1M People Use Facebook Over Tor • Hacker News Board

Re: 1M People Use Facebook Over Tor

#61

Post by pg_is_a_butt » Fri, Apr 22, 2016, 5:35 PM UTC

ikeboy wrote: post #59

bostik wrote: post #54

Earlier quoted context omitted.

If your plan was to remain anonymous on FB , it would. But that's not what their .onion service is for. The ingenuiety of the hidden service is that FB basically inverted Tor's idea. Tor is really good at bypassing restrictive net filters, while at the same time it hides your browsing destination. So in effect FB turned a Tor address into their own highly resilient web proxy. Where a proxy normally provides a guarded…

What? Hidden services use 6 hops compared to regular traffic's three. They are slower.

making someone hop 6 times before a marathon is also slower than running a marathon without hopping 6 times first.

the guy that hopped 6 times first didn't get run over by a car right out of the gate. lucky coincidence.

Re: 1M People Use Facebook Over Tor

#62

Post by jsprogrammer » Fri, Apr 22, 2016, 5:36 PM UTC

p4bl0 wrote: post #49

bostik wrote: post #46

Earlier quoted context omitted.

I have good faith that they didn't, or certainly not all of them. When Alex described the entire process they went through, he also smirked that should that primary key ever get compromised they have several others, almost as good, ready as drop-in replacements. I do think he also mentioned that they only cared about keys that had their required prefix; all others were destroyed without anyone ever having access to t…

> I do think he also mentioned that they only cared about keys that had their required prefix; all others were destroyed without anyone ever having access to them. Okay, that is what I was implying would be terrible otherwise. But actually it is quite obvious that they would not spend the disk space necessary the keep every single generated key pairs now that I think about it.

How would that be terrible?

Re: 1M People Use Facebook Over Tor

#63

Post by wicket » Fri, Apr 22, 2016, 5:40 PM UTC

nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

That's really interesting. Are you able to tell us how long those 500k cores were running for before the facebookcorewwwi.onion name was found?

Re: 1M People Use Facebook Over Tor

#64

Post by logicallee » Fri, Apr 22, 2016, 5:44 PM UTC

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre

in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook).

meanwhile in theory I'd expect facebook to leak everything else on their end, because come on. I have next to zero expectation of privacy on facebook.

by that I mean you think people are planning terrorist plots over facebook? come on.

so I find the mashup of tor with facebook to be kind of bizarre.

Re: 1M People Use Facebook Over Tor

#65

Post by c22 » Fri, Apr 22, 2016, 5:46 PM UTC

cm3 wrote: post #35

mapgrep wrote: post #11

Earlier quoted context omitted.

Interestingly, since Onion addresses are derived from the public key of the host server, Facebook had to basically brute force this address. The process is described in "Part three" here: https://blog.torproject.org/blog/facebook-hidden-services-an... "The short answer is that for the first half of it ('facebook'), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits o…

But how did they allocate the carefully selected key and avoid others generating the same one in the meantime?

They "allocated" the key by using it. Others are not more likely to generate the key they found than any other specific key. This is statistically unlikely due to the extremely huge number of possible keys.

Re: 1M People Use Facebook Over Tor

#66

Post by [deleted] » Fri, Apr 22, 2016, 5:46 PM UTC

cm3 wrote: post #35

mapgrep wrote: post #11

Earlier quoted context omitted.

Interestingly, since Onion addresses are derived from the public key of the host server, Facebook had to basically brute force this address. The process is described in "Part three" here: https://blog.torproject.org/blog/facebook-hidden-services-an... "The short answer is that for the first half of it ('facebook'), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits o…

But how did they allocate the carefully selected key and avoid others generating the same one in the meantime?

[deleted]

Re: 1M People Use Facebook Over Tor

#67

Post by Russell91 » Fri, Apr 22, 2016, 5:48 PM UTC

nocarrier wrote: post #33

0x0 wrote: post #28

Earlier quoted context omitted.

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site? Edit: probably wrong, see below

It requires substantially more compute power to match "facebookcorewwwi" vs just finding a hash with a prefix of "facebook" that looks readable. Good luck hashing the remaining eight characters!

Well, it would just take twice as long as hashing the first 8... /s

Re: 1M People Use Facebook Over Tor

#68

Post by [deleted] » Fri, Apr 22, 2016, 5:50 PM UTC

jsprogrammer wrote: post #62

p4bl0 wrote: post #49

Earlier quoted context omitted.

> I do think he also mentioned that they only cared about keys that had their required prefix; all others were destroyed without anyone ever having access to them. Okay, that is what I was implying would be terrible otherwise. But actually it is quite obvious that they would not spend the disk space necessary the keep every single generated key pairs now that I think about it.

How would that be terrible?

[deleted]

Re: 1M People Use Facebook Over Tor

#69

Post by c22 » Fri, Apr 22, 2016, 5:51 PM UTC

logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

If you expect facebook to leak everything they know about you then connecting through tor allows them to know one less thing about you (the location you used to visit facebook).

Re: 1M People Use Facebook Over Tor

#70

Post by p4bl0 » Fri, Apr 22, 2016, 5:52 PM UTC

jsprogrammer wrote: post #62

p4bl0 wrote: post #49

Earlier quoted context omitted.

> I do think he also mentioned that they only cared about keys that had their required prefix; all others were destroyed without anyone ever having access to them. Okay, that is what I was implying would be terrible otherwise. But actually it is quite obvious that they would not spend the disk space necessary the keep every single generated key pairs now that I think about it.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.