3 ms·

I'm pretty much ignorant about Tor, but I'm curious why the .onion strongbox address they give is a string of random characters, instead of something recognizab

I'm pretty much ignorant about Tor, but I'm curious why the .onion strongbox address they give is a string of random characters, instead of something recognizable/memorable?

pixelcort 13y ago
If you combine Namecoin with Tor you could get close. Have a Namecoin .bit address point to a Tor .onion address. As long as you don't let the .bit address expire, you'll have a secure, easy to remember address people can use to access your hidden server.
pablobm 13y ago
I don't know the specifics, but my understanding is that the seemingly random string of characters is a crypto signature. If I'm not mistaken, it makes the site safe from Man In The Middle attacks.
ef4 13y ago
The address is also a public key. No one else can pretend to be the New Yorker unless they have the corresponding private key. If the address was just "newyorker.onion", you'd still need to find some way of safely verifying the public key to make sure you're really talking to the New Yorker.
- Serow225 13y ago
  This could be a naive question, but would it be possible to allow the site to choose their public key text? That way they could choose 'newyorkerstrongbox' or similar.
  - zokier 13y ago
    No, that would pretty much break the whole public-key cryptography if it were possible.
    - Serow225 13y ago
      Agreed, my wording was poor - see reply below by aceberry for what I was trying to get at.
  - MichaelGG 13y ago
    Somewhat - you can keep generating keys until the characters look like something. SR's address starts with "silkroad" followed by a few more random characters.
stefantalpalaru 13y ago
From the Tor design paper[1] section 5.2: > Location-hidden services use a virtual top level domain called .onion: thus hostnames take the form x.y.onion where x is the authorization cookie and y encodes the hash of the public key. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...
acebarry 13y ago
If they wanted to make a memorable address, they would have to run something like Shallot [1]. This is essentially brute forcing private keys until you find the public key you want. Depending on the name, that could take a very long time. [1] https://github.com/katmagic/Shallot https://github.com/katmagic/Shallot
- Serow225 13y ago
  Thanks, that's what I was thinking of.
- zokier 13y ago
  I don't really understand how they can claim that shallot-generated keys are as secure as normal keys. If you are able to essentially brute force your key (to create the customized address), wouldn't the adversarial (with presumably much greater computing power) be able to do the same?

I'm pretty much ignorant about Tor, but I'm curious why the .onion strongbox address they give is a string of random characters, instead of something recognizable/memorable?

pixelcort 13y ago

If you combine Namecoin with Tor you could get close. Have a Namecoin .bit address point to a Tor .onion address. As long as you don't let the .bit address expire, you'll have a secure, easy to remember address people can use to access your hidden server.

pablobm 13y ago

I don't know the specifics, but my understanding is that the seemingly random string of characters is a crypto signature. If I'm not mistaken, it makes the site safe from Man In The Middle attacks.

ef4 13y ago

The address is also a public key. No one else can pretend to be the New Yorker unless they have the corresponding private key. If the address was just "newyorker.onion", you'd still need to find some way of safely verifying the public key to make sure you're really talking to the New Yorker.

Serow225 13y ago
This could be a naive question, but would it be possible to allow the site to choose their public key text? That way they could choose 'newyorkerstrongbox' or similar.
- zokier 13y ago
  No, that would pretty much break the whole public-key cryptography if it were possible.
  - Serow225 13y ago
    Agreed, my wording was poor - see reply below by aceberry for what I was trying to get at.
- MichaelGG 13y ago
  Somewhat - you can keep generating keys until the characters look like something. SR's address starts with "silkroad" followed by a few more random characters.

stefantalpalaru 13y ago

From the Tor design paper[1] section 5.2: > Location-hidden services use a virtual top level domain called .onion: thus hostnames take the form x.y.onion where x is the authorization cookie and y encodes the hash of the public key. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...

acebarry 13y ago

If they wanted to make a memorable address, they would have to run something like Shallot [1]. This is essentially brute forcing private keys until you find the public key you want. Depending on the name, that could take a very long time. [1] https://github.com/katmagic/Shallot https://github.com/katmagic/Shallot

Serow225 13y ago
Thanks, that's what I was thinking of.
zokier 13y ago
I don't really understand how they can claim that shallot-generated keys are as secure as normal keys. If you are able to essentially brute force your key (to create the customized address), wouldn't the adversarial (with presumably much greater computing power) be able to do the same?