(untitled)

Hello dear Lains, I am a Twitterglitterboy who has a reasonably large following in crypto/cybersecurity/digital privacy communities. I am planning to create an e-commerce business that accepts Monero (and likely shielded Zcash, even though it glows), and focuses on maximizing privacy for customers. My business itself will comply with all laws in my jurisdiction, the USA. I want to make this as schizo-approved as possible. So far, I will try to make this happen without Javascriptz while still being tolerable for normalglitterboys, or I may have an option to use a version of the site with no JS, along with the user experience that follows from that being omitted. Addresses for shipping will be sent with PGP encryption, decrypted with a dedicated coreboot ThinkPad that has been physically airgapped by removing any networking components from the device. This device will decrypt addresses and print shipping labels. The PGP key will be stored on Yubikeys, or potentially some open source security key if that is viable. I, unfortunately, need to collect and record the state the customer is located in, along with the total monetary value of the shipments to comply with sales tax laws. All other data I have no legal responsibility to keep and will be deleted. I will be charging a ~10% premium on goods that I offer in order to make this a profitable venture, and my exact shipping structure I am still working out. I am considering offering the ability to have package tracking and insurance, but have that be opt-in, explaining clearly that this results in a customer's address being stored by both the shipping company and my company until successful delivery, upon which I will delete their data from my infrastructure. I will have a Signal or other e2e messaging service where customers can identify themselves with the unique Monero (or Zcash) address if customer support is needed on an order. Obviously, there will be no user accounts. I will have a normal https url, a Tor onion url, and potentially an I2P option. I really want to provide this service because it is totally legal here in the USA, and will (hopefully) be amazing for customers who value privacy. It will also hopefully strengthen the Monero ecosystem, including the BTC-XMR atomic swap liquidity. To simplify the MVP, I will restrict all shipping and sources of my merchandise to just the US to start, ideally expanding worldwide. I will obviously follow all laws in all jurisdictions I do business in, but I want to do my absolute best to protect customer's addresses and other info, even in the case of fed raids. I am expecting fed raids if I find success. I will not accept Bitcoin or payment on any other public ledger, for several reasons that I won't go into besides saying "managing payment from tainted coins while maintaining compliance is costly." Feedback? Questions? Concerns? Please tell me anything you'd do differently or encourage me to consider. I have seen Monero businesses that purchase items from any url on behalf of users. This structure is illegal and will not be considered viable. The same goes for selling gift cards, and gift cards still don't protect user's privacy from the company the gift card is for. Supplying the goods I sell on my e-commerce platform has already been solved, but definitely let me know if you see any privacy concerns there. I am working with a godcoder who is deep in the security/digital forensics/privacy world. I have not received his input on the architecture yet, so my apologies if anything I said is retarded. I have had cybersecurity as a hobby for about 7 years now, but I am far from an expert. I want you all to evaluate my approach so that I can schizomax this and bring a great service to customers who value privacy. Much love <3

>asking lainchan security board for business advice mate. this is soykaf isnt for profit. why dont you ask your billions of twitter followers

>>28124 nigger I am not asking for business advice at all. I am asking for evaluation of the tech stack for my attempt to protect customers' privacy. How is that not appropriate for /sec/ roody-poo

>>28125 trying to make a profit, fuarrrk off. some people here are actually trying to make a real difference in the world. go back to twitter with your neeky little crypto boy followers

I don't have any advice for you unfortunately as this is way out of my depth so I apologize in advance if I'm just soykafting up the board. But I would be interested in this, do you plan on advertising this anywhere if you ever do get this brought up and running? I'd like to try a service like this.

What are you trying to sell? I read your whole post twice and I couldn't figure out. Am I retarded?

I would say you could consider GNU Taler but I am not sure anyone even uses it. It should be hosted in a country with better data protection laws but because the CLOUD Act passed by the Trump regime that wont help much unless it is possible to get around it by use of a foreign registered corporate entity as the owner instead of an individual directly owning but I do know if that works. A lawyer might know better that bit.

>>28126 bait or what? running an e-commerce platform and properly doing this and making it available widely is ot something that can be pursued at a loss in all but the richest of people's lives. >>28127 yes, advertising on Twitter, hopefully if it goes well also on YouTube with some bigger YouTubers in this sort of space, with fleshsimulator being the sort of everything-going-as-well-as-possible scenario. >>28129 I have kooked at other jurisdictions for corporate entity, but ultimately I'd unfortunately be doing business in the USA, which to my understanding exposes me to the same legal risk profile as just incorporating/LLCing in the US. Of course, this is why my setup needs to use airgapping and be as prepared as possible for getting raided.

