[muffinmaker]

Like already stated there is no secure email. If persay you were looking to do this stuff an have minimal chance to get caught this is what you do. (This guy at the gym told me about his routine when he was trying to get me to order stuff, but I won't take steroids illegally, I will do HRT next year though)

1. Get a cheap laptop from someone in the paper or whatever. They won't know ur name or anything.

2. Make sure it has a wireless card, then be sure to drive around until you can find a connection.

3. Place your order and only use that computer and different connections in different locations when you want to check those emails lol.

4. Do not leave the computer at your house obviously, if you can leave it with a trusted person that you don't call with your landline or cell phone. This makes it almost impossible to tie orders to you because they can't find the computer you did stuff with. Even if they use the dealer's how are they going to prove it actually is you if its not your ip address and there is no hard evidence tying you to it.

5. Western union money with fake names and addresses and stuff obviously

The only trace to you is obviously the substance but if you dont' have it at your place either theres really nothing tying you to anything. It really isn't that easy to get a warrant and borrowing other peoples internet with a computer that you don't have at your residence will make it impossible to tie stuff to you. It sounds pretty secure, any other ideas? His idea seems very good, and anyone that is too lazy to go the extra 100 miles should also remember the consequences that can happen. All I know is if I was doing this stuff. I would make sure I had every i dotted and t crossed lol.

Fraud is always a great charge to add on

 

[sincere81oo0]

why are you guys freaking out still???? has anyone had aknock at there door yet?? when they start knocking on doors for personal users then worry me, but as of now there are no reports of this correct?? stop bugging out, unless your erdering a couple hundred bottles for resale or something i dont think they are going to waste there time..... personal use is like with any other drug, not sure what they can ge you on but even when people get busted with persoanl stash of drusgs they usually go to rehab..... i would really like to see how they handle personal abuse of steroids in the courtroom lmao.... think they will send bros to rehab??? lol lets see when it happens....

 

[muffinmaker]

why are you guys freaking out still???? has anyone had aknock at there door yet?? when they start knocking on doors for personal users then worry me, but as of now there are no reports of this correct?? stop bugging out, unless your erdering a couple hundred bottles for resale or something i dont think they are going to waste there time..... personal use is like with any other drug, not sure what they can ge you on but even when people get busted with persoanl stash of drusgs they usually go to rehab..... i would really like to see how they handle personal abuse of steroids in the courtroom lmao.... think they will send bros to rehab??? lol lets see when it happens....

Well the thing is, it would happen immediately, they have tons and tons of emails and info to go through.

 

[digger]

With this option, you'd be vulnerable to a man-in-the-middle attack or data sniffing (since the email isnt encrypted until it gets to the Hush servers)

It's an https connection, and SSL isn't all that bad.

 

[Mavafanculo]

It's an https connection, and SSL isn't all that bad.

no, it's not. I lapsed into Int'l Banking ass-covering mode for a second lol.

For what we're talking about here, the exposure isnt great I guess, and you'd already have to be the target of an investigation.

Last I recall to break a 128 bit it would probably take "...a large bank of supercomputers a few weeks....." or words to that effect.

I dont think the NSA will devote that to 100 dbols lol

-

 

[jh1]

no, it's not. I lapsed into Int'l Banking ass-covering mode for a second lol.

For what we're talking about here, the exposure isnt great I guess, and you'd already have to be the target of an investigation.

Last I recall to break a 128 bit it would probably take "...a large bank of supercomputers a few weeks....." or words to that effect.

I dont think the NSA will devote that to 100 dbols lol

-

SSL also protects data in transport - not data at rest.

Which means it can afford less security due to other layers.

i.e. you'd have to be able to caputure the data real time as it travels accross networks you don't necessarily have access to. Whereas with the emails you can subpeona copies from servers where they are stored and take your jolly old time cracking away.

 

[Fidel_Castro]

Hushmail is still safe to use. Although I'd suggest using Open PGP at your desktop, if you are so technically inclined. There is still a way Law Enforcement will own you though read on...

Note that Hushmail must and will submit to subpoenas, but they don't have the ability to decrypt your mail (message bodies & attachments) so their response will include all your mail headers (To/From, Date/Time, Subject, IP Addy, Etc) in clear then an PGP encrypted mail body. At no time does Hushmail receive your passphrase.

The problem here is that people are confusing anonymity and privacy; they are two very different things. Hushmail provides privacy, but does not provide anonymity. If one is engaged in potentially illegal activities, it is necessary to be *both* anonymous and private.

