Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

21–30 of 168 posts

Re: 1M People Use Facebook Over Tor

#22
post #12

Does Google allow searches from Tor network? Last I heard it didn't.

URL: https://ahmia.fi/

There are search engine(s) specialized for TOR. As per Wikipedia[1]: 'Ahmia is a clearnet search engine for Tor's hidden services'. It was part of Google summer of code in 2014[2].

[1] https://en.wikipedia.org/wiki/Ahmia [2] https://blog.torproject.org/category/tags/gsoc-2014

Re: 1M People Use Facebook Over Tor

#23

I thought .onion addresses were for anonymous hidden services, which Facebook is not. What's the advantage of accessing a .onion versus using Tor to visit the normal facebook.com?

Try reading the introductory blog post[0] before asking redundant questions.

[0] https://www.facebook.com/notes/protect-the-graph/making-conn...

Re: 1M People Use Facebook Over Tor

#24
post #17

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

I don't understand quite, why so much brute force?

The name of .onion address is the hash of a public key, so you can't choose it, or rather the only way is to generate random public and private key pairs and to keep the one that interest you.

Facebook must have generated an awful lot of key pairs to get "facebookcorewwwi". By the way, I hope they deleted the other generated pairs…

Re: 1M People Use Facebook Over Tor

#25
post #17

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

I don't understand quite, why so much brute force?

Onion names are sort of public keys. You generate a secret key, then that's transformed/hashed into the public key that is your onion address.

Since onion addresses are essentially random strings of a certain length, the only way to get a "vanity" onion address is to brute force it.

Re: 1M People Use Facebook Over Tor

#26
post #17

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

I don't understand quite, why so much brute force?

Onion domains are just an encoding of a hash of a public key. To get a memorable name, you have to find a keypair that hashes to some letters you want. There is no correlation between any of the characters, so you have to do an exhaustive search to find nice strings.

Re: 1M People Use Facebook Over Tor

#28
post #17

Earlier quoted context omitted.

I don't understand quite, why so much brute force?

Onion names are sort of public keys. You generate a secret key, then that's transformed/hashed into the public key that is your onion address. Since onion addresses are essentially random strings of a certain length, the only way to get a "vanity" onion address is to brute force it.

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site?

Edit: probably wrong, see below

Re: 1M People Use Facebook Over Tor

#30
post #11

Earlier quoted context omitted.

The article says its https://www.facebookcorewwwi.onion

Interestingly, since Onion addresses are derived from the public key of the host server, Facebook had to basically brute force this address. The process is described in "Part three" here: https://blog.torproject.org/blog/facebook-hidden-services-an... "The short answer is that for the first half of it ('facebook'), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits o…

I thought Onion addresses were a hash of the public key, not the private key.
Post reply on HN