the_stc

The point is to remain user-friendly while hiding the actual webservers, databases, and anything else that LE might want to take. An onion-routing proxy is easily setup and torn down and moved around quickly, making it a harder target for persistent surveillance.

Facebook said they just looked for Facebook and got very lucky. corewww does not have a lot of meaning.

We tried the same thing for PinkApp and got all sorts of much-longer matches that we could retcon into meaning something.

That does not solve anything. It just means the addresses are so long you are guaranteed no one is eyeball-comparing them. This makes phishing easier.

But DigiCert says they are no longer issuing them. Probably because the .onion is an 80-bit truncation of a SHA1 hash so it doesn't meet baseline reqs?

This is why we need SSL certs for .onions. DigiCert was doing this, but they told me it is on hold. Maybe when V3 hidden services are out?

With an SSL cert, you get a cert for your .onion PLUS your clearnet domain. Then users can access the .onion and see your real enterprise's name.

This should be doable even for extrajurisdictional companies like mine. The key is that your clearnet site should be a TCP-level proxy to the hidden service. That way the SSL keys are never on an easily-discoverable system so only IP addresses can be logged, not any contents. Slight plug: Here's the tech design for our system: https://medium.com/@PinkApp/pink-app-trading-latency-for-ano... (ignore the clickbait title). This should work just fine for .onions too, even with the clearnet entry point. For a DarkNet Market, most small buyers are probably safe visiting over clearnet.

What is Peter referring to when he says there's no reproducible builds?

2^80 is not very weak. That's the level of brute forcing a SHA-1 collision. It's low for a new system, but not very weak.

I agree with your 20%/10% comments, but I do not know why you call ZCash an investment. Zcash should discourage people from investing, like Monero does. Be a privacy coin, do not try to get in on the moon and lambo hypetrains if you want to be taken seriously.

There is no good justification for 20% right now. ZEC market cap is half a billion today. Do they really need that extra 50 mln now versus over time? Feels greedy.

But with so much taken by them that way, does that not reduce their desire to get a backdoor?

At any rate, all of this ceremony and your measures seem, as you say, hocus pocus if you're not building from known source! Forget hardware attacks! How can they not have the basics of a secure toolchain?!?

Did some participants at least publish the source they used and hashes of the toolchain and environment?

At my startup (details in profile) we will end up depending on crypto (among other things) to stay out of prison. Monero is hard to use, privacy wise - EABE and EWE attacks are our concerns. At least with ZCash the model is fairly easy to understand with shielded transactions. Much easier than figuring out ringsize and traceability there. But the Monero community seems better with no 20% take, no central company, none of this trusted nonsense. And no odd comments by both founders that require lots of mental gymnastics to make sense of. Not that any of this should matter. ZCash should be trusted on its own merits regardless of the inventors. Monero has anonymous inventors which could be the NSA for all we know.

Alas I am in no position to analyze ZCash math vs RingCT but my feeling is the latter is more understandable and thus might be more secure even if it has much weaker safety promises.

What does SW activation have to do with it? Why not have it ready to go, wait for the flip, enable. Or deploy it on a testnet. Or on LTC?

But detecting cheating and withdrawing requires you to have client software online and monitoring. Which individuals can not do and thus will outsource it to their payment handling company which will probably be the same as the LN hub.

Most people live month-to-month at best. It seems not real they can open a single channel with all their purchases for the year.

>short term lightning

Can you clarify what this means? Last I read, Lightning was 18 months out. But not really, that's just a number tossed to a crowd. The preview tech published a month ago is nowhere near being ready for use.

I had one of our investors write us and say he was really counting on our success to pay some family bills. I told him he should back out, that no investment is a good idea for bills. Much less a startup! Much less an illegally operating startup that depends on cryptocurrency! I'm sure of our model, but damn.

Not many of them! Even the ones that are sincere, often have terrible ideas. Or purely unworkable ideas or no business model.

It makes it hard for legit people like my startup. We're actually using tech for an end case, not building tech on top of tech for tech's sake.

Pink (www.pinkapp.io) | Extrajurisdictional | Designer/Front End Developer, Security Engineers | REMOTE

Take part in building the libertarian, cypherpunk future. Pink is an anonymously operating escort agency. Using blockchain fundraising and privacy tech, Pink will operate in a way other companies cannot.

Pink is hiring graphic designers/front end developers as well as security engineers (emphasis on network and appsec). We prefer to pay via cryptocurrencies, pegged to the currency of your choice. Strong salaries and great stock packages.

Join us in making sex work more accessible, safer, and smoother for everyone. Contact us: humans@pinkapp.io

This is one reason why we're excited about our company (info in profile). By operating anonymously, we can choose ethics over legality. By erring on the side of sex workers, we can shift some of the power away from abusive clients and review culture. Since we are involved in every transaction and serve as a commercial focus point, we can encourage unions and collective action.

Not starting worldwide. Launch city Toronto. There are essentially no jurisdictions where we'd be legal. Places that have legal sex work usually make surrounding activities legal. Places where it's fully legal have regulatory issues we wouldn't pass.

US targeted for mid-2018 after we have a few cities smoothly operating.

agree

I know, but it's the history of the person I'm looking at. Monero could well have weaknesses. That's why I don't rely on it. In fact, I know it has weaknesses. Monero's problem is they do not adequately tell people how to use it safely. The marketing is all about how Monero is safe, not about its limitation. Dangerous game for them to play.

It's not about rolling own crypto. My understanding is that zcash is more risky due to the newer concepts involved.