PGP, as the name implies, is Pretty Good Privacy--it provides an excellent level of privacy, but in and of itself, does not provide anonymity. Anonymity is provided by anonymous remailers, of which there are currently two classes: cypherpunk and mixmaster. (There is a third class, mixminion, but it is still in an immature stage of development.)

Another specialized type of remailer is the nymserver; as its name implies, nymservers allow one to use PGP/GPG to setup a pseudonym, where one can send/receive email securely.

If one uses a chain of mixmaster remailers to setup/use a nymserver account, this effectively breaks the link between your own IP address and that of the nymserver.
The nymserver operator, even were they to be subpoenaed, would not have your IP address to give to the authorities. All that the nymserver operator has to give to the authorities are:

1) My PGP public key, and 2) my reply block.

In my case, my PGP key is 4096-bits, or twice the size of the 2048-bit keys used by Hushmail. Frankly, neither 2048 nor 4096 keys will be vulnerable any time in the near future. My reply block is a PGP-encrypted, specially-formatted text file. The reply block tells a remailer where to direct any replies that are sent to my nymserver account.

My nymserver account has been setup to send all messages to an anonymous message pool. In practice, this usually is the Usenet newsgroup alt.anonymous.messages. (This is just a high-tech version of the "dead drop" used in espionage tradecraft.)

I'll explain the rationale behind this choice a little further down.

Unlike Hushmail, the nymserver does not have my private PGP key. My private PGP key only exists on my hardware, where it was initially generated. Brute-force password attacks against my private key are not possible, since an attacker cannot get access to my private key. The fact that your private key is available to law-enforcement with Hushmail is why it is so important to use a strong passphrase on your Hushmail accounts, if you must use Hushmail.

Here's how the process works:

i) Someone sends me an email message; the nymserver takes this message and encrypts it with my public key;

ii) The nymserver takes the encrypted message, prepends the reply block to it, and forwards it to the target remailer associated with the reply block.

iii) the target remailer decrypts my reply block, and carries out the instructions found inside.

Let's assume for a moment that the nymserver operator were to be served with a warrant under MLAT and forced to hand over my PGP public key and reply block. All they would have is a public key with an address of say, [email protected] No clues to my real identity here. As for the reply block, it is encrypted to: [email protected] over in the Netherlands. So the authorities would have to get their Dutch counterparts to get a warrant and approach the remailer operator over there to decrypt the reply block.

So the replay.com operator takes the reply block from the police and decrypts it., like they asked. Here is the decrypted reply-block that the authorities get for all their time and trouble:

::
Request-Remailing-To: [email protected]
Encrypt-Key: blah_blah
Encrypt-Subject: dKBJDCd2tZqidpxiAJME9Q

##
Newsgroups: alt.anonymous.messages
Subject: I love paris in the the spring!

**

The Request-Remailing-To: line points to a mail2news gateway that posts to the Usenet group found in the Newsgroups: line, in this case alt.anonymous.messages.

The Encrypt-Key: directive tells the remailer to further encrypt the already-PGP- encrypted message with the symmetric IDEA cipher, using the string "blah_blah". The reason for this is to prevent any adversary from combing through the messages in alt.anonymous.messages looking for messages encrypted with my PGP public key.

Similarly, the Encrypt-Subject: directive, as the name implies, encrypts a hash of the message subject, thus ensuring that the Subject line showing up in alt.anonymous.messages changes constantly. This is to prevent an adversary sending say, 20 or 30 or 50 messages to my nym account and watching alt.anonymous.messages to see a spike the number of messages with a particular subject line.

In other words, these measures ensure that no attacker can determine which messages in the pool are mine by:

a) trying to see which messages are encrypted to my PGP public key; and
b) watching for messages with a particular subject line.

Now an investigator, who has obtained the decrypted reply block under warrant, _has_ sufficient information to determine which messages are mine in the anonymous message pool. Using a package like AAMfetch, they can insert the values found in the reply block and download all the traffic in the message pool associated with my nym account.

However, they still don't know who I am, or where I am located. They also still cannot read my messages, as they cannot break the PGP-encrypted messages.

If the feds are able to unencrypt, they will - but it is very doubtfull that such resources are brought to bear for a law enforcement issue over drugs. Typically such resources are found in the intelligence community - specifically the NSA and other federal agencies draw upon that pool - but it is highly unlikely the NSA would devote resources to such trival matters.

