10 ms·

Making Connections to Facebook More Secure

258 points by jboynyc 12y ago

mike-cardwell 12y ago
It concerns me that they were able to brute force a key for facebookcorewwwi.onion. If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. Looks like Tor hidden services are now broken to me... [edit] What's to stop Facebook from brute forcing a key for any of the existing hidden services? [edit2] If Facebook can brute force keys like this, so can the NSA and GCHQ. Tor hidden services are officially broken. [edit3] A colleague of mine suggested that this might be simply Facebooks way of making it public knowledge that Tor hidden services can no longer be relied upon. [edit4] Facebook are saying (on the Tor Talk list) that they generated a load of keys starting "facebook" and then just picked the one which looked most memorable, and were extremely lucky to get such a good one: http://archives.seul.org/tor/talk/Oct-2014/msg00433.html http://archives.seul.org/tor/talk/Oct-2014/msg00433.html
- shawabawa3 12y ago
  I'm hoping they just lucked out and came up with a backronym for it. I don't really know much about tor so I don't know how feasible bruteforcing is
  - sgrenfro 12y ago
    FB engineer here. We got extremely lucky then went the backronym route as shawabawa3 guessed.
    - cesarb 12y ago
      You got so lucky that you'll probably want to keep using that name forever. The longer it's used, the greater the probability of compromise of its secret key. Which is why using TLS on top of the .onion address is brilliant: even if the secret key for the .onion address is compromised, the TLS certificate (which is rotated more often) will keep the connection safe. The worst that could happen would be someone hijacking the .onion address, but that would lead only to a DoS instead of the compromise that would happen without the redundant TLS layer. And the certificate also helps validate that the .onion address is really from facebook: as someone observed elsewhere in this discussion, the certificate is also valid for the non-.onion addresses, so just examining its alternate names extension is enough to prove that the certificate owner could also get a valid certificate for www.facebook.com (meaning the certificate owner is very probably facebook itself).
      - ultramancool 12y ago
        This is a good idea for other tor services too as that 1024 bit RSA is looking pretty shaky these days. Hopefully the tor devs will give it a bump to 2048 or move to Curve/Ed25519 soon, before this becomes a real problem. Progress: https://lists.torproject.org/pipermail/tor-dev/2013-August/005259.html https://lists.torproject.org/pipermail/tor-dev/2013-August/0...
      - 0x0 12y ago
        Someone else said getting SSL certs for .onion in the SNI doesn't require ANY kind of validation. So someone bruteforcing the .onion key could easily get their own valid SSL cert and have full access to the plaintext for anyone browsing the .onion site over SSL. The security of facebook over onion is now only protected by the hash power required to brute force the vanity address, instead of the integrity of the SSL CA system or the power required in factoring an SSL key. Even the requirement to spoof DNS or perform actual man-in-the-middle-of-the-wire hijacks has vanished.
        akavel 12y ago
        And here's a link to a comment from a HNer claiming to have just got a certificate for the very same facebook's .onion address: https://news.ycombinator.com/item?id=8539066 https://news.ycombinator.com/item?id=8539066
    - pieter_mj 12y ago
      What we should expect is that facebook has enough computing power to bruteforce 12 to 13 characters in a reasonable timeframe. Did you ask NSA for a full 16-character bruteforce? :)
  - im2w1l 12y ago
    Agreed. Likely they required facebook, and required that the rest of it would form words from some dictionary. I'd guess that the "i" at the end is a random alphanumeric (2⁵ possibilities). The positions of the words were likely arbitrary, since www comes after facebook. Lets arbitrarily say they have a word list of 128 words, that they want words from, all four letters long. This means we have 2⁷2⁷2⁵*4!/2 ~= 2²³ acceptable possibilities(the division because of the order of the random words).
- mike_hearn 12y ago
  Nothing, and it's interesting that they have enough computational power to do that for a relatively trivial project. Meanwhile, whilst I applaud Facebook going above and beyond here, this doesn't set a good precedent. Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone. Secondly, by doing this, there's now a risk that other firms who want to be on the cutting edge of privacy will try to copycat this approach, even though it makes no sense and is very complex and expensive to set up. Worse, users might think it's some kind of "gold standard". Thirdly, it doesn't actually solve any of the reasons why Tor traffic is routinely discriminated against and harassed: Tor is effectively a "bulletproof ISP" that shields a lot of abuse and hacking. Merely making a Tor hidden service specifically for Facebook doesn't solve that, at all.
  - justcommenting 12y ago
    > Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. As long as you don't have to use it, I don't see why offering users a choice is a problem. >If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone. ExoneraTor does this quite well in my opinion, and I don't follow how/why you think this will slow things down for everyone. Surely you're not referring to the entire Tor network? The main value in using this, in my opinion, is reducing the potential attack surface associated with MITM attacks--including CDNs--after your traffic exits Tor. Attacks on Facebook users involving Akamai have been documented by NSA, for example; Facebook is a PRISM partner, but this would arguably still stack the deck in favor of "going through the front door" to access Facebook user data.
    - mike_hearn 12y ago
