4 ms·
.onion addresses are hashes, but a hash long enough to prevent a brute forcing is also too long for people to consistently recognize. Is facebookwkhpilnemxj7as
by jefftk 5y ago
.onion addresses are hashes, but a hash long enough to prevent a brute forcing is also too long for people to consistently recognize. Is facebookwkhpilnemxj7asaniu7vnjjbiltxjghye3mhbshg7kx5tfyd.onion the right URL for Facebook or a clever near-collision?
- LeoPanthera 5y agoThis is only true if you limit yourself to standard character based hash representations.
- zem 5y agoI feel like whatever scheme you use, if it is too simple there won't be enough unique keys to go around, but if it is complex enough it can be subtly changed in ways a human would find hard to notice.
- LeoPanthera 5y agoIsn't the whole point of a hash that you can't "subtly" change it?
- thewakalix 5y agoWould you notice if someone changed the "f" in the middle of that onion link to an "l"?
- LeoPanthera 5y agoAgain, it's impossible, or should be impossible, to easily change a single character in a hash. The avalanche effect means that small changes in the input data will result in huge changes to the hash.
- The_Colonel 5y agoOn the other hand, it's probably easy to brute force search a hash which is visually close enough for most people to not notice the difference.
- account42 5y agoThe input data in this case is the private key so if you had that available to change, you would not need to do anything more as you could already control the real .onion domain. The attack on things like onion domains would be finding another domain that to a human looks similar enough to be mistaken for the real deal. You'd do that by brute forcing (same as what Facebook did to get the "facebook" prefix in their onion domain) and for a sucessfull attack the space you need to brute force is limited by what humans can distinguish, which is smaller than the whole hash space.
- zem 5y agothat's the point of a machine-checked hash, because computers are really good at exact equality operations. humans have a much harder time with it.
- jefftk 5y agoThe limit is much more about how many bits a human is capable of distinguishing reliably at a glance, which I think is very likely below the brute-forcible level
- teddyh 5y ago(The correct address is facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion)
- stavros 5y ago("q" instead of "g").