If you're getting owned by law enforcement on your encrypted mail, they have most likely owned your computer - so in that case, nothing will save you - you need to be more dillegent.

Here is a recent bust by the DEA over MDMA - they installed a keylogger to capture passphrases for a hushmail account:

http://www.news.com/8301-10784_3-9741357-7.html?part=rss&subj=news&tag=2547-1001_3-0-5

So if hushmail can provide clear text emails on administrative subpeonas - there is no way they'd bother to suripticiously install keyloggers. But that keylogger mentioned in the above article would own your ass no matter what you were doing to encrypt your communications.

In order to install a keylogger, they first have to be able to find you. The only way they could affect you without knowing who or where you are, would be to get you to carry out some action, for example, visit a trojaned web site, or trick you into installing some malware that would send your IP address, etc. to them.

For those interested in privacy, anonymity and techniques to accomplish this, I would recommend paying a visit to the Usenet newsgroup alt.privacy.anon-server. Dr. Who's FAQ is frequently posted there, and it is an excellent introduction to these subjects, particularly for Windows users. The latest version of Dr. Who's Encryption & Security FAQ (22.6.4) was posted on October 1st in alt.privacy.anon-server. The Message-ID: is: <[email protected]>. I have verified his PGP signature on this particular version. (If it has expired with your newsserver, it may still be available through Google Groups.)

Here is a link to another tutorial: http://www.iusmentis.com/technology/remailers/nym.html

Most of the information is accurate, although dated. In particular, nym.alias.net is NOT recommended any longer, as they haven't changed their public key in more than 10 years! (Nym.alias.net is/was a student project--it has been run by a succession of student admins over the years. It tends to be erratic, and heaven only knows how many copies of nym.alias.net's private key are floating around. Ten years ago it ws top-notch, today it is no longer recommended--there are other nymservers out there that are much better-administered.)

Finally, here's a link to a 96-page court document with respect to the MDMA bust and keylogger installation.

http://politechbot.com/docs/forrester.alba.dea.key.logger.070907.pdf

I could elaborate further, if anyone is interested. If anyone wants to email me, they can do so at: [email protected]. I've already uploaded the public key for this account to the hushmail key server.

Fidel Castro <[email protected]>
PGP-Key: 0x9703892
Fingerprint: CFF2 9E40 8C8B 8A03 14DB D51C 44A2 2578 0970 3892

 

[ironclaw]

don't use hushmail for correstponding with sources anymore, its not safe, you just got to assume the LE motherfuckers are reading your shit. get another encrypted way of using email.

 

[jh1]

The problem here is that people are confusing anonymity and privacy; they are two very different things. Hushmail provides privacy, but does not provide anonymity. If one is engaged in potentially illegal activities, it is necessary to be *both* anonymous and private.

PGP, as the name implies, is Pretty Good Privacy--it provides an excellent level of privacy, but in and of itself, does not provide anonymity. Anonymity is provided by anonymous remailers, of which there are currently two classes: cypherpunk and mixmaster. (There is a third class, mixminion, but it is still in an immature stage of development.)

Another specialized type of remailer is the nymserver; as its name implies, nymservers allow one to use PGP/GPG to setup a pseudonym, where one can send/receive email securely.

If one uses a chain of mixmaster remailers to setup/use a nymserver account, this effectively breaks the link between your own IP address and that of the nymserver.
The nymserver operator, even were they to be subpoenaed, would not have your IP address to give to the authorities. All that the nymserver operator has to give to the authorities are:

1) My PGP public key, and 2) my reply block.

In my case, my PGP key is 4096-bits, or twice the size of the 2048-bit keys used by Hushmail. Frankly, neither 2048 nor 4096 keys will be vulnerable any time in the near future. My reply block is a PGP-encrypted, specially-formatted text file. The reply block tells a remailer where to direct any replies that are sent to my nymserver account.

My nymserver account has been setup to send all messages to an anonymous message pool. In practice, this usually is the Usenet newsgroup alt.anonymous.messages. (This is just a high-tech version of the "dead drop" used in espionage tradecraft.)

I'll explain the rationale behind this choice a little further down.

Unlike Hushmail, the nymserver does not have my private PGP key. My private PGP key only exists on my hardware, where it was initially generated. Brute-force password attacks against my private key are not possible, since an attacker cannot get access to my private key. The fact that your private key is available to law-enforcement with Hushmail is why it is so important to use a strong passphrase on your Hushmail accounts, if you must use Hushmail.

