Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

51–60 of 168 posts

Re: 1M People Use Facebook Over Tor

#51

Post by zhemao »

50CNT wrote: post #37
Joof wrote: post #14

Earlier quoted context omitted.

It may be that it just isn't that strictly enforced for a variety of reasons. China allows a number of VPN services that bypass the firewall to function. My guess is that it isn't a huge deal because the vast majority of people don't care enough to go out of their way to bypass the firewall; the social effects of having that firewall are still in place. Start enforcing it heavily and the people that DO use those serv…

Which also tends to be the subset of people that have studied abroad, various repatriated huaqiao and college students at some of the more metropolitan colleges and I guess tech people/white collar workers. Cracking down on college students seems like a really dumb idea.

And yet, that hasn't stopped them in the past.

https://en.wikipedia.org/wiki/Tiananmen_Square_protests_of_1...

Re: 1M People Use Facebook Over Tor

#52

Post by cloudjacker »

HeavenFox wrote: post #48
NelsonMinar wrote: post #41

It's funny that they say people use Tor "for a variety of reasons related to privacy, security and safety". They left out "firewall circumvention", which I have to believe is the #1 reason, at least in China.

Unfortunately, it's been a very, very long time since Tor was last usable in China.

I heard that internally, China has a very robust internet infrastructure, and it is just connecting to things on the outside that are broken

Re: 1M People Use Facebook Over Tor

#53

Post by cloudjacker »

HeavenFox wrote: post #48
NelsonMinar wrote: post #41

It's funny that they say people use Tor "for a variety of reasons related to privacy, security and safety". They left out "firewall circumvention", which I have to believe is the #1 reason, at least in China.

Unfortunately, it's been a very, very long time since Tor was last usable in China.

I heard that internally, China has a very robust internet infrastructure, and it is just connecting to things on the outside that are broken

Re: 1M People Use Facebook Over Tor

#54

Post by bostik »

HalcyonicStorm wrote: post #2

Please explain it to me if I'm wrong, but doesn't logging into Facebook on Tor defeat the purpose of Tor?

If your plan was to remain anonymous on FB, it would. But that's not what their .onion service is for.

The ingenuiety of the hidden service is that FB basically inverted Tor's idea. Tor is really good at bypassing restrictive net filters, while at the same time it hides your browsing destination. So in effect FB turned a Tor address into their own highly resilient web proxy. Where a proxy normally provides a guarded way out of a network, the hidden service provides an otherwise untraceable way in.

Now, technically it is ~possible to identify FB-Tor traffic from regular Tor traffic. At least in some sense. Because the address is inside the .onion network, there are only half as many routing hops between the client and the server. So if you, as a well funded governmental adversary, first identify nearly all Tor traffic, you can then see which clients receive their responses notably faster than the rest.

These faster roundtrips are very likely using hidden services. If you then drill down even further, I am sure you should be able to identify a reasonably large fraction of your own subjects who are clearly accessing FB and thus stepping around the nationally imposed censure.

For the record, Alec didn't consider the above traffic analysis attack particularly feasible. And we both agreed that the straightforward solution is to get a lot more traffic for hidden services in general. Once FB is not the sole huge site with a hidden service, their traffic cannot stand out.

Re: 1M People Use Facebook Over Tor

#55

Post by 0x0 »

eterm wrote: post #32
0x0 wrote: post #28

Earlier quoted context omitted.

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site? Edit: probably wrong, see below

Normally you brute force vanity addresses by having a range of acceptable outcomes, whereas to brute force a specific vanity address* you are only targetting a single outcome. So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match. * Actually any address, it's not limited to brute forcing vanity addresses.

I guess I incorrectly assumed the process would be repeatable, but now I see that getting a specific duplicate equals bruteforcing the entire key space - even if the prefix is a chosen vanity name. I confused it with the effort of getting a similar address where just the vanity prefix needs to match.

Re: 1M People Use Facebook Over Tor

#56

Post by nicelynicely »

ryanlol wrote: post #43
p4bl0 wrote: post #18

Earlier quoted context omitted.

It does, but you will have to go through captchas regularly.

In my experience, unless you get lucky with your node it'll just throw an infinite captcha loop at you.

Disconnect.me wraps Google and is bundled in the for browser.

No capchas.

Re: 1M People Use Facebook Over Tor

#57

Post by ikeboy »

jchendy wrote: post #36
0x0 wrote: post #28

Earlier quoted context omitted.

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site? Edit: probably wrong, see below

Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist. According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key" I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar. [1] https://www.reddit.c…

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want.

The time calculation assumes our current computers and disregards Moore's law.

Re: 1M People Use Facebook Over Tor

#58

Post by alexchantavy »

HeavenFox wrote: post #48
NelsonMinar wrote: post #41

It's funny that they say people use Tor "for a variety of reasons related to privacy, security and safety". They left out "firewall circumvention", which I have to believe is the #1 reason, at least in China.

Unfortunately, it's been a very, very long time since Tor was last usable in China.

Can you elaborate? Someone above commented that Tor was the only way they were able to get out of the GFW.

Re: 1M People Use Facebook Over Tor

#59

Post by ikeboy »

bostik wrote: post #54
HalcyonicStorm wrote: post #2

Please explain it to me if I'm wrong, but doesn't logging into Facebook on Tor defeat the purpose of Tor?

If your plan was to remain anonymous on FB , it would. But that's not what their .onion service is for. The ingenuiety of the hidden service is that FB basically inverted Tor's idea. Tor is really good at bypassing restrictive net filters, while at the same time it hides your browsing destination. So in effect FB turned a Tor address into their own highly resilient web proxy. Where a proxy normally provides a guarded…

What? Hidden services use 6 hops compared to regular traffic's three. They are slower.

Re: 1M People Use Facebook Over Tor

#60

Post by envy2 »

cloudjacker wrote: post #52
HeavenFox wrote: post #48

Earlier quoted context omitted.

Unfortunately, it's been a very, very long time since Tor was last usable in China.

I heard that internally, China has a very robust internet infrastructure, and it is just connecting to things on the outside that are broken

"Broken" would suggest that this isn't intentional. But yes, you are correct; domestic internet is fine, but traffic in/out is slowed and interfered with nearly to the point of being unusable.
Post reply on HN