      Accessing an .onion address via Tor is slower than accessing a normal website via Tor. If this onion service is now the official way to access Facebook via Tor and direct access doesn't work well, then this is slowing things down. Tor's current support for detecting usage is patchy. You can't query a random third party website for every login for a system like Facebook, so you need a list of IPs that can be refreshed quickly. But such lists tend to be incomplete or behind e.g. the "exit" flag doesn't mean what you'd intuitively expect, so it's sometimes possible for Tor traffic to turn up from an IP that is not identified as an exit. Re: MITM security. Even if Facebook got lucky here, we're talking about an 80 bit identifier and brute forcing these has been demonstrated before, I believe. I'm not sure this is much of an upgrade over just regular SSL CA + HSTS pinning. (edit: last paragraph)
- untrothy 12y ago
  I'm guessing they used something like scallion [0] or Shallot [1]. Bench marking Shallot on an Intel 3350P@3.10GHz: time ./shallot ^a -> 0.09 sec user time ./shallot ^aa -> 0.12 sec user time ./shallot ^aaa -> 0.12 sec user time ./shallot ^aaaa -> 0.47 sec user time ./shallot ^aaaaa -> 5.92 sec user time ./shallot ^aaaaaa -> 118 sec user Unfortunately OpenCL doesn't work with the nouveau drivers so I can't test scallion. Who knows how much they spent trying to brute force that onion address. EDIT: Ok looks like they went the backronym route [0] https://github.com/lachesis/scallion https://github.com/lachesis/scallion [1] https://github.com/katmagic/Shallot https://github.com/katmagic/Shallot
- tyho 12y ago
  There is a program called scallion [1] which can generate Vanity addresses like these. I am assuming that they searched for facebookwww?.onion and then just made up the acronym for the last character. They are therefore trying to brute force the first 11 characters of the address. The author of scallion estimates one can achieve 520 MH/s with a AMD Radeon HD5770 GPU [2] which retails for $190 [3], they then give the formula for calculating the time (in seconds) to have a 50% chance of finding a matching URL: 2^(5length-1) / hashspeed Which with a length of 11 and a hashspeed of 520M, would take about a year with the one GPU [4]. The total cost of the hardware to have a 50% chance of finding the vanity address "facebookwww?.onion" within a week would therefore be around $11 000 [5]. Imho, this is well within the realms of possibility for a company as large as Facebook and does not suggest a weakness in the .onion scheme. [1] https://github.com/lachesis/scallion https://github.com/lachesis/scallion [2] https://github.com/lachesis/scallion#speed--performance https://github.com/lachesis/scallion#speed--performance [3] https://www.amazon.com/dp/B0032F63TW https://www.amazon.com/dp/B0032F63TW [4] http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+520*10^6%29+seconds http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+5... [5] http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1%29+%2F+520*10^6%29+seconds+%2F+1+week http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1... [edit] Dustcore is very correct, correcting for my initial mistake, it would take 1.1 million years on a single GPU using scallion. Finding that sort of result in a month would require $2.6 billion worth of GPUs. Now I know facebook is known for spending billions on questionable purchases, but this would be a bit extreme even for them. How the hell have they managed this?
  - dustcoin 12y ago
    The url isn't facebookwww? though, it is facebookcorewww?. The additional 4 characters didn't have to be "core", but the fact that it is an english word and relevant adds significant difficulty to your estimates.
    - tyho 12y ago
      I have appended my comment correcting for my mistake.
    - 12y ago
- Llevel 12y ago
  > If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database. [1] https://security.stackexchange.com/questions/23241/how-are-tor-hidden-nodes-services-found https://security.stackexchange.com/questions/23241/how-are-t...
  - mike-cardwell 12y ago
    No, the way it works is the hidden service with the most recent announcement is the one that is currently used.
- nly 12y ago
  > If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. IIRC it's 80bit truncated SHA-1, so it's not even close to feasible unless there's a substantial preimage attack against the function (and none are known). It's clearly feasible to find something close enough to the human eye for a phishing/spoofing attack, but that's hardly a problem exclusive to Tor.
- akavel 12y ago
  Actually, to me the first thought after seeing the URL was totally: "wow, I wonder what backronym they invented for the ugly wwwi suffix." And the others posts in this thread seem to confirm that this was the case, and that this prettification mechanism is actually quite common on Tor already. Now, the other, more important for me observation is, that reportedly the TLS certificate is actually worth close to nothing, and giving false security, as a HNer claims to have got a valid cert issued for this very same facebook's .onion address already: https://news.ycombinator.com/item?id=8539066 https://news.ycombinator.com/item?id=8539066 -- if I understand correctly, cert issuers seem to happily accept any .onion URLs in "alternative addresses" in SSL certs without any verification. Anybody else could confirm/deny?
  - wowaname 12y ago
    I cannot confirm nor deny, but if this is true, that just proves how flawed the CA system is.
justcommenting 12y ago
Although this will be useful, I hope users will keep in mind that identifying themselves while using Tor could make their other traffic less than anonymous. In the Tor Browser Bundle, compartmentalizing your traffic via frequent use of the 'New Identity' feature is usually a good idea. Using this would also add to the data that one of the world's most aggressive advertisers and an NSA PRISM partner will have about you as a Facebook user. One plus: at least the login page appears to load correctly without javascript enabled. Edit to add: someone whose only interest is in not sharing their IP address/location with Facebook could access this URL via facebookcorewwwi.tor2web.org but the usual browser fingerprinting and potential tracking caveats apply
- driverdan 12y ago
  > identifying themselves while using Tor could make their other traffic less than anonymous Why? With data encrypted end to end the only people who know you've identified yourself are you and the end service.
  - justcommenting 12y ago
