Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1M People Use Facebook Over Tor

facebook.com

Post reply on HN
Print view View original

141–150 of 168 posts

Re: 1M People Use Facebook Over Tor

#141

Post by belorn »

dchest wrote: post #104
jimktrains2 wrote: post #98

Earlier quoted context omitted.

> This let us issue certificates on .onion. Isn't TOR encrypted up to a hidden service anyway? Why would you HTTPS over TOR? Honest Question.

It is encrypted, but when you're going to facebookcorewwwi.onion you only know that you're connecting to server that knows the corresponding private key, of which "facebookcorewwwi" is a hash. Which is already good. However, seeing EV certificate on this domain also shows you that the corresponding private key for HTTPS connection is signed by a certificate authority: that is, if you trust this CA, you can pretty muc…

To add on that explenation, EV is about identity. Its what should differential someone pretending to be facebook using facebookcorewwwl.com and the real entity. Its less about encryption and keys, and more about a CA claiming to have looked at the companies registration papers and other government official documents and thus confirmed their identity.

Re: 1M People Use Facebook Over Tor

#142

Post by dublinben »

putasidemobile wrote: post #137
dublinben wrote: post #135

Earlier quoted context omitted.

This is a social problem, not a technical problem. Encourage your social group to not use proprietary walled-gardens to plan and publicize their events. They'll all be better off for it.

I'd say it is a battle, and a battle that is won by Facebook. I now want to surrender, but with a little dignity. You won't convince your social group to delete their Facebook account. You may, however, convince them that you are not cool. I'll probably take the other advice, open a new account, use a week for invites, turn on email-updates, and bite the bullet.

I didn't have to convince anyone, but most of my friends are already off Facebook. For years, I've lead by example through organizing events via other means, and contacting all interested parties directly. You don't have to convince them to delete their account, just to not use it for organizing events.

Re: 1M People Use Facebook Over Tor

#143

Post by noir_lord »

nocarrier wrote: post #81
wicket wrote: post #63

Earlier quoted context omitted.

That's really interesting. Are you able to tell us how long those 500k cores were running for before the facebookcorewwwi.onion name was found?

We generated many candidates beginning with facebook, so I don't recall when that one was found--it just happened to be the one that looked the best. There's a number of backup memorable domains that we kept the keypairs for just in case facebookcorewwwi gets compromised somehow. I don't remember how long we ran it for, but IIRC we had enough candidates to stop after a week or two. I'm guessing something like 100-200…

It's awesome we live in a world where we can throw 100-200 million cpu hours at something of a whim.

That each of those cores are billions of times faster than my first PC just puts the icing on the cake.

Re: 1M People Use Facebook Over Tor

#144

Post by zhemao »

Joof wrote: post #110
zhemao wrote: post #51

Earlier quoted context omitted.

And yet, that hasn't stopped them in the past. https://en.wikipedia.org/wiki/Tiananmen_Square_protests_of_1...

I think this is a good reminder of why they would want to keep people just barely satisfied. China will go that far, but it's an expensive point to make.

Since Tiananmen, the party has basically bargained that people will accept economic progress as a substitute for political freedom. Now that the rapid growth of the last two decades is starting to slow down, we'll have to see how the CCP and Chinese people respond.

Re: 1M People Use Facebook Over Tor

#145

Post by logicallee »

nisa wrote: post #111
logicallee wrote: post #64

Given Facebook's real-name policy, and the fact that it's literally a social network of your best friends, then since all Facebook pages are HTTPS anyway, the idea of using it over tor is... Uh... a bizarre in theory the only thing you're leaking over a plain https is, "Hey this guy has friends." (this connection is visiting facebook). meanwhile in theory I'd expect facebook to leak everything else on their end, beca…

There are countries where people go to jail over Facebook or Twitter comments and even just using it could be triggering some arcane investigation against you. Also Iran (likely others) did try to inject tracking JS in plain HTTP and they got the ability for a while to have valid certs so HTTPS is not really helping if you are not really paranoid with certs and hashes that is really difficult to archive. Once you got…

This is a very good comment that answers my question. Would you move up a layer: why would (why do) these countries allow any citizen to run tor without a visit from the (not so) secret police?

Re: 1M People Use Facebook Over Tor

#146

Post by xur17 »

Raphmedia wrote: post #118
akavel wrote: post #84

Earlier quoted context omitted.

The problem is not the existence of the challenge. The problem is it is broken in a fresh, unmodified install of the TOR Browser. Sorry, but I can't recognize a pure white square properly as a person.

That test is a Captcha. You failed it. Are you sure you are not a robot? Sorry to announce it to you like that...

> but unfortunately, all those photos showed as blank, white squares!

It sounds like the test was just broken.

Re: 1M People Use Facebook Over Tor

#147

Post by nisa »

logicallee wrote: post #145
nisa wrote: post #111

Earlier quoted context omitted.

There are countries where people go to jail over Facebook or Twitter comments and even just using it could be triggering some arcane investigation against you. Also Iran (likely others) did try to inject tracking JS in plain HTTP and they got the ability for a while to have valid certs so HTTPS is not really helping if you are not really paranoid with certs and hashes that is really difficult to archive. Once you got…

This is a very good comment that answers my question. Would you move up a layer: why would (why do) these countries allow any citizen to run tor without a visit from the (not so) secret police?

They don't allow it but it tries hard to look like regular SSL then there is stuff like obfsproxy that helps to hide Tor furthermore.

Re: 1M People Use Facebook Over Tor

#148

Post by admax88q »

xur17 wrote: post #146
Raphmedia wrote: post #118

Earlier quoted context omitted.

That test is a Captcha. You failed it. Are you sure you are not a robot? Sorry to announce it to you like that...

> but unfortunately, all those photos showed as blank, white squares! It sounds like the test was just broken.

Or he's a robot and is just claiming to have seen blank white squares.

Re: 1M People Use Facebook Over Tor

#150

Post by nikcub »

nocarrier wrote: post #13

Alec Muffet has done a lot of work to get Facebook running on TOR and he's a true believer. I really enjoyed working with him when I was at Facebook. He also did a lot of work to get .onion domains to be recognized by registrars as a special purpose domain name. This let us issue certificates on .onion. I don't know if the story behind the facebookcorewwwi.onion domain name itself has been talked about much, but we w…

It took me only 24 hours and about $200-300 in compute to hit Blockchains hidden server key which is:

blockchainbdgpzk.onion

I'm pretty sure it's the second most trafficked site after FB

If anyone is looking at setting up a hidden service and wants a memorable name I still have the cluster setup.

Matching 10 characters isn't much of a challenge - it's why hidden service addressed on their own don't provide identity authentication and why we both went with SSL cents for Tor hidden services (provided by Digicert - who have been great advocates for the cause)

Post reply on HN