Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

121–130 of 168 posts

Re: 1M People Use Facebook Over Tor

#121

Post by cm3 »

c22 wrote: post #113
cm3 wrote: post #92

Earlier quoted context omitted.

Well, did they generate keys they liked and then tried to use them immediately, hoping nobody had generated the same key in the meantime, or did they generate only keys they would like and "registered" them all but kept just one? If so, what happens to allocated but unused keys? What I'm trying to figure out is: 1. race condition? 2. waste of key space?

There's nowhere to register the key, tor is decentralized. They simply start conducting their business using the key they found. There's no waste of key space for the unused keys, merely a minuscule chance of collision with other random users. I guess you could think of attempting to find hash collisions as a race condition of sorts, but it is a very long race for the attacker.

So do we know the hash? I guess we don't or it would be easy for someone to pretend to be Facebook.

Re: 1M People Use Facebook Over Tor

#122

Post by quickben »

HalcyonicStorm wrote: post #2

Please explain it to me if I'm wrong, but doesn't logging into Facebook on Tor defeat the purpose of Tor?

Yes.

They make money from knowing who people are, and selling that. This cleaves the driving tor concept by deanonymizing users.

For anybody as large as Facebook, if enough people go for it, the remaining slice of the pie will be really small (because not all have tor, but many of those that have, have Fb).

Derive conclusions accordingly.

Re: 1M People Use Facebook Over Tor

#123

Post by putasidemobile »

Related: Please Facebook, let me peek over your walled garden. Taking a privacy-friendly stance, with the current Facebook, hurts my social life.

I do not trust your company, and I think you are bound to act unethically in the future. But I do not ask you to become a trustworthy ethical company. Mess with the accounts of my friends all you want. I just want to be invited to the next BBQ. People have stopped using e-mail for announcing these social events, and _all_ use Facebook. Could it be possible for me to not be on Facebook, yet still stay up-to-date on what my friends, or hell, even my parents now, are doing? A more advanced social graph API that hooks into email, RSS, Twitter, whatever... ?

I'm sure you also have my email-address from the address books of my contacts, so you could verify me.

As one of your longest non-users (I remember when TheFacebook required a Harvard-email for invite), please let me become a semi-user. It won't pay you a dime, but it will make the world a better place.

Re: 1M People Use Facebook Over Tor

#124

Post by c22 »

cm3 wrote: post #121
c22 wrote: post #113

Earlier quoted context omitted.

There's nowhere to register the key, tor is decentralized. They simply start conducting their business using the key they found. There's no waste of key space for the unused keys, merely a minuscule chance of collision with other random users. I guess you could think of attempting to find hash collisions as a race condition of sorts, but it is a very long race for the attacker.

So do we know the hash? I guess we don't or it would be easy for someone to pretend to be Facebook.

Yes, the hash is "facebookcorewwwi", this is the hash of the public key of one of the keypairs facebook generated. We can't pretend to be facebook without knowledge of the corresponding private key, however.

To make this more clear, most tor hidden service sites that don't have loads of computing power to bruteforce a vanity domain have uris that look like http://3g2upl4pq6kufc4m.onion

Re: 1M People Use Facebook Over Tor

#126

Post by p4bl0 »

besselheim wrote: post #76
p4bl0 wrote: post #70

Earlier quoted context omitted.

The number of generated key pair to find "facebook" + keywords must have been gigantic, maybe even so much that it could be used as a kind of rainbow table which would allow people (or three letters agencies) who can access it to attack hidden services that use one of the .onion for which a corresponding private key is known.

Relative to the 2^80 (1,208,925,819,614,629,174,706,176) possible onion addresses, whatever they generated would be miniscule.

Indeed. I was being stupid and didn't take the time to really think it through. Thanks to you and all the others who pointed that out :).

Re: 1M People Use Facebook Over Tor

#127

Post by bostik »

ikeboy wrote: post #97
bostik wrote: post #89

Earlier quoted context omitted.

Oh sorry, the context was missing. This came up in a discussion we had. FB is proposing (and funding) development that would make hidden services faster. One of the measures would be to make [some?] hidden services reachable over 3 hops only. A quick search does not bring anything on the topic up, but it can easily be that I try to search for wrong key words.

https://tor.stackexchange.com/questions/9485/decrease-number... links to some proposals for doing so. I thought I remembered something on the Tor blog about that, but didn't find it. But anyway, why would a hidden service with 3 hops look different than a clearnet site visited over tor and 3 hops?

Normally it wouldn't. But as I understand, in FB's case the last hop will be served by a fleet of extremely well connected, high-bandwidth edge nodes. And I would be sorely surprised if they didn't have peering agreements in practically all internet exchanges.

So under the faster onion routing, when accessing FB.onion your roundtrip is total of 6 hops. Hops 3 and 4 will be made to an edge node network, so the "last hop in" and "first hop out" will be, on average, faster. Even if the circuit was reconfigured midway through the session, the fast innermost hop would still exist.[~]

It's just another timing attack, with passive traffic analysis. I wonder how much one could do with active attacks.

~: I have no knowledge how FB has configured their Tor network connectivity, but I do know that the private key is not held on a single termination point. (The traffic volume is too much for a standalone node.) Hence I am making an educated guess that their onion address is advertised from multiple edge systems.

Re: 1M People Use Facebook Over Tor

#128

Post by ikeboy »

bostik wrote: post #127
ikeboy wrote: post #97

Earlier quoted context omitted.

https://tor.stackexchange.com/questions/9485/decrease-number... links to some proposals for doing so. I thought I remembered something on the Tor blog about that, but didn't find it. But anyway, why would a hidden service with 3 hops look different than a clearnet site visited over tor and 3 hops?

Normally it wouldn't. But as I understand, in FB's case the last hop will be served by a fleet of extremely well connected, high-bandwidth edge nodes. And I would be sorely surprised if they didn't have peering agreements in practically all internet exchanges. So under the faster onion routing, when accessing FB.onion your roundtrip is total of 6 hops. Hops 3 and 4 will be made to an edge node network, so the "last h…

But there's still no difference between visiting FB.onion under a 3-hop system and visiting Google or Netflix or any of the many sites that have distributed servers.

(I suppose that different protocols are being used that have different times, but that seems negligible; wouldn't bet on that though.)

Re: 1M People Use Facebook Over Tor

#130

Post by mcpherrinm »

putasidemobile wrote: post #123

Related: Please Facebook, let me peek over your walled garden. Taking a privacy-friendly stance, with the current Facebook, hurts my social life. I do not trust your company, and I think you are bound to act unethically in the future. But I do not ask you to become a trustworthy ethical company. Mess with the accounts of my friends all you want. I just want to be invited to the next BBQ. People have stopped using e-m…

Facebook users can invite non-Facebook users by email to events, if they want to.

But for viewing what your friends and parents are doing on Facebook? Well, they could change their privacy settings to be public, but that would hurt their privacy. You want to be in their social graph, but not have a Facebook account. What does that even mean? Do you just not want to have a password? There's no rule you have to post any content, if you just want to view other's.

Post reply on HN