    suppose you see an article in your news feed while using the hidden service and click on it; facebook still has a good chance of learning about your browsing habits that way, even if you start from a hidden service. facebook might then learn which exit your non-hidden-service traffic exits to, and from there, it might have information to offer to advertisers about the identities of tor users using a given exit around the same time. even just having a strong authenticator of your real identity active on tor at a given time may be concerning, depending on your threat model.
    - neltnerb 12y ago
      Where "advertisers" can be replaced by "NSA" for a more lucrative business model... :-/
  - 0x0 12y ago
    Are they serving all of the CDN contents (photos) via .onion as well?
spacefight 12y ago
Which CA signed the .ontion cert in that case? Self signed?
- spindritf 12y ago
  No. It's a fully valid ceritifcate issued by DigiCert to CN = *.facebook.com O = "Facebook, Inc." L = Menlo Park ST = CA C = US with a bunch of altnames DNS Name: *.facebook.com DNS Name: facebook.com DNS Name: *.fb.com DNS Name: *.fbsbx.com DNS Name: *.fbcdn.net DNS Name: *.xx.fbcdn.net DNS Name: *.xy.fbcdn.net DNS Name: fb.com DNS Name: facebookcorewwwi.onion DNS Name: fbcdn23dssr3jqnq.onion DNS Name: fbsbx2q4mvcl63pw.onion
  - spacefight 12y ago
    Thanks - learned something that you can put anything in the alt names list. So digicert is not checking those to be valid domains and controlled by the cert requester?
    - iancarroll 12y ago
      You can't put anything in the SubjectAltName field, you can put anything that isn't a valid TLD (and not have to validate it).
      - im2w1l 12y ago
        So Eve could also get a cert for facebookcorewwwi.onion?
        iancarroll 12y ago
        Yes. I submitted a request for one just now, actually. Hopefully the CA doesn't flag it for containing Facebook.
        12y ago
lorddoig 12y ago
I dread to think how much electricity it cost them to brute that vanity URL.
jgrahamc 12y ago
The most interesting part of this (to me) is that they brute-forced the .onion address (which is normally the SHA-1 hash of a public key). Good thread on StackExchange about how to do that: http://security.stackexchange.com/questions/29772/how-do-you-get-a-specific-onion-address-for-your-hidden-service http://security.stackexchange.com/questions/29772/how-do-you...
- sgrenfro 12y ago
  Also commented downthread, but we got extremely lucky then went the backronym route as shawabawa3 guessed. (I'm an engineer at FB.)
  - AlyssaRowan 12y ago
    That is extremely lucky. That's, what, 82 bits if you'd chosen the whole thing? A more manageable 61 bits for 12 characters or so, from my recollection. Did you pile a dictionary attack on top of that? I don't believe this does "break hidden services". That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error.
    - tux3 12y ago
      >That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error. Actually, a name collision would still mean hijacking the traffic, even if they don't have the same private key. The last HS to announce "owns" the name.
    - sgrenfro 12y ago
      Roger Dingledine (Tor project, not FB) shared some accurate background here: https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October...
- higherpurpose 12y ago
  Tor still uses SHA1? I understand clueless download sites (such as FossHub) and projects still using MD5 and SHA1, but I would hope projects that are supposed to be about security would've stopped using SHA1 a long time ago. If they dread moving to SHA2 because of its much slower performance, they should at least use BLAKE2 [1]. Even NSA-influenced NIST recommended against using SHA1 after Dec. 2013. And when NIST recommends a deadline for change, you know you should be doing that at least 3-5 years earlier to be safe against state sponsored/NSA attacks. [1] - https://blake2.net/ https://blake2.net/
aestetix 12y ago
While Facebook gets props for their astonishingly clever .onion address, it seems rather odd to promote unlinkability while continuing to enforce their legal names policy. I'd probably respect this a lot more if it was accompanied by setting up Tor exit nodes, which invites actual risk and things like FBI visits.
- sp332 12y ago
  You can at least browse public Facebook posts without logging in. But I think the main point is to avoid local censorship, reducing Tor to a simple proxy.
  - diggan 12y ago
    There is no difference from accessing Facebook from .com and .onion in that case. If the main point would be to avoid local censorship, they would have a bigger effect if they instead of focusing power on running a hidden service, spent the effort on running an exit node.
- nly 12y ago
  > it seems rather odd to promote unlinkability They're not, they just want users on networks that block facebook.com, or try to perform MITM (by hijacking DNS or the switch from HTTP to HTTPS), to be able to reach them safely.
- frostmatthew 12y ago
  > while continuing to enforce their legal names policy They've recently announced they plan to ease the real name policy http://bits.blogs.nytimes.com/2014/10/01/facebook-agrees-to-ease-rules-on-real-names/ http://bits.blogs.nytimes.com/2014/10/01/facebook-agrees-to-...
wtbob 12y ago
Heh, my first reaction was, 'shoot, they brute-forced an address!' and I see that a lot of others had the exact same idea. I wonder how tough that was to do—I'm guessing that they didn't use Shallot! Looks like some sort of CA structure is going to be pretty vital to Tor…
- tyho 12y ago
  CA structure is not vital to tor at all. All connections to hidden services are encrypted and authenticated end to end. the URL serves as the public key.
  - wtbob 12y ago
    The public key which is obviously brute-forceable…
steakejjs 12y ago
If you want more information on the specifics behind how FB did this, here is a really really informative mailing list conversation about it. Instead of coming up with facebookcorewwwi and then searching for it, they found a bunch of "facebook" first, and then picked the best one. https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October...
dataminded 12y ago
Can someone help me understand the intended user experience? As I currently understand it, you connect anonymously to Facebook, login and link your activities to your real life identity and Facebook turns over the information that you provide to whatever powerful government entity you are hiding from. Why would anyone do this?
- evgen 12y ago
