Legend has it that it wasn’t long after someone invented doors that locks were created. In ancient Egypt, an ingenious primitive mechanism was already in use that allowed a hook to be inserted through a hole as a key to move the wedges that acted as cylinders on a pin. These ingenious devices were perfected until they became the modern locks that we have in front of us today to curb the excesses of curiosity or empathy for other people’s belongings.

Moving away from the physical plane, in the digital world, locks are forms with two little boxes and a button, and keys are strings of characters. In the early days, when modern internet users could fit into a couple of first division football stadiums, those “keys” were as simple as counting to five, i.e., “12345”. Of course, it was just the seed for a well-known disaster.

We don’t know how to create strong passwords

And we can’t memorise them either. Let’s add to this mix the unhealthy ability we have to reuse passwords on dozens of sites where we open accounts. But isn’t it easy to carry a simple master key to open all our doors? Of course, it is, and that’s what the (now digitalised) thieves love to do every time they get your pet’s name or the date of your birthday. One password, thousands of websites. A bargain.

Second authentication factor, secure key generation algorithm, CAPTCHA systems to detect bots, password managers in the cloud… patches and patches and patches and patches on top of these to mend an exhausted system, concluded, obsolete, called to extinction, vilified and outdated… but, mind you, universal, ubiquitous, unanimous and anointed for being unique and unrivalled. What other alternatives do we have?

As on the physical plane, locks do not have many competitors, although they change shape (and there are even those with facial recognition), in the end it is the same thing: a shutter that moves, leaving the way open to the supposed bearers of the right to access and enjoy the contents of that which they guard.

However, doors and locks are not as driven by research and initiatives as the digital world in which we move on a daily basis (and at ungodly hours too), so the progressive abandonment of the headache of passwords was a problem that needed to be addressed and whose solution was to put an agreement on the table to standardise “something” that would allow, once and for all, to discard a mechanism more typical of the previous century than of this interesting and busy century.

Transparent passwords

At last, half of GAFAM and the FIDO Alliance in conjunction have signed a principle to push for a common mechanism to free our memory (the grey one, not the silicon one) from the tediousness of remembering or managing passwords. Could we be living in the historical moment where the last human being enters a password to access his or her binary piggy banks? Probably not yet. It’s a long way off, but as we said at the beginning, it’s a start. A first step already taken to walk a long road that is not going to be exactly flat.

OK, but how exactly are we going to stop using passwords? What would be used instead? Well, strangely enough, we are not going to stop using them in a certain way or, rather, form. You simply won’t use passwords, it will be a transparent action for you.

It takes advantage of a number of items that are already widespread among the public: diversity of devices federated into a personal or distinguishable identity and the ability of these devices to offer biometric sensor features.

Case studies

All with a front camera and two of them with fingerprint reading capability. They don’t have to be from the same manufacturer, but surely, in most cases, the same person has the same identity under one, two or even three providers. Do you access the mobile terminal? You can do it with your fingerprint or with facial recognition.  Even laptops allow access with fingerprint (Apple’s Touch ID) or facial recognition (Microsoft’s Windows Hello).

Now picture that all these manufacturers (who are also, let’s not forget, identity providers) agree and allow a single identity to be used for all devices. You open your account once and that same identity is used on all your other systems. Sounds good, doesn’t it?

What if you now make it possible for a third party, on a website, to use that same system? Easy, you enter the identity saved on your device and on that or another device (from laptop to mobile and vice versa) it asks you to put your fingerprint or face. No password travelling, no password or hash is stored on the website, there is nothing an attacker can use to guess your password because it simply doesn’t exist. There’s no point in snooping through your social networks to guess your birthday or a pet’s name

Some of the challenges

Of course, in all these advantages, there are some points that need to be elaborated in order to be fair. The first and most important of all is privacy. That quality that no one misses until it is too late to repent and remedy. Once you hand over control of your bunch of digital keys to a third party they will know at all times where, when and with which device you are visiting which site.

The second, less likely but not impossible, is that an integrity failure in the identity provider can be catastrophic. Very catastrophic. Security is better (albeit more complex) when the weights (the risk) are distributed and it has never been a principle of this science to place the weight of a whole virtual life on a single point.

