Storing Customer Information Locally (and safely(*))

There was a thread telling vendors NOT to store any information on their machines. While that would be the ideal solution, it is not the one people will always use. I pointed out hidden volumes in the comments and it got some attention, so I figured I'd make a post about it.

How it works: https://veracrypt.codeplex.com/wikipage?title=Hidden%20Volume

A hidden volume is a volume that will only be visible if you type the right password into the bootloader. Otherwise, it will look like empty space on the end of the partition table. This is useful for vendors, because they can give LE the password to the decoy volume, with no real incriminating evidence, and LE would not be able to access or otherwise prove the existence of, the hidden volume.

*It's still better to delete all the data, but if you must.


Comments


[7 Points] Vendor_BBMC:

I only have a couple of customers who need me to keep their shipping details. I used a pen and paper to foil the NSA's multi-billion dollar electronic surveilance coumtermeasures.

If you order from the same vendor regularly, don't insist on him forgetting your name and address. It just means you will have to encrypt it again and get it past law enforcement agencies again and again and again and again and again.

your details are all over every marketplace's servers because of this paranoid insistance. Its fine for one-off orders, but not with vendors you've been using for years.


[2 Points] lordredvampire:

Veracrypt should remove PIM. It looks too suspicious to LE, especially forensic scientists.


[2 Points] polaroidandroid1:

tHIS.

veracrypt.

this software also has a decoy, you can type in two passwords - one opens up the partition with your sensitive information (the type you want to hide from LE), and the other password can open up a partition with just some music or video etc.

And its been audited by a third party firm that there is now way to prove that two partitions exist inside a veracrypt volume.

Best solution imo for saving sensitive information locally.


[1 Points] PirateRadioSignal:

Could you not create an alternative pgp identity and encrypt the data you MUST save and hide it separately on another USB? Then just decrypt it if needed, no?

Not saying you aren't giving solid advice, only that in my experience, of it isn't simple enough, users won't willingly comply without serious incentive, and not everyone takes these things as serious as they should, ala the barbs.

I not Barb bashing. I saw one on the priv sub hand out a full name gmail account to quantik ON the open forum post in the priv sub..

How bad can it be? Name, asking about orders, names amounts and dates.. Like, really? In the same post you doxxed yourself in?

It is not the norm, but these retarded unicorns DO exist.


[1 Points] None:

[deleted]


[1 Points] Vendor_BBMC:

Why would you want your info stored digitally on a device connected to the internet?

Like stairs to a dalek, nothing fucks with secret government evesdropping programs like a pen and paper, and sometimes the hi-tek way isn't the safest way.

In 1982 during the Falklands conflict radio encryption was in it's infancy, so British warships kept their communications secret from their Argentinian enemy by having a communications officer from Wales, and speaking in Welsh.

Decrypt THAT mess of Ls and Ws if you can, Diego!

You Americans are so lucky the founding fathers weren't from Swansea, or you'd have more than the words "dustbin", "autumn" and the spelling of "colour" to deal with. Taffs, Jocks and Paddys have all got their own pointless native languages. Instead of New york and New hampshire, Sinatra would have been singing about New Llanfairpwllgwyngyllgogerychwyrndrobwyllllantysiliogo - the place name on the longest railway station sign in Wales. That's a PGP key, not a place name as far as I'm concerned. If you're welsh, it just rolls of the tongue.

What were we talking about?


[1 Points] highbillymays:

interesting info thanks


[1 Points] bobbiggs69:

Great post!