  Probably because the latter half of your assertion, that "Facebook turns over the information you provide to whatever government entity you are hiding from" is a lie. This protects people who feel they need to hide the fact that they are connecting to Facebook from an observer/ISP.
  - dataminded 12y ago
    Maybe my phrasing was overly strong. As I understand it, there are no guarantees that the information that we put into a service like Facebook can be kept out of the government's hands. Whether or not Facebook is doing it willingly, is not relevant to my question. What is the value in using tor to connect anonymously to a system that ties back to your real life identity? http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-facebook-the-perfect-mass-surveillance-tool/ http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-faceb...
    - scott_karana 12y ago
      The tie is only temporal, and it's still anonymized. The only concession is that now the government you're avoiding might know you use Tor, if Facebook tells them. ---- Here's the usage case: you're a foreign national visiting a country with a restrictive firewall, like China's. Now you can continue to communicate with people back home. Facebook already had your information, in this scenario, so nothing has changed except that they know people from China are desperate for their services. That's only good, in my book.
- sinaa 12y ago
  As I understand it, they are now making it easier for someone(i.e. hacker) to login to your account using Tor. The attacker will not raise any flags anymore (since it could be you).
cordite 12y ago
Huh.. I wonder if something like Cloudflare would offer something like this next? (Whether or not they might brute force vanity URLs is another matter)
- justcommenting 12y ago
  not sure if you're trolling, but i wish cloudflare weren't so overtly hostile to tor users! i've already stopped using all but a few cloudflare sites for this reason.
  - cordite 12y ago
    I was not aware that cloudflare was hostile to tor users. I mean, I know they apparently bother my friend who uses a VPS with checking if he is human or not.
  - jonknee 12y ago
    On the other hand, tor users are very hostile to Cloudfare. The percentage of traffic from tor that is malicious is not small.
    - justcommenting 12y ago
      just about everywhere else, service providers have figured out ways to allow access while managing abuse. cloudflare ends up being a HUGE pain and practical barrier for the vast majority of people who use tor to exercise their right to read.
      - mike_hearn 12y ago
        They manage abuse by expecting networks to handle malicious users, and blocking entire networks that fail to do so. Tor doesn't handle abuse by design so gets blocked a lot. It's not being singled out our treated specially in that regard.
      - jonknee 12y ago
        Sure, but Cloudfare is where you go when you have already had malicious users causing trouble. It doesn't seem crazy that it would be a huge problem for Cloudfare hosted sites (and as such, the block). Sites that want Tor users should do well and avoid services like Cloudfare, but for sites that don't care it's a very effective way to cut out malicious actors. It's not nice in a freedom sort of way, but for ad supported sites Tor traffic is worthless and there is little incentive to try and cater towards it.
revelation 12y ago
Last I checked, Facebook doesn't work at all unless you are logged in. So I can now tell Facebook my personal information and a list of associates securely, which it will then promptly share with any government interested. I guess its the best way yet to illustrate the basic problem with Tor (no technology in the world can protect you from giving the bad guys your home address), but can't shake the feeling that this makes an utter mockery of the idea behind Tor.
- justcommenting 12y ago
  two words for you: censored users
rbcgerard 12y ago
awesome! I can now securely hand over my personal data to a company that will turn around and sell it...what a relief...
junto 12y ago
Can the NSA 'tag' a specific user using Tor? If so, wouldn't using Facebook over Tor then provide them with a direct link between your FB identity and your other Tor activity?
- kreneskyp 12y ago
  Yes. If someone captures identifiable information then a user can be identified. This can be minimized by using SSL to connect to services. A service may share data so you should also use only a single service within a Tor session. That includes closing tabs to prevent ajax requests. A new session can be created by restarting Tor or from the tor indicator if within TAILS.
  - lucb1e 12y ago
    Note that, although you are right that you should usually use https on tor, it does NOT APPLY to hidden services. Hidden Services are end-to-end encrypted, regardless of whether you use http or https. That is also why a site like Silk Road simply used http: it was a hidden service. The reason for this is that it never leaves the Tor network. Traffic from a tor client to a hidden service goes (encrypted) through relays, but never exits. Basically you are entering a validation of the public key when you type in the .onion address, so nobody can tamper with the connection.
xnull 12y ago
From Tor: "So I'm totally anonymous if I use Tor? No. First, Tor protects the network communications. It separates where you are from where you are going on the Internet. What content and data you transmit over Tor is controlled by you. If you login to Google or Facebook via Tor, the local ISP or network provider doesn't know you are visiting Google or Facebook. Google and Facebook don't know where you are in the world. However, since you have logged into their sites, they know who you are. If you don't want to share information, you are in control."
DanBlake 12y ago
I think its much more likely that facebook is utilizing this to better track abuse. Its not always easy to tell if a user is using tor, and a statistically higher percentage of tor users are doing things facebook doesnt like. By creating a entry point, they can more easily track and label users that even use that entry point, to better handle abuse.
bhartzer 12y ago
I'm sorry, but even the thought of a more secure Facebook site won't get me to post on there.
justcommenting 12y ago
adding a link to roger's super-thoughtful and basically authoritative blog post on the subject: https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs https://blog.torproject.org/blog/facebook-hidden-services-an...

