3 ms·

And that vanity .onion address... They must've had some real processing power thrown at it. Or they were very lucky when searching for an address starting with

And that vanity .onion address... They must've had some real processing power thrown at it. Or they were very lucky when searching for an address starting with facebook. I really hope it's the latter, because if the foprmer then someone else might do it. Now I'm left wondering if shallot and scalion and really safe.

em3rgent0rdr 12y ago
good point. One commentator on the official facebook note writes: "You've just proven that Tor hidden services are broken. If you can brute force a key for facebookcorewwwi.onion, then you can brute force a key for any other existing hidden service and intercept their traffic."
- em3rgent0rdr 12y ago
  Actually, it is not as scary as you might think. I'm reading a discussion: https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October... "> If they have the resources to do that, what's to stop them brute > forcing a key for any other existing hidden service? I talked to them about this. The short answer is that they did the vanity name thing for the first half of it ("facebook"), which is only 40 bits so it's possible to generate keys over and over until you get some keys whose first 40 bits of the hash match the string you want. Then they had some keys whose name started with "facebook", and they looked at the second half of each of them to decide which one they thought would be most memorable for the second half of the name as well." So in summary, it is not necessary for facebook to have bruteforced the entire facebookcorewwwi string, but just "facebook" and then find one that works somewhat.