Actually, it is not as scary as you might think. I'm reading a discussion: https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lis

Actually, it is not as scary as you might think. I'm reading a discussion: https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html https://lists.torproject.org/pipermail/tor-talk/2014-October... "> If they have the resources to do that, what's to stop them brute > forcing a key for any other existing hidden service? I talked to them about this. The short answer is that they did the vanity name thing for the first half of it ("facebook"), which is only 40 bits so it's possible to generate keys over and over until you get some keys whose first 40 bits of the hash match the string you want. Then they had some keys whose name started with "facebook", and they looked at the second half of each of them to decide which one they thought would be most memorable for the second half of the name as well." So in summary, it is not necessary for facebook to have bruteforced the entire facebookcorewwwi string, but just "facebook" and then find one that works somewhat.