258 points by jboynyc 12y ago

It concerns me that they were able to brute force a key for facebookcorewwwi.onion. If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. Looks like Tor hidden services are now broken to me... [edit] What's to stop Facebook from brute forcing a key for any of the existing hidden services? [edit2] If Facebook can brute force keys like this, so can the NSA and GCHQ. Tor hidden services are officially broken. [edit3] A colleague of mine suggested that this might be simply Facebooks way of making it public knowledge that Tor hidden services can no longer be relied upon. [edit4] Facebook are saying (on the Tor Talk list) that they generated a load of keys starting "facebook" and then just picked the one which looked most memorable, and were extremely lucky to get such a good one: http://archives.seul.org/tor/talk/Oct-2014/msg00433.html http://archives.seul.org/tor/talk/Oct-2014/msg00433.html

shawabawa3 12y ago
I'm hoping they just lucked out and came up with a backronym for it. I don't really know much about tor so I don't know how feasible bruteforcing is
- sgrenfro 12y ago
  FB engineer here. We got extremely lucky then went the backronym route as shawabawa3 guessed.
  - cesarb 12y ago
    You got so lucky that you'll probably want to keep using that name forever. The longer it's used, the greater the probability of compromise of its secret key. Which is why using TLS on top of the .onion address is brilliant: even if the secret key for the .onion address is compromised, the TLS certificate (which is rotated more often) will keep the connection safe. The worst that could happen would be someone hijacking the .onion address, but that would lead only to a DoS instead of the compromise that would happen without the redundant TLS layer. And the certificate also helps validate that the .onion address is really from facebook: as someone observed elsewhere in this discussion, the certificate is also valid for the non-.onion addresses, so just examining its alternate names extension is enough to prove that the certificate owner could also get a valid certificate for www.facebook.com (meaning the certificate owner is very probably facebook itself).
    - ultramancool 12y ago
      This is a good idea for other tor services too as that 1024 bit RSA is looking pretty shaky these days. Hopefully the tor devs will give it a bump to 2048 or move to Curve/Ed25519 soon, before this becomes a real problem. Progress: https://lists.torproject.org/pipermail/tor-dev/2013-August/005259.html https://lists.torproject.org/pipermail/tor-dev/2013-August/0...
    - 0x0 12y ago
      Someone else said getting SSL certs for .onion in the SNI doesn't require ANY kind of validation. So someone bruteforcing the .onion key could easily get their own valid SSL cert and have full access to the plaintext for anyone browsing the .onion site over SSL. The security of facebook over onion is now only protected by the hash power required to brute force the vanity address, instead of the integrity of the SSL CA system or the power required in factoring an SSL key. Even the requirement to spoof DNS or perform actual man-in-the-middle-of-the-wire hijacks has vanished.
      - akavel 12y ago
        And here's a link to a comment from a HNer claiming to have just got a certificate for the very same facebook's .onion address: https://news.ycombinator.com/item?id=8539066 https://news.ycombinator.com/item?id=8539066
  - pieter_mj 12y ago
    What we should expect is that facebook has enough computing power to bruteforce 12 to 13 characters in a reasonable timeframe. Did you ask NSA for a full 16-character bruteforce? :)
- im2w1l 12y ago
  Agreed. Likely they required facebook, and required that the rest of it would form words from some dictionary. I'd guess that the "i" at the end is a random alphanumeric (2⁵ possibilities). The positions of the words were likely arbitrary, since www comes after facebook. Lets arbitrarily say they have a word list of 128 words, that they want words from, all four letters long. This means we have 2⁷2⁷2⁵*4!/2 ~= 2²³ acceptable possibilities(the division because of the order of the random words).
mike_hearn 12y ago
Nothing, and it's interesting that they have enough computational power to do that for a relatively trivial project. Meanwhile, whilst I applaud Facebook going above and beyond here, this doesn't set a good precedent. Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone. Secondly, by doing this, there's now a risk that other firms who want to be on the cutting edge of privacy will try to copycat this approach, even though it makes no sense and is very complex and expensive to set up. Worse, users might think it's some kind of "gold standard". Thirdly, it doesn't actually solve any of the reasons why Tor traffic is routinely discriminated against and harassed: Tor is effectively a "bulletproof ISP" that shields a lot of abuse and hacking. Merely making a Tor hidden service specifically for Facebook doesn't solve that, at all.
- justcommenting 12y ago
  > Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. As long as you don't have to use it, I don't see why offering users a choice is a problem. >If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone. ExoneraTor does this quite well in my opinion, and I don't follow how/why you think this will slow things down for everyone. Surely you're not referring to the entire Tor network? The main value in using this, in my opinion, is reducing the potential attack surface associated with MITM attacks--including CDNs--after your traffic exits Tor. Attacks on Facebook users involving Akamai have been documented by NSA, for example; Facebook is a PRISM partner, but this would arguably still stack the deck in favor of "going through the front door" to access Facebook user data.
  - mike_hearn 12y ago
    Accessing an .onion address via Tor is slower than accessing a normal website via Tor. If this onion service is now the official way to access Facebook via Tor and direct access doesn't work well, then this is slowing things down. Tor's current support for detecting usage is patchy. You can't query a random third party website for every login for a system like Facebook, so you need a list of IPs that can be refreshed quickly. But such lists tend to be incomplete or behind e.g. the "exit" flag doesn't mean what you'd intuitively expect, so it's sometimes possible for Tor traffic to turn up from an IP that is not identified as an exit. Re: MITM security. Even if Facebook got lucky here, we're talking about an 80 bit identifier and brute forcing these has been demonstrated before, I believe. I'm not sure this is much of an upgrade over just regular SSL CA + HSTS pinning. (edit: last paragraph)
untrothy 12y ago
I'm guessing they used something like scallion [0] or Shallot [1]. Bench marking Shallot on an Intel 3350P@3.10GHz: time ./shallot ^a -> 0.09 sec user time ./shallot ^aa -> 0.12 sec user time ./shallot ^aaa -> 0.12 sec user time ./shallot ^aaaa -> 0.47 sec user time ./shallot ^aaaaa -> 5.92 sec user time ./shallot ^aaaaaa -> 118 sec user Unfortunately OpenCL doesn't work with the nouveau drivers so I can't test scallion. Who knows how much they spent trying to brute force that onion address. EDIT: Ok looks like they went the backronym route [0] https://github.com/lachesis/scallion https://github.com/lachesis/scallion [1] https://github.com/katmagic/Shallot https://github.com/katmagic/Shallot
tyho 12y ago
There is a program called scallion [1] which can generate Vanity addresses like these. I am assuming that they searched for facebookwww?.onion and then just made up the acronym for the last character. They are therefore trying to brute force the first 11 characters of the address. The author of scallion estimates one can achieve 520 MH/s with a AMD Radeon HD5770 GPU [2] which retails for $190 [3], they then give the formula for calculating the time (in seconds) to have a 50% chance of finding a matching URL: 2^(5length-1) / hashspeed Which with a length of 11 and a hashspeed of 520M, would take about a year with the one GPU [4]. The total cost of the hardware to have a 50% chance of finding the vanity address "facebookwww?.onion" within a week would therefore be around $11 000 [5]. Imho, this is well within the realms of possibility for a company as large as Facebook and does not suggest a weakness in the .onion scheme. [1] https://github.com/lachesis/scallion https://github.com/lachesis/scallion [2] https://github.com/lachesis/scallion#speed--performance https://github.com/lachesis/scallion#speed--performance [3] https://www.amazon.com/dp/B0032F63TW https://www.amazon.com/dp/B0032F63TW [4] http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+520*10^6%29+seconds http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+5... [5] http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1%29+%2F+520*10^6%29+seconds+%2F+1+week http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1... [edit] Dustcore is very correct, correcting for my initial mistake, it would take 1.1 million years on a single GPU using scallion. Finding that sort of result in a month would require $2.6 billion worth of GPUs. Now I know facebook is known for spending billions on questionable purchases, but this would be a bit extreme even for them. How the hell have they managed this?
- dustcoin 12y ago
  The url isn't facebookwww? though, it is facebookcorewww?. The additional 4 characters didn't have to be "core", but the fact that it is an english word and relevant adds significant difficulty to your estimates.
  - tyho 12y ago
    I have appended my comment correcting for my mistake.
  - 12y ago
Llevel 12y ago
> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database. [1] https://security.stackexchange.com/questions/23241/how-are-tor-hidden-nodes-services-found https://security.stackexchange.com/questions/23241/how-are-t...
- mike-cardwell 12y ago
  No, the way it works is the hidden service with the most recent announcement is the one that is currently used.
nly 12y ago
> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. IIRC it's 80bit truncated SHA-1, so it's not even close to feasible unless there's a substantial preimage attack against the function (and none are known). It's clearly feasible to find something close enough to the human eye for a phishing/spoofing attack, but that's hardly a problem exclusive to Tor.
akavel 12y ago
Actually, to me the first thought after seeing the URL was totally: "wow, I wonder what backronym they invented for the ugly wwwi suffix." And the others posts in this thread seem to confirm that this was the case, and that this prettification mechanism is actually quite common on Tor already. Now, the other, more important for me observation is, that reportedly the TLS certificate is actually worth close to nothing, and giving false security, as a HNer claims to have got a valid cert issued for this very same facebook's .onion address already: https://news.ycombinator.com/item?id=8539066 https://news.ycombinator.com/item?id=8539066 -- if I understand correctly, cert issuers seem to happily accept any .onion URLs in "alternative addresses" in SSL certs without any verification. Anybody else could confirm/deny?
- wowaname 12y ago
  I cannot confirm nor deny, but if this is true, that just proves how flawed the CA system is.

