4 ms·

What about Facebook's onion domain? https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/ This seems to be human meaningful, secure, and decentraliz

by itake 4y ago

What about Facebook's onion domain? https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/ This seems to be human meaningful, secure, and decentralized. https://m.facebook.com/nt/screen/?params=%7B%22note_id%22%3A2655797467977351%7D&path=%2Fnotes%2Fnote%2F&refsrc=deprecated&_rdr https://m.facebook.com/nt/screen/?params=%7B%22note_id%22%3A...

deleted 4y ago
[deleted]
scraptor 4y ago
It's not actually secure and human meaningful. There are many possible domains at least as legit looking which are not owned by facebook, and so you must either have the machine remember that facebook is facebookcorewwwi.onion and not wwwfacebookcomyz.onion (secure) or trust the first domain that looks legit (human-meaningful).
chejazi 4y ago
I can't believe they managed to grind that one.
arwt 4y ago
I'd love to see some insight as to how they were able to generate that domain name. Surely if they can do that (years ago, even), then a well-funded adversary would be able to generate the same now, given enough time. Maybe it took x thousands of compute years to generate the secret key for `facebokcorewww` - and they didn't care about the last character. But still, let's say you're a government agency with endless resources - how hard would it be to recreate that private key? If a private corp can do it once with finite resources - why can't you? Was it is just a stroke of luck for those working on it? What are the chances?
- pseudalopex 4y ago
  They stress tested a compute farm for by brute forcing onion addresses. About 10 per week per CPU started with facebook. corewwwi was their favorite.[1] Onion addresses are longer now. [1] https://alecmuffett.com/article/15996 https://alecmuffett.com/article/15996
  - arwt 4y ago
    Very interesting read. Thank you!
- aaron695 4y ago
cowtools 4y ago
It is not secure by merit of the fact that they were able to brute-force it. The v2 onion domains are weak. the v3 onion domains are much longer.
- haakon 4y ago
  Also worth noting that v2 domains are phased out now and will no longer work. Facebook's new onion address is facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion, which is not exactly human-meaningful.

by itake 4y ago

deleted 4y ago

[deleted]

scraptor 4y ago

It's not actually secure and human meaningful. There are many possible domains at least as legit looking which are not owned by facebook, and so you must either have the machine remember that facebook is facebookcorewwwi.onion and not wwwfacebookcomyz.onion (secure) or trust the first domain that looks legit (human-meaningful).

chejazi 4y ago

I can't believe they managed to grind that one.

arwt 4y ago

I'd love to see some insight as to how they were able to generate that domain name. Surely if they can do that (years ago, even), then a well-funded adversary would be able to generate the same now, given enough time. Maybe it took x thousands of compute years to generate the secret key for `facebokcorewww` - and they didn't care about the last character. But still, let's say you're a government agency with endless resources - how hard would it be to recreate that private key? If a private corp can do it once with finite resources - why can't you? Was it is just a stroke of luck for those working on it? What are the chances?

pseudalopex 4y ago
They stress tested a compute farm for by brute forcing onion addresses. About 10 per week per CPU started with facebook. corewwwi was their favorite.[1] Onion addresses are longer now. [1] https://alecmuffett.com/article/15996 https://alecmuffett.com/article/15996
- arwt 4y ago
  Very interesting read. Thank you!
aaron695 4y ago

cowtools 4y ago

It is not secure by merit of the fact that they were able to brute-force it. The v2 onion domains are weak. the v3 onion domains are much longer.

haakon 4y ago
Also worth noting that v2 domains are phased out now and will no longer work. Facebook's new onion address is facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion, which is not exactly human-meaningful.