I'd be interested to see if any more sophisticated techniques have ever been successfully used to uncover a Tor user.
From the webpage I linked, "Security-wise, Silk Road seems to be receiving passing grades from law enforcement agencies internally; a leaked FBI report mentioned no attacks against SR, anonymous anecdotes claim the DEA is stymied4, while a May 2012 Australian document reportedly praised the security of vendor packaging and general site security."
Right now a buyer's address is vulnerable if they don't use PGP when giving it to a seller, or if SR is indeed trying to do a MitM attack by replacing a seller's published public key with their own. But the latter case is easy for a seller to check against simply by creating a second buyer account and verifying the buyer sees the correct key. The buyer and seller can also arrange to exchange keys off of SR. A better plan (also mentioned on Gwern's page) would be to have law enforcement create their own buyer and seller accounts and act like normal users until it was time to start a crackdown -- the problem seems to be that law enforcement, or at least the FBI, either doesn't have permission to engage in mass entrapment and fraud, or it's just not interested in buyers.
From the webpage I linked, "Security-wise, Silk Road seems to be receiving passing grades from law enforcement agencies internally; a leaked FBI report mentioned no attacks against SR, anonymous anecdotes claim the DEA is stymied4, while a May 2012 Australian document reportedly praised the security of vendor packaging and general site security."
Right now a buyer's address is vulnerable if they don't use PGP when giving it to a seller, or if SR is indeed trying to do a MitM attack by replacing a seller's published public key with their own. But the latter case is easy for a seller to check against simply by creating a second buyer account and verifying the buyer sees the correct key. The buyer and seller can also arrange to exchange keys off of SR. A better plan (also mentioned on Gwern's page) would be to have law enforcement create their own buyer and seller accounts and act like normal users until it was time to start a crackdown -- the problem seems to be that law enforcement, or at least the FBI, either doesn't have permission to engage in mass entrapment and fraud, or it's just not interested in buyers.