justcommenting 12y ago

Although this will be useful, I hope users will keep in mind that identifying themselves while using Tor could make their other traffic less than anonymous. In the Tor Browser Bundle, compartmentalizing your traffic via frequent use of the 'New Identity' feature is usually a good idea. Using this would also add to the data that one of the world's most aggressive advertisers and an NSA PRISM partner will have about you as a Facebook user. One plus: at least the login page appears to load correctly without javascript enabled. Edit to add: someone whose only interest is in not sharing their IP address/location with Facebook could access this URL via facebookcorewwwi.tor2web.org but the usual browser fingerprinting and potential tracking caveats apply

driverdan 12y ago
> identifying themselves while using Tor could make their other traffic less than anonymous Why? With data encrypted end to end the only people who know you've identified yourself are you and the end service.
- justcommenting 12y ago
  suppose you see an article in your news feed while using the hidden service and click on it; facebook still has a good chance of learning about your browsing habits that way, even if you start from a hidden service. facebook might then learn which exit your non-hidden-service traffic exits to, and from there, it might have information to offer to advertisers about the identities of tor users using a given exit around the same time. even just having a strong authenticator of your real identity active on tor at a given time may be concerning, depending on your threat model.
  - neltnerb 12y ago
    Where "advertisers" can be replaced by "NSA" for a more lucrative business model... :-/
- 0x0 12y ago
  Are they serving all of the CDN contents (photos) via .onion as well?