>>28128 sorry to doublepost, I am retarded. I would be selling lots of stuff. The current gameplan is to start small by selling electronics, but then incorporating anything from clothing to fuarrrking Pokémon cards. Think of it like Amazon ir AliExpress, but at a higher price point in exchange for privacy measures. >>28129 To give you a more complete response, the servers will be chosen woth the best possible legal structure, but unfortunately I believe doing business in the US still exposes me to feds doing feds things. For this reason, the PGP encryption, airgapped device, and Monero/Zcash payment is used. This makes it so that snooping on the server, provided customers are protecting their IP via VPN/Tor/I2P, not particularly useful for feds, or that's my goal, at least. If you see data being transmitted on the server in this current setup that is in need of stricter protection that feds could currently get their hands on, please let me know.

>>28131 Its called drop shipping. You should take a look at Mental Outlaw (Youtuber) website https://based.win/. Its exactly what you are trying to do.

>>28132 >Most of our products do not currently ship from our own warehouses which means we must forward your name and address to our vendors so they can create a shipping label to mail your items to you. oh no...it's retarded... Also, I have no idea how he's choosing what items to list, but if he was doing drop shipping, why doesn't he have WAY more goods listed? If this is my competition, I am feeling very good. I will definitely use no trackers too, encourage VPN, make an onion url, probably i2p as well. I will also act as an intermediary, meaning that you will buy goods directly from me, and I will do the drop shipping thing, but deliver to myself and then to you, actually giving you increased privacy. This looks surprisingly awful, and is exciting to see. Seems like he just doesn't want the overhead if doing this properly, tbqh.

>>28133 Ok, I searched a bit in my memory for things that looks like what you are trying to do. - https://www.getmonero.org/community/merchants/ - On kycnot.me : left panel "Type" - "Shopping" - Search for markets on Tor and try to understand how they operate, but its mostly for illegal stuff so it may be overkill for your activity.

>>28133 And Dread, its like a reddit on Tor. You should ask there. You find some links at https://tor.taxi/

>Supplying the goods I sell on my e-commerce platform has already been solved, but definitely let me know if you see any privacy concerns there. you would need to share how you plan on supplying them to get any feedback on that. >I am considering offering the ability to have package tracking and insurance, but have that be opt-in, explaining clearly that this results in a customer's address being stored by both the shipping company and my company until successful delivery, upon which I will delete their data from my infrastructure. have you ever shipped anything before? when you drop the package off or when you create the shipping label, you get a tracking number. that number is the only thing you would need to store. and for any e-commerce site, if you're not using tracked shipping you're going to get fuarrrked hard by did-not-arrive scams. >>28125 >I am asking for evaluation of the tech stack then you should elaborate on what your tech stack is. "airgapped thinkpad with pgp" is not enough info >>28131 >Think of it like Amazon ir AliExpress, but at a higher price point in exchange for privacy measures. sounds more like privacy theater.

>>28136 Word. Will check them out. >>28137 I will do just-in-time ordering of items from vendors in my business's name, and shipped to my HQ (warehouse later as it scales). I will then print the labels in the airgapped setup after decrypting PGP on that same device. Also, it will be very clear that if you want max privacy, you will have no tracking, which means if your soykaf doesn't arrived or arrives broken, you, the customer, are fuarrrked. I obviously would do my best to have the package checked for functionality beforehand and arrive, but unless you're OK with me storing a tracking number with your address, which a fed raid would almost certainly get from the ways I see to transmit and store that info from the shipping company, tracking/returns isn't feasible. Obviously, to prevent scammers, no tracking means no returns/claims. If they want the security of returns, then they can opt in to lower standard of privacy and higher shipping costs (since insurance is needed on expensive goods when tracked). Yes, I know I just need to store the number, but a trail will be left via email that I don't have absolute control over, and the number will generate the address of the destination.

>>28137 Sorry, for double posting again. I am retarded and my front end for imageboards has misled me into not seeing the bottom of your post. I don't really understand what parts of the tech stack are unclear. Everything besides the address and monero payment can be transparent, with no real risk to the privacy of customers that I see as being relevant, no? My apologies if I sound fuarrrking retarded and I need to carefully hide total costs and items in a cart that checked out, or someone will somehow get the address through...I don't even know how they'd do this if tracking isn't used, and if tracking is used, they'd need to filter through all tracked shipments to start making patterns to try to dox a user. Am I missing something?

>>28123 Another prospective project thread about ideas and fantasies. Has anyone on Lainchan ever made anything?

>>28142 Perhaps very importantly, I am not strictly speaking a lainchan schizo. I am mostly a Twitter user unfortunately these days, though I dislike the platform, but have found some communities I find interesting and enjoyable. You have to be on Twitter if you're trying to maximize your experience working in crypto, which is where I have been for 6+ years now. I can assure you that I will do this project, unless I somehow find someone doing this so well that I don't think I'd be able to compete. I have found the biggest services doing something like this, along with adjacent stuff like selling gift cards, and I believe strongly my approach provides unique benefits to users over these others. Shipping outside the US is going to involve a lot, basically having a node warehouse of my business in each country ao that I can clear customs lawfully without doxxing my customers, but setting up the US-only MVP seems very doable. I would like to say that I will have something launched by Feb 2027 at the ABSOLUTE latest. It isn't my first time making a business or working in crypto.

>>28142 most of them, no. especially of themselves.