Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: 1M People Use Facebook Over Tor

#111

Post by nisa »

logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

There are countries where people go to jail over Facebook or Twitter comments and even just using it could be triggering some arcane investigation against you.

Also Iran (likely others) did try to inject tracking JS in plain HTTP and they got the ability for a while to have valid certs so HTTPS is not really helping if you are not really paranoid with certs and hashes that is really difficult to archive.

Once you got Tor running and connect to an onion you have quite a few guarantees that are hard to circumvent/spy on for a government.

> by that I mean you think people are planning terrorist plots over facebook? come on.

It sure has likely happened. Due to Facebook only access (internet.org) for a lot of the world using mobile and Facebook is the only access to internet that is affordable. Online shopping is also handled over Facebook in these countries.

While Facebook shares your data with courts it has no way of knowing who you are if you are using Tor. At least it can't forward your location to the local secret service to beat you up. A somewhat qualified court request from a western country is also something different than arbitrary repression from dictatorships.

Re: 1M People Use Facebook Over Tor

#112

Post by dchest »

MacsHeadroom wrote: post #87
ikeboy wrote: post #74

Earlier quoted context omitted.

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be…

Shores algorithm doesn't break anything. It just reduces the key space. Considering the major increase in energy costs and major lag in computational power of quantum computing, shores algorithm won't be a threat to today's crypto for hundreds of years to come.

It reduces key space for most symmetric algorithms, but completely breaks RSA and ECC making them run in polynomial time.

Re: 1M People Use Facebook Over Tor

#113

Post by c22 »

cm3 wrote: post #92
c22 wrote: post #65

Earlier quoted context omitted.

They "allocated" the key by using it. Others are not more likely to generate the key they found than any other specific key. This is statistically unlikely due to the extremely huge number of possible keys.

Well, did they generate keys they liked and then tried to use them immediately, hoping nobody had generated the same key in the meantime, or did they generate only keys they would like and "registered" them all but kept just one? If so, what happens to allocated but unused keys? What I'm trying to figure out is: 1. race condition? 2. waste of key space?

There's nowhere to register the key, tor is decentralized. They simply start conducting their business using the key they found. There's no waste of key space for the unused keys, merely a minuscule chance of collision with other random users. I guess you could think of attempting to find hash collisions as a race condition of sorts, but it is a very long race for the attacker.

Re: 1M People Use Facebook Over Tor

#114

Post by [deleted] »

ikeboy wrote: post #57
jchendy wrote: post #36

Earlier quoted context omitted.

Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist. According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key" I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar. [1] https://www.reddit.c…

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want. The time calculation assumes our current computers and disregards Moore's law.

[deleted]

Re: 1M People Use Facebook Over Tor

#116

Post by c22 »

logicallee wrote: post #71
c22 wrote: post #69

Earlier quoted context omitted.

If you expect facebook to leak everything they know about you then connecting through tor allows them to know one less thing about you (the location you used to visit facebook).

sure, but people usually obscure their location by using a vpn, not going through the hassle of going through tor. So what I've written: >so I find the mashup of tor with facebook to be kind of bizarre. is even more so if anyone's reason is "I really, really, don't want facebook to know where I am!" I mean I just don't get it. Especially to the tune of 1 million people.

What is the hassle of using tor? You have to download, configure, and run some software, just like you'd have to to connect to a vpn, but you don't have to, yanno, set up a vpn... You also don't have to rely on the integrity of a single proxy.

Re: 1M People Use Facebook Over Tor

#117

Post by reitanqild »

geofft wrote: post #85
p4bl0 wrote: post #70

Earlier quoted context omitted.

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

If that is indeed tractable for a side project at Facebook over a few weeks, it's definitely tractable for someone who actually cares to attack Tor.

If I understand correctly finding an "equally good" domain name starting with facebook should be equally possible yes.

Finding that same one again? Not likely.

Re: 1M People Use Facebook Over Tor

#118

Post by Raphmedia »

akavel wrote: post #84
blacksmith_tb wrote: post #50

Earlier quoted context omitted.

That's a standard challenge if you try to log into your FB account from a new machine / IP address that geolocates somewhere you don't typically seem to be. Of course, that's pretty ironic since your Tor exit could be anywhere, but it's not specific to Tor anyhow. I have seen the same behavior using VPN, too.

The problem is not the existence of the challenge. The problem is it is broken in a fresh, unmodified install of the TOR Browser. Sorry, but I can't recognize a pure white square properly as a person.

That test is a Captcha. You failed it. Are you sure you are not a robot? Sorry to announce it to you like that...

Re: 1M People Use Facebook Over Tor

#119

Post by putasidemobile »

c22 wrote: post #69
logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

If you expect facebook to leak everything they know about you then connecting through tor allows them to know one less thing about you (the location you used to visit facebook).

Actually you share one more, important, datum: This user uses Tor. Likely uses Tor for other, possible nefarious, purposes too. Likely has a high X_keyscore.

Your real profile and location can be inferred from your browsing habbits and friend's data.

Unfortunately, with the current size of Facebook, even "not having an active Facebook account" shares data, especially when you are in an age category where all your peers do have profiles. It's a negative signal to recruiters and employers ("must have something to hide...").

Re: 1M People Use Facebook Over Tor

#120

Post by kregasaurusrex »

nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

I remember this was talked about by a group at Ohio Linuxfest a couple years ago and also went into IP load balancing at scale. Really neat work being done there.
Post reply on HN