spacefight 12y ago

Which CA signed the .ontion cert in that case? Self signed?

spindritf 12y ago
No. It's a fully valid ceritifcate issued by DigiCert to CN = *.facebook.com O = "Facebook, Inc." L = Menlo Park ST = CA C = US with a bunch of altnames DNS Name: *.facebook.com DNS Name: facebook.com DNS Name: *.fb.com DNS Name: *.fbsbx.com DNS Name: *.fbcdn.net DNS Name: *.xx.fbcdn.net DNS Name: *.xy.fbcdn.net DNS Name: fb.com DNS Name: facebookcorewwwi.onion DNS Name: fbcdn23dssr3jqnq.onion DNS Name: fbsbx2q4mvcl63pw.onion
- spacefight 12y ago
  Thanks - learned something that you can put anything in the alt names list. So digicert is not checking those to be valid domains and controlled by the cert requester?
  - iancarroll 12y ago
    You can't put anything in the SubjectAltName field, you can put anything that isn't a valid TLD (and not have to validate it).
    - im2w1l 12y ago
      So Eve could also get a cert for facebookcorewwwi.onion?
      - iancarroll 12y ago
        Yes. I submitted a request for one just now, actually. Hopefully the CA doesn't flag it for containing Facebook.
        12y ago

lorddoig 12y ago

I dread to think how much electricity it cost them to brute that vanity URL.

jgrahamc 12y ago

The most interesting part of this (to me) is that they brute-forced the .onion address (which is normally the SHA-1 hash of a public key). Good thread on StackExchange about how to do that: http://security.stackexchange.com/questions/29772/how-do-you-get-a-specific-onion-address-for-your-hidden-service http://security.stackexchange.com/questions/29772/how-do-you...

sgrenfro 12y ago
Also commented downthread, but we got extremely lucky then went the backronym route as shawabawa3 guessed. (I'm an engineer at FB.)
- AlyssaRowan 12y ago
  That is extremely lucky. That's, what, 82 bits if you'd chosen the whole thing? A more manageable 61 bits for 12 characters or so, from my recollection. Did you pile a dictionary attack on top of that? I don't believe this does "break hidden services". That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error.
  - tux3 12y ago
    >That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error. Actually, a name collision would still mean hijacking the traffic, even if they don't have the same private key. The last HS to announce "owns" the name.
  - sgrenfro 12y ago
    Roger Dingledine (Tor project, not FB) shared some accurate background here: https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October...
higherpurpose 12y ago
Tor still uses SHA1? I understand clueless download sites (such as FossHub) and projects still using MD5 and SHA1, but I would hope projects that are supposed to be about security would've stopped using SHA1 a long time ago. If they dread moving to SHA2 because of its much slower performance, they should at least use BLAKE2 [1]. Even NSA-influenced NIST recommended against using SHA1 after Dec. 2013. And when NIST recommends a deadline for change, you know you should be doing that at least 3-5 years earlier to be safe against state sponsored/NSA attacks. [1] - https://blake2.net/ https://blake2.net/

aestetix 12y ago

While Facebook gets props for their astonishingly clever .onion address, it seems rather odd to promote unlinkability while continuing to enforce their legal names policy. I'd probably respect this a lot more if it was accompanied by setting up Tor exit nodes, which invites actual risk and things like FBI visits.

sp332 12y ago
You can at least browse public Facebook posts without logging in. But I think the main point is to avoid local censorship, reducing Tor to a simple proxy.
- diggan 12y ago
  There is no difference from accessing Facebook from .com and .onion in that case. If the main point would be to avoid local censorship, they would have a bigger effect if they instead of focusing power on running a hidden service, spent the effort on running an exit node.
nly 12y ago
> it seems rather odd to promote unlinkability They're not, they just want users on networks that block facebook.com, or try to perform MITM (by hijacking DNS or the switch from HTTP to HTTPS), to be able to reach them safely.
frostmatthew 12y ago
> while continuing to enforce their legal names policy They've recently announced they plan to ease the real name policy http://bits.blogs.nytimes.com/2014/10/01/facebook-agrees-to-ease-rules-on-real-names/ http://bits.blogs.nytimes.com/2014/10/01/facebook-agrees-to-...

wtbob 12y ago

Heh, my first reaction was, 'shoot, they brute-forced an address!' and I see that a lot of others had the exact same idea. I wonder how tough that was to do—I'm guessing that they didn't use Shallot! Looks like some sort of CA structure is going to be pretty vital to Tor…

tyho 12y ago
CA structure is not vital to tor at all. All connections to hidden services are encrypted and authenticated end to end. the URL serves as the public key.
- wtbob 12y ago
  The public key which is obviously brute-forceable…

steakejjs 12y ago

If you want more information on the specifics behind how FB did this, here is a really really informative mailing list conversation about it. Instead of coming up with facebookcorewwwi and then searching for it, they found a bunch of "facebook" first, and then picked the best one. https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October...

