Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

91–100 of 168 posts

Re: 1M People Use Facebook Over Tor

#91

Post by dsmithatx »

logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

FB probably supports TOR for those who wish to use Facebook against the policy of their countries government or to gain more possible privacy from said governments.

https://en.wikipedia.org/wiki/Censorship_of_Facebook

Re: 1M People Use Facebook Over Tor

#92

Post by cm3 »

c22 wrote: post #65
cm3 wrote: post #35

Earlier quoted context omitted.

But how did they allocate the carefully selected key and avoid others generating the same one in the meantime?

They "allocated" the key by using it. Others are not more likely to generate the key they found than any other specific key. This is statistically unlikely due to the extremely huge number of possible keys.

Well, did they generate keys they liked and then tried to use them immediately, hoping nobody had generated the same key in the meantime, or did they generate only keys they would like and "registered" them all but kept just one? If so, what happens to allocated but unused keys? What I'm trying to figure out is:

1. race condition?

2. waste of key space?

Re: 1M People Use Facebook Over Tor

#93

Post by ikeboy »

Guvante wrote: post #90
ikeboy wrote: post #74

Earlier quoted context omitted.

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be…

> What? Why is brute force impossible to code? I don't understand what you're claiming. You claim that a reversible algorithm takes zero time. I said that requires a reversible algorithm that applies to an arbitrary AES-256 key which is currently thought to be impossible. Brute forcing is not breaking but instead simply enumerating the key space and is subject to the slow downs we are talking about here. > I agree th…

>You claim that a reversible algorithm takes zero time.

No, you misread my comment. Reversible computing can take almost no energy.

Re: 1M People Use Facebook Over Tor

#96

Post by jaeh »

slig wrote: post #86
lbenes wrote: post #38

Earlier quoted context omitted.

When I was traveling in China, I would have had no access to Facebook if it weren’t for Tor. All I needed was my USB drive with a Tor + Linux and I could access the free Internet from any computer. Providing anonymity of identity is just one of the many uses of tor. [1] [1] https://www.torproject.org/about/torusers.html.en

Why doesn't China block Tor? Isn't it easy as blocking all known public IP addresses? It doesn't make sense to not allow the user to access certain sites, but allow Tor that can easily bypass that protection.

there are non public ip addresses and the tor team spends quite some time fighting the big firewall in various ways.

talk from the 23c3 about tor and china: https://www.youtube.com/watch?v=P6A7jLpL3Rs

Re: 1M People Use Facebook Over Tor

#97

Post by ikeboy »

bostik wrote: post #89
ikeboy wrote: post #59

Earlier quoted context omitted.

What? Hidden services use 6 hops compared to regular traffic's three. They are slower.

Oh sorry, the context was missing. This came up in a discussion we had. FB is proposing (and funding) development that would make hidden services faster. One of the measures would be to make [some?] hidden services reachable over 3 hops only. A quick search does not bring anything on the topic up, but it can easily be that I try to search for wrong key words.

https://tor.stackexchange.com/questions/9485/decrease-number... links to some proposals for doing so. I thought I remembered something on the Tor blog about that, but didn't find it.

But anyway, why would a hidden service with 3 hops look different than a clearnet site visited over tor and 3 hops?

Re: 1M People Use Facebook Over Tor

#98

Post by jimktrains2 »

nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

> This let us issue certificates on .onion.

Isn't TOR encrypted up to a hidden service anyway? Why would you HTTPS over TOR? Honest Question.

Re: 1M People Use Facebook Over Tor

#99

Post by RaleyField »

jimktrains2 wrote: post #98
nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

> This let us issue certificates on .onion. Isn't TOR encrypted up to a hidden service anyway? Why would you HTTPS over TOR? Honest Question.

Probably authentication of server, but client still remains anonymous.

Re: 1M People Use Facebook Over Tor

#100

Post by ryan-c »

MacsHeadroom wrote: post #83
Russell91 wrote: post #67

Earlier quoted context omitted.

Well, it would just take twice as long as hashing the first 8... /s

I realize that was sarcasm. But for the non-hash-aware among us, it would take on average 2,147,483,647 as long to brute force the last 8 with the same computing power and 4,294,967,295 as long to hash every combination of the last 8. This all assumes no vulnerabilities in the algorithm, of course.

It's base32, not base16, so you're off by several orders of magnitude - numbers should be 549,755,813,888 and 1,099,511,627,776.
Post reply on HN