Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

71–80 of 168 posts

Re: 1M People Use Facebook Over Tor

#71

Post by logicallee »

c22 wrote: post #69
logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

If you expect facebook to leak everything they know about you then connecting through tor allows them to know one less thing about you (the location you used to visit facebook).

sure, but people usually obscure their location by using a vpn, not going through the hassle of going through tor.

So what I've written:

>so I find the mashup of tor with facebook to be kind of bizarre.

is even more so if anyone's reason is "I really, really, don't want facebook to know where I am!" I mean I just don't get it. Especially to the tune of 1 million people.

Re: 1M People Use Facebook Over Tor

#72

Post by Guvante »

ikeboy wrote: post #57
jchendy wrote: post #36

Earlier quoted context omitted.

Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist. According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key" I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar. [1] https://www.reddit.c…

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want. The time calculation assumes our current computers and disregards Moore's law.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here:

> It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key.

Let's assume that Moore's law is true for forever. In 300 years we will have a super computer capable of cracking a single AES-256 key in 37 millennium. However claiming that Moore's law will stay the same for 300 years when many think it won't last 30 is foolhardy.

Re: 1M People Use Facebook Over Tor

#73

Post by besselheim »

blacksmith_tb wrote: post #50
akavel wrote: post #39

I've recently tried using FB via TOR (Browser) for the first time, but was unable. After entering the onion address and my FB credentials, I was informed that the account is temporarily blocked (presumably because of first access via TOR). I was presented with an option of unblocking it by recognizing a few photos of friends and matching them to names - but unfortunately, all those photos showed as blank, white squar…

That's a standard challenge if you try to log into your FB account from a new machine / IP address that geolocates somewhere you don't typically seem to be. Of course, that's pretty ironic since your Tor exit could be anywhere, but it's not specific to Tor anyhow. I have seen the same behavior using VPN, too.

There isn't an exit when accessing an onion address - the identity of the client-chosen part of the circuit would be unknown to the hidden service operator.

Re: 1M People Use Facebook Over Tor

#74

Post by ikeboy »

Guvante wrote: post #72
ikeboy wrote: post #57

Earlier quoted context omitted.

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want. The time calculation assumes our current computers and disregards Moore's law.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here: > It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key. Let's assume that Moore'…

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference.

What? Why is brute force impossible to code? I don't understand what you're claiming.

I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

Re: 1M People Use Facebook Over Tor

#75

Post by baby »

p4bl0 wrote: post #70
jsprogrammer wrote: post #62

Earlier quoted context omitted.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

This is not vulnerable to brute-force nor rainbow tables.

Re: 1M People Use Facebook Over Tor

#76

Post by besselheim »

p4bl0 wrote: post #70
jsprogrammer wrote: post #62

Earlier quoted context omitted.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

Relative to the 2^80 (1,208,925,819,614,629,174,706,176) possible onion addresses, whatever they generated would be miniscule.

Re: 1M People Use Facebook Over Tor

#77

Post by shanemhansen »

p4bl0 wrote: post #70
jsprogrammer wrote: post #62

Earlier quoted context omitted.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

Presumably those 3 letter agencies also have the technology to generate RSA keys.

Re: 1M People Use Facebook Over Tor

#78

Post by rmc »

HalcyonicStorm wrote: post #2

Please explain it to me if I'm wrong, but doesn't logging into Facebook on Tor defeat the purpose of Tor?

There are several advantages of Facebook over Tor. One of them is that your ISP is unable to see who what site you are talking to, and that Facebook is unable to see your source IP address.

Re: 1M People Use Facebook Over Tor

#79

Post by jsprogrammer »

p4bl0 wrote: post #70
jsprogrammer wrote: post #62

Earlier quoted context omitted.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

That shouldn't matter. If the scheme is vulnerable when some company generates a bunch of keys, it is vulnerable whether those keys are deleted or not.

Re: 1M People Use Facebook Over Tor

#80

Post by yxlx »

realkitkat wrote: post #22
sidcool wrote: post #12

Does Google allow searches from Tor network? Last I heard it didn't.

URL: https://ahmia.fi/ There are search engine(s) specialized for TOR. As per Wikipedia[1]: 'Ahmia is a clearnet search engine for Tor's hidden services'. It was part of Google summer of code in 2014[2]. [1] https://en.wikipedia.org/wiki/Ahmia [2] https://blog.torproject.org/category/tags/gsoc-2014

Cool, been looking for something like this. However, it should be noted that this is not what parent asked about. Parent was wondering if Google was usable for regular web searches using a client that came from a Tor exit node via the Tor network.
Post reply on HN