dataminded 12y ago

Can someone help me understand the intended user experience? As I currently understand it, you connect anonymously to Facebook, login and link your activities to your real life identity and Facebook turns over the information that you provide to whatever powerful government entity you are hiding from. Why would anyone do this?

evgen 12y ago
Probably because the latter half of your assertion, that "Facebook turns over the information you provide to whatever government entity you are hiding from" is a lie. This protects people who feel they need to hide the fact that they are connecting to Facebook from an observer/ISP.
- dataminded 12y ago
  Maybe my phrasing was overly strong. As I understand it, there are no guarantees that the information that we put into a service like Facebook can be kept out of the government's hands. Whether or not Facebook is doing it willingly, is not relevant to my question. What is the value in using tor to connect anonymously to a system that ties back to your real life identity? http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-facebook-the-perfect-mass-surveillance-tool/ http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-faceb...
  - scott_karana 12y ago
    The tie is only temporal, and it's still anonymized. The only concession is that now the government you're avoiding might know you use Tor, if Facebook tells them. ---- Here's the usage case: you're a foreign national visiting a country with a restrictive firewall, like China's. Now you can continue to communicate with people back home. Facebook already had your information, in this scenario, so nothing has changed except that they know people from China are desperate for their services. That's only good, in my book.
sinaa 12y ago
As I understand it, they are now making it easier for someone(i.e. hacker) to login to your account using Tor. The attacker will not raise any flags anymore (since it could be you).

cordite 12y ago

Huh.. I wonder if something like Cloudflare would offer something like this next? (Whether or not they might brute force vanity URLs is another matter)

justcommenting 12y ago
not sure if you're trolling, but i wish cloudflare weren't so overtly hostile to tor users! i've already stopped using all but a few cloudflare sites for this reason.
- cordite 12y ago
  I was not aware that cloudflare was hostile to tor users. I mean, I know they apparently bother my friend who uses a VPS with checking if he is human or not.
- jonknee 12y ago
  On the other hand, tor users are very hostile to Cloudfare. The percentage of traffic from tor that is malicious is not small.
  - justcommenting 12y ago
    just about everywhere else, service providers have figured out ways to allow access while managing abuse. cloudflare ends up being a HUGE pain and practical barrier for the vast majority of people who use tor to exercise their right to read.
    - mike_hearn 12y ago
      They manage abuse by expecting networks to handle malicious users, and blocking entire networks that fail to do so. Tor doesn't handle abuse by design so gets blocked a lot. It's not being singled out our treated specially in that regard.
    - jonknee 12y ago
      Sure, but Cloudfare is where you go when you have already had malicious users causing trouble. It doesn't seem crazy that it would be a huge problem for Cloudfare hosted sites (and as such, the block). Sites that want Tor users should do well and avoid services like Cloudfare, but for sites that don't care it's a very effective way to cut out malicious actors. It's not nice in a freedom sort of way, but for ad supported sites Tor traffic is worthless and there is little incentive to try and cater towards it.

revelation 12y ago

Last I checked, Facebook doesn't work at all unless you are logged in. So I can now tell Facebook my personal information and a list of associates securely, which it will then promptly share with any government interested. I guess its the best way yet to illustrate the basic problem with Tor (no technology in the world can protect you from giving the bad guys your home address), but can't shake the feeling that this makes an utter mockery of the idea behind Tor.

justcommenting 12y ago
two words for you: censored users

rbcgerard 12y ago

awesome! I can now securely hand over my personal data to a company that will turn around and sell it...what a relief...

junto 12y ago

Can the NSA 'tag' a specific user using Tor? If so, wouldn't using Facebook over Tor then provide them with a direct link between your FB identity and your other Tor activity?

kreneskyp 12y ago
Yes. If someone captures identifiable information then a user can be identified. This can be minimized by using SSL to connect to services. A service may share data so you should also use only a single service within a Tor session. That includes closing tabs to prevent ajax requests. A new session can be created by restarting Tor or from the tor indicator if within TAILS.
- lucb1e 12y ago
  Note that, although you are right that you should usually use https on tor, it does NOT APPLY to hidden services. Hidden Services are end-to-end encrypted, regardless of whether you use http or https. That is also why a site like Silk Road simply used http: it was a hidden service. The reason for this is that it never leaves the Tor network. Traffic from a tor client to a hidden service goes (encrypted) through relays, but never exits. Basically you are entering a validation of the public key when you type in the .onion address, so nobody can tamper with the connection.

xnull 12y ago

From Tor: "So I'm totally anonymous if I use Tor? No. First, Tor protects the network communications. It separates where you are from where you are going on the Internet. What content and data you transmit over Tor is controlled by you. If you login to Google or Facebook via Tor, the local ISP or network provider doesn't know you are visiting Google or Facebook. Google and Facebook don't know where you are in the world. However, since you have logged into their sites, they know who you are. If you don't want to share information, you are in control."

DanBlake 12y ago

I think its much more likely that facebook is utilizing this to better track abuse. Its not always easy to tell if a user is using tor, and a statistically higher percentage of tor users are doing things facebook doesnt like. By creating a entry point, they can more easily track and label users that even use that entry point, to better handle abuse.

bhartzer 12y ago

I'm sorry, but even the thought of a more secure Facebook site won't get me to post on there.

justcommenting 12y ago

adding a link to roger's super-thoughtful and basically authoritative blog post on the subject: https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs https://blog.torproject.org/blog/facebook-hidden-services-an...