Here's how the process works:

i) Someone sends me an email message; the nymserver takes this message and encrypts it with my public key;

ii) The nymserver takes the encrypted message, prepends the reply block to it, and forwards it to the target remailer associated with the reply block.

iii) the target remailer decrypts my reply block, and carries out the instructions found inside.

Let's assume for a moment that the nymserver operator were to be served with a warrant under MLAT and forced to hand over my PGP public key and reply block. All they would have is a public key with an address of say, [email protected] No clues to my real identity here. As for the reply block, it is encrypted to: [email protected] over in the Netherlands. So the authorities would have to get their Dutch counterparts to get a warrant and approach the remailer operator over there to decrypt the reply block.

So the replay.com operator takes the reply block from the police and decrypts it., like they asked. Here is the decrypted reply-block that the authorities get for all their time and trouble:

::
Request-Remailing-To: [email protected]
Encrypt-Key: blah_blah
Encrypt-Subject: dKBJDCd2tZqidpxiAJME9Q

##
Newsgroups: alt.anonymous.messages
Subject: I love paris in the the spring!

**

The Request-Remailing-To: line points to a mail2news gateway that posts to the Usenet group found in the Newsgroups: line, in this case alt.anonymous.messages.

The Encrypt-Key: directive tells the remailer to further encrypt the already-PGP- encrypted message with the symmetric IDEA cipher, using the string "blah_blah". The reason for this is to prevent any adversary from combing through the messages in alt.anonymous.messages looking for messages encrypted with my PGP public key.

Similarly, the Encrypt-Subject: directive, as the name implies, encrypts a hash of the message subject, thus ensuring that the Subject line showing up in alt.anonymous.messages changes constantly. This is to prevent an adversary sending say, 20 or 30 or 50 messages to my nym account and watching alt.anonymous.messages to see a spike the number of messages with a particular subject line.

In other words, these measures ensure that no attacker can determine which messages in the pool are mine by:

a) trying to see which messages are encrypted to my PGP public key; and
b) watching for messages with a particular subject line.

Now an investigator, who has obtained the decrypted reply block under warrant, _has_ sufficient information to determine which messages are mine in the anonymous message pool. Using a package like AAMfetch, they can insert the values found in the reply block and download all the traffic in the message pool associated with my nym account.

However, they still don't know who I am, or where I am located. They also still cannot read my messages, as they cannot break the PGP-encrypted messages.



In order to install a keylogger, they first have to be able to find you. The only way they could affect you without knowing who or where you are, would be to get you to carry out some action, for example, visit a trojaned web site, or trick you into installing some malware that would send your IP address, etc. to them.

For those interested in privacy, anonymity and techniques to accomplish this, I would recommend paying a visit to the Usenet newsgroup alt.privacy.anon-server. Dr. Who's FAQ is frequently posted there, and it is an excellent introduction to these subjects, particularly for Windows users. The latest version of Dr. Who's Encryption & Security FAQ (22.6.4) was posted on October 1st in alt.privacy.anon-server. The Message-ID: is: <[email protected]>. I have verified his PGP signature on this particular version. (If it has expired with your newsserver, it may still be available through Google Groups.)

Here is a link to another tutorial: http://www.iusmentis.com/technology/remailers/nym.html

Most of the information is accurate, although dated. In particular, nym.alias.net is NOT recommended any longer, as they haven't changed their public key in more than 10 years! (Nym.alias.net is/was a student project--it has been run by a succession of student admins over the years. It tends to be erratic, and heaven only knows how many copies of nym.alias.net's private key are floating around. Ten years ago it ws top-notch, today it is no longer recommended--there are other nymservers out there that are much better-administered.)

Finally, here's a link to a 96-page court document with respect to the MDMA bust and keylogger installation.

http://politechbot.com/docs/forrester.alba.dea.key.logger.070907.pdf

I could elaborate further, if anyone is interested. If anyone wants to email me, they can do so at: [email protected]. I've already uploaded the public key for this account to the hushmail key server.

Fidel Castro <[email protected]>
PGP-Key: 0x9703892
Fingerprint: CFF2 9E40 8C8B 8A03 14DB D51C 44A2 2578 0970 3892

Good information here.


T.OR available at the Electronic Frontier Foundation offers the layer of anonymity required that can be couple with hushmail.

This stuff has to be easy to use... at least for 'customers'....

For anyone marketing or selling... they should take things to the next level ... .IMO