> It seems like everything except the 'i' is a prefix, a lot of computing must have went in to generating it. If Facebook can generate an address with only a s

> It seems like everything except the 'i' is a prefix, a lot of computing must have went in to generating it. If Facebook can generate an address with only a single character being random (the trailing ‘i’), couldn’t an attacker generate anyone’s address by just applying 26 times more computing power? Either Facebook didn’t target the trailing “corewww” or the .onion URL scheme is broken (since Facebook would be able to take over any .onion URL by just spending 26 times as much compute power as they did with https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/).