Let’s also talk about the third point: availability. What if you need to make an urgent transfer and your provider’s servers have a meltdown at that moment and do not recover until many moments later?

Bonus, fourth point: What if you wake up one morning and suddenly a machine learning-based automated system randomly decides that your account is fraudulent and deletes it? Where is the customer service desk? Hello, is anyone there? Hello? Can anyone hear me? My name is K, and I can’t access my money?

We can only celebrate the beginning of the farewell to passwords, even if there is still a long way to go, but we must also be critical of those who claim to be guarding what is ours, and we must be wary of betting with caution. We will see what the arrival of these new capabilities has in store for us and, above all, what alternatives are available for those who do not want or find it an inconvenient convenience.

What are Dark Markets or Black Markets? This concept has been in the news for a long time as a consequence of clandestine sales. The markets for drugs and pharmaceuticals or firearms, for example.

As well as the illegal sale of animals, credit cards, child pornography, documentation, permits, licences, counterfeit money, the contracting of cosmetic operations, the hiring of hitmen, and a long etcetera. Almost anything you can think of will be on the black markets.

In the age of digitalisation, and this has been going on for a few years now, everything is modernised, even the black market. Whereas in the past it was necessary to know someone, that someone knew someone else who had a contact in a gang operating on the black market, the old-fashioned word of mouth, now it is no longer necessary.

All you need now is a computer, internet connection and, in the worst-case scenario, an “IT responsible friend” who can explain how to connect to the black market network. Although, excuse the joke, our grandchildren, children and nephews and nieces are going to know almost more than any of our friends. But the point is: a computer, internet connection and someone to help you, and you are free to search, pay and get what you really want.

What are Deep Web and Dark Web?

To give value to the part in which our IT expert friend is involved and to make it easier to understand how it works, we would like to explain this process in a very summarised way. It is true that it is not as easy as it seems to access some of the black markets, because yes, there are many places, many gangs and a lot of demand, hence the large supply.

In order to minimally understand how to gain access and which is the part where the “computer-savvy friend” will help you, you need to know in which part of the internet these black markets are to be found. That part is known as the Deep Web and Dark Web.

Although the terms Deep Web and Dark Web have a “bad reputation”, not everything on them is bad or illegal

For the sake of clarification, the term Deep Web was originally introduced in 2001 by Michael K. Bergman. Just as the Dark Web has no clear origin, it can only be said that the first times this term was used date back to 2009.

Both have the “bad reputation” of being sites where only illegal acts can be committed. What if we told you that absolutely all of us, even my mother, use the Deep Web on a daily basis?

The following is an approximation of what one can find in the three different parts of the web:

• Surface web: These pages are the ones that are indexed in the main internet search engines. All the pages that appear after a simple search on Google, Bing, Yahoo, etc. all comprise part of the Surface web. These pages can be accessed from any conventional browser such as Google Chrome, Firefox, Opera, Safari, etc.
• Deep Web: These are the pages that are not indexed in the main search engines. For example, our private area in the bank, on Amazon, in our favourite clothes shop, our email inbox, even messaging services such as WhatsApp.
  That is the Deep Web. It is true that there are other services and Markets that are not indexed in the main search engines, and that would be part of the Deep Web, that carry out illicit activities. As you can see, not everything on the Deep Web is bad or illegal. These pages can also be accessed from any conventional browser.
• Dark Web: These pages are also not indexed in the major search engines. However, they are often, but not always, associated with illicit activities. Similarly, I myself could set up a Dark Web forum and provide access only to the people I consider appropriate.
  Only people I share my URL with would be able to access it, and the forum could only deal with horoscope topics, for example. And it would not be associated with any illegal activity.
  It is true that nobody wants to be “invisible” and not take advantage of it. For example, a rather hot topic is the fact that the Islamic State of Iraq and Syria (ISIS) uses the Dark Web to communicate internally. This tracking is made almost impossible because they are so protected by the protocols used in this type of navigation.

How to access Dark Markets

As already mentioned, the Dark Web pages will only be accessible through protocols or services that anonymise their users, such as Tor (The Onion Router), Freenet, I2P, Zeronet and many others. Tor is mentioned here because it is the most widely used and known by most people.