This is all theoretical right now anyways. Without more support for shielded transactions, it isn't feasible to use zcash to clean Bitcoin or other cryptocurrencies. Exchange volumes of XMR-ZEC are also too small from what I can see to make stacking them useful.

That said, we are reconsidering things. We will probably add zcash as a payment method sometime this week.

KGill if you have a specific criticism that we're being irrational, please contact us. Info in profile.

This country was founded on taunting men with guns and winning. Every bit of social progress does too. I am a small actor in comparison but the ideas are what matters.

We are not doing an ICO. We are offering shares like any well-meaning enterprise should do. Anything less is disrespectful to investors.

We are using blockchain fundraising because tech is good enough to give us enough privacy to operate. That's all. We are not some guys in a basement thinking blockchain & Javascript will fix sex worker problems.

There is no invincibility complex. We are acutely aware of the risks. I just believe I am good enough to get the project working and stay ahead of LE until we can take a more hidden approach and reduce our opsec surface area.

> ... SEC won't care if investors are OK, yes.

Hastily written comment! Should read:

> SEC won't care whether investors are OK

I am admitting it is irrelevant as far as legality goes. My point is that if investors are not being defrauded then it lowers our priority. If we defraud investors then they will complain to the SEC and make us a higher priority.

And for all, it is besides the point. We must have strong opsec and technical measures or we fail.

You're right, opsec is stressful! That's why the core team's plan is to get the system running and then hire people to handle interactions. We will focus on things in the background. The core team will only use high-latency-methods like email. That reduces our opsec footprint very much.

And our contingency plans will enable another team to pick things up to restore from backups und continue operating.

I never suggested morality will prevent a judge or jury. Just that doing fewer bad things results in fewer complains results in less likelihood of spending prosecutor effort on us. But probably when our share price hits $25+ we'll be big enough that someone will decide to go after us for real.

If our opsec fails, I'll end up in prison, very probably. That's what contingency plans are for: the project can keep operating without me. Meanwhile that's going to take a ton of effort and time, so I can the project to a point where I'm not vital.

Lawyers opinions are the same. No lawyer will advise their client to be the founder of an illegal enterprise. This is not much of an insight. Other than that, most lawyers are not capable of assessing opsec risk.

I am unable to judge zcash and must rely on other cues. So when the founders seem to be saying they're OK with backdoors, it makes me think hey, given the chance maybe there's something they could do.

Anyways once they get mandatory shielded transactions I'll look at it in more depth and see if I can get comfortable.

I don't mean it in bad faith. I am one of the people you and Zooko talk about preventing from using zCash. That's very offputting and since I cannot audit zCash it makes me nervous. People tell me zcash is very advanced and thus hard to understand and audit for other people too: newer crypto.

I am not implying any backdoor, just that it seems you are sympathetic to such works. I don't follow Zooko's explanation that he wasn't talking about zcash but about some other unmentioned layer. If it's a generic statement about all currencies, why bring it up and mention zcash in the same breath?

It's our view that the SEC part won't be what pushes us over the edge. 100% what we're doing is not legal, it's in our business plan. SEC won't care if investors are OK, yes. But if investors are OK, they won't be filing complaints and there will be less pressure to go after us. Not a defense! Just a delaying factor. Prosecution isn't free. Far easier to shut down ICOs that aren't operating as proper anonymous extrajurisdictional companies. They can go after us, but it's a terrible ROI for them.

But that is not what we're counting on!

Basically we asked: What if everything related to sex work was legal? What would the inevitable startup look like? With modern privacy tech, we can attempt to try it. We can ignore legal issues by operating extrajurisdictionally and anonymously.

This article discusses our technical setup: https://medium.com/@PinkApp/pink-app-trading-latency-for-ano... - excuse the clickbait title. Please let me know the flaws you see! Latency could be a killer, but we think we can mitigate it.

The core team, people that know real-world ID, are very few. Within a few months we plan to move nearly exclusively to high-latency communication methods.

By having trustless contractors run public-facing aspects of the business, the core team's opsec attack surface is drastically reduced. We have contingency plans, so even in case of arrest or death, the system can be restored from backup. Maybe one day there will be private mature smart contracts and we can codify it. Meanwhile we'll rely on lawyers and other trusted parties.

It may sound crazy ... a libertarian cypherpunk dream. But think how if you told people that it'd be popular to send non-refundable Internet money to a hidden internet service that promises to give it to an anonymous drug dealer on the other side of the planet to mail you drugs via the US Postal Service and that people would willingly trust them and it'd all be safer than using the street ... well people would have called you crazy! Yet it's popular and darknet services do exist that haven't had their operators busted.

That's not an explanation. It's just an assertion they'd not do bad stuff, ignoring what he previously tweeted. Neither is his stuff about it being compatible with law enforcement. A real explanation would follow through the thought and say exactly how they can make zCash "too traceable for criminals".

Especially when Green has his own quote saying they're OK building backdoors for police.

Or maybe that is their entire plan. Say something slightly sketchy, knowing any real criminal will be too paranoid to trust it. Worked for me.

We agree. For instance, we have a very strong anti-drug stance, despite not thinking it's immoral. We just don't want to draw unnecessary attacks against our platform.

The SEC thing was probably unavoidable anyways.

Exactly. Being ethical is more important than being legal.

To be fair, our entire business model is illegal in the US, and mostly illegal in many countries. We already have to deal with the penalties for running an escort agency.

On the plus side, it's a good business model so our chance of success is pretty high. If we end up having good returns, there will be less complaints and we'll be less of a target for the SEC organically.

We intend to be the first blockchain-funded cypherpunk unicorn. It would set a bad precedent if we didn't treat investors fairly.