Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: 1M People Use Facebook Over Tor

#81

Post by nocarrier »

wicket wrote: post #63
nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

That's really interesting. Are you able to tell us how long those 500k cores were running for before the facebookcorewwwi.onion name was found?

We generated many candidates beginning with facebook, so I don't recall when that one was found--it just happened to be the one that looked the best. There's a number of backup memorable domains that we kept the keypairs for just in case facebookcorewwwi gets compromised somehow.

I don't remember how long we ran it for, but IIRC we had enough candidates to stop after a week or two. I'm guessing something like 100-200M cpu hours?

Re: 1M People Use Facebook Over Tor

#82

Post by chrisfosterelli »

alexchantavy wrote: post #58
HeavenFox wrote: post #48

Earlier quoted context omitted.

Unfortunately, it's been a very, very long time since Tor was last usable in China.

Can you elaborate? Someone above commented that Tor was the only way they were able to get out of the GFW.

China uses fairly complex artificial intelligence to detect TOR connections. Anything that "behaves like" TOR or a VPN is quickly caught on to and blocked.

There are a few attempts designed to make TOR look more like standard web traffic, which are really interesting.

It's definitely a cat-and-mouse-style game. Some have more success than others.

Re: 1M People Use Facebook Over Tor

#83

Post by MacsHeadroom »

Russell91 wrote: post #67
nocarrier wrote: post #33

Earlier quoted context omitted.

It requires substantially more compute power to match "facebookcorewwwi" vs just finding a hash with a prefix of "facebook" that looks readable. Good luck hashing the remaining eight characters!

Well, it would just take twice as long as hashing the first 8... /s

I realize that was sarcasm.

But for the non-hash-aware among us, it would take on average 2,147,483,647 as long to brute force the last 8 with the same computing power and 4,294,967,295 as long to hash every combination of the last 8. This all assumes no vulnerabilities in the algorithm, of course.

Re: 1M People Use Facebook Over Tor

#84

Post by akavel »

blacksmith_tb wrote: post #50
akavel wrote: post #39

I've recently tried using FB via TOR (Browser) for the first time, but was unable. After entering the onion address and my FB credentials, I was informed that the account is temporarily blocked (presumably because of first access via TOR). I was presented with an option of unblocking it by recognizing a few photos of friends and matching them to names - but unfortunately, all those photos showed as blank, white squar…

That's a standard challenge if you try to log into your FB account from a new machine / IP address that geolocates somewhere you don't typically seem to be. Of course, that's pretty ironic since your Tor exit could be anywhere, but it's not specific to Tor anyhow. I have seen the same behavior using VPN, too.

The problem is not the existence of the challenge. The problem is it is broken in a fresh, unmodified install of the TOR Browser. Sorry, but I can't recognize a pure white square properly as a person.

Re: 1M People Use Facebook Over Tor

#85

Post by geofft »

p4bl0 wrote: post #70
jsprogrammer wrote: post #62

Earlier quoted context omitted.

How would that be terrible?

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

If that is indeed tractable for a side project at Facebook over a few weeks, it's definitely tractable for someone who actually cares to attack Tor.

Re: 1M People Use Facebook Over Tor

#86

Post by slig »

lbenes wrote: post #38
HalcyonicStorm wrote: post #2

Please explain it to me if I'm wrong, but doesn't logging into Facebook on Tor defeat the purpose of Tor?

When I was traveling in China, I would have had no access to Facebook if it weren’t for Tor. All I needed was my USB drive with a Tor + Linux and I could access the free Internet from any computer. Providing anonymity of identity is just one of the many uses of tor. [1] [1] https://www.torproject.org/about/torusers.html.en

Why doesn't China block Tor? Isn't it easy as blocking all known public IP addresses?

It doesn't make sense to not allow the user to access certain sites, but allow Tor that can easily bypass that protection.

Re: 1M People Use Facebook Over Tor

#87

Post by MacsHeadroom »

ikeboy wrote: post #74
Guvante wrote: post #72

Earlier quoted context omitted.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here: > It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key. Let's assume that Moore'…

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be…

Shores algorithm doesn't break anything. It just reduces the key space. Considering the major increase in energy costs and major lag in computational power of quantum computing, shores algorithm won't be a threat to today's crypto for hundreds of years to come.

Re: 1M People Use Facebook Over Tor

#88

Post by chrisfosterelli »

agildehaus wrote: post #15

I thought .onion addresses were for anonymous hidden services, which Facebook is not. What's the advantage of accessing a .onion versus using Tor to visit the normal facebook.com?

If you are using TOR to connect to facebook.com, your connection has to leave the TOR network. This gives a lot of power and control to whoever is your exit node out of the network. Although they can't see who you are, they have full MiTM of your traffic. SSL helps a lot with this obviously, but it's still not the most ideal scenario.

Traffic directed to hidden services never "leaves" the TOR network, so it doesn't hand over any control to exit nodes and the (possibly malicious) people running them.

Re: 1M People Use Facebook Over Tor

#89

Post by bostik »

ikeboy wrote: post #59
bostik wrote: post #54

Earlier quoted context omitted.

If your plan was to remain anonymous on FB , it would. But that's not what their .onion service is for. The ingenuiety of the hidden service is that FB basically inverted Tor's idea. Tor is really good at bypassing restrictive net filters, while at the same time it hides your browsing destination. So in effect FB turned a Tor address into their own highly resilient web proxy. Where a proxy normally provides a guarded…

What? Hidden services use 6 hops compared to regular traffic's three. They are slower.

Oh sorry, the context was missing.

This came up in a discussion we had. FB is proposing (and funding) development that would make hidden services faster. One of the measures would be to make [some?] hidden services reachable over 3 hops only.

A quick search does not bring anything on the topic up, but it can easily be that I try to search for wrong key words.

Re: 1M People Use Facebook Over Tor

#90

Post by Guvante »

ikeboy wrote: post #74
Guvante wrote: post #72

Earlier quoted context omitted.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here: > It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key. Let's assume that Moore'…

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be…

> What? Why is brute force impossible to code? I don't understand what you're claiming.

You claim that a reversible algorithm takes zero time. I said that requires a reversible algorithm that applies to an arbitrary AES-256 key which is currently thought to be impossible.

Brute forcing is not breaking but instead simply enumerating the key space and is subject to the slow downs we are talking about here.

> I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

But you are missing the point of cryptographic systems, the goal typically isn't to be forever uncrackable, it is to be effectively forever uncrackable which includes upgrading the strength of your cryptography over time.

If we were talking about cracking crypto within 100 years then maybe we could talk about reasonable fear, but all of these things involve timelines that are longer than that (including quantum computer work).

Post reply on HN