This type of browser offers layers of security in order to avoid or make it as difficult as possible to be identified while browsing, i.e., the cap with the glasses of celebrities when they go out in the centre of a big city, and the pages, instead of ending in “.com”, “.es”, “.org”, etc. They end in “.onion”. 

Once you have access to these browsers, you need to know which page of the Market you want to connect to. Sometimes, these pages can be found in search engines such as DuckDuckGo, or even in Google’s own search engine, where you can find articles sharing the latest addresses of the main Dark Web markets.

However, on other occasions, it is necessary to have that page through contacts, and here we are back to word of mouth, but via Telegram, Discord, or any other type of messaging platform. Once you have obtained that specific URL address, all you have to do is enter it through your browser, depending on the website, and, as we mentioned before, search for what you are interested in in that specific market.

Police surveillance of illegal Dark Markets

These markets, and speaking of the central concept of the article, offer everything. While it is true that some specialise in drugs, others in weapons, others in documents, etc., there will always be a Market, at the very least, that can satisfy the needs of those who are looking for it. It should be noted that this practice is just as illegal and punishable as when it is carried out in the old way.

It should be noted that police work becomes very complicated in this respect as it is very difficult and sometimes impossible to attribute a criminal act within this type of surfing. So, just as in the past there were police officers infiltrating the gangs to be able to identify all the details of illegal activities, the same thing is happening now, but in the gangs operating in the markets of this part of the web.

Police officers infiltrate gangs to identify illegal activities, just as they infiltrate the gangs operating in the markets of this part of the web.

Likewise, part of the police work focused on the Dark Web consists of setting traps for people who want to consume certain types of commerce because access alone constitutes a crime, as would be the clear example of consuming child pornography.

This consists of honeypots. A honeypot is a lure placed, in this case, on the Internet, to be targeted and attract the attention of people who want to be identified by consulting certain types of information. The Dark Web is full of honeypots to track illegal activities.

One of the most active markets in recent months has been confirmed not to specialise in the sale of a particular illegal commodity, but to be a general marketplace providing many services, as can be seen from the navigation panel on the left-hand side of the website. What can be said is that the majority of the offer is focused on the sale of drugs.

The same applies to another of the markets with the largest offer in recent months.  This market was at the centre of the biggest cyber-raid in the history of the Dark Web market when the site’s administrator was arrested. However, it has risen from the ashes like a phoenix and is once again one of the most popular markets.

As shown, it offers more of the same as above. Above all, it would focus on the sale of drugs.

Going even deeper into the black markets of the Dark Web, we find another one that is off to a strong start. In this case, we can already see offers for weapons, the sale of stolen goods, and even a section listed as “organs for transplants”.

As this type of Markets has been found, many more can be found. However, it is better to stop at this point, as I think we have gained enough of an idea of what is happening here.

Why should cybersecurity experts monitor the Dark Web?

I currently work in one of the teams dedicated to cybersecurity at Telefónica Tech. We regularly visit this type of websites, mainly to analyse the buying and selling of access to services, as well as sales of privileged information and vulnerabilities associated with our clients’ exposed assets.

We may find, for instance, sales of username and password for access to VPN services, access to remote desktops exposed to the Internet, and even sales of exploits, i.e. software that would exploit vulnerabilities in the exposed services and could allow, for instance, remote code execution on the victim company’s systems. Any type of sale that could result in an intrusion into our clients’ systems would be covered by this type of search.

There is only some obvious advice left to give here.

• If you need any drugs, the best thing to do is to go to your doctor and have him prescribe them.
• If you want to obtain a licence, study or make the necessary arrangements, you should always use the legal route.
• If you want to have an aesthetic operation, we refer to beauty and the beast, beauty is on the inside!
• In case you want to kill someone, the best idea is to count to 10 and approach the ” issue ” in a less dangerous way.

Generally speaking, the items found on these sites are often illegal or unethical to use at best. If they were legal merchandise, they could be purchased from legitimate portals. We should think very carefully about any activity in this type of environment.

Before finishing this post, we must remember that purchases on these types of portals are always outside the applicable tax system and that —in almost all cases— the items or services to be purchased will be illegal at an international level, with the purchase process itself (or subsequent attempted use) being a criminal offence in the relevant jurisdiction.