Hacker News Reader

Comment by ergot | Hacker News Reader

For those wondering how to create your own custom Tor onion adress, look no further than: https://timtaubert.de/blog/2014/11/using-the-webcrypto-api-t...

And for those who think Protonmail are the only service with a custom address, think again, because Facebook has one too: https://facebookcorewwwi.onion/

You can find a tonne more at this list:

https://github.com/chris-barry/darkweb-everywhere/tree/maste...

And staying on topic, Mailpile has their own .onion

https://raw.githubusercontent.com/chris-barry/darkweb-everyw...

View on HN

For those wondering how to generate vanity Tor onion addresses in a more efficient manner (taking advantage of your GPU): https://github.com/lachesis/scallion

Too bad you have to do it yourself, we can't have a service doing that in the cloud.

Maybe doing that in the cloud would compromise the security of your vanity address. You would not own the private key. Your cloud provider could control your domain.

(Please correct me if I am wrong…)

Correct.

Vanity addresses are popular in bitcoin, but difficulty rises exponentially with each character. Most people don't want crunch random numbers for 6 months. The solution to 3rd party key generation is split keys.

Essentially the addition of keys to get the desired final key.

Generate key X, give X public address to cloud provider, they search for key Y so that X + Y == YourVanityAddress, when found they send you private Y. Private X + Y is your vanity private key.

Vanity address generated by 3rd party in a trustless environment.

I was not aware of that technique, thanks.

Yeah, that's the reason.

Finding an arbitrary 8 character onion with scallion is easy even on a video card from 2009 (ATI 5770). You don't need fancy hardware for this.

That said you could use an Amazon GPU instance for a handful of cents an hour and run scallion there.

>And for those who think Protonmail are the only service with a custom address, think again, because Facebook has one too

facebook, scryptmail, one bitcoin exchange, one bitcoin walled, dozes on blogs and chans, there is GoG instance in Tor as well as GitLab.

For those curious to see a vanity finder written in Go: https://github.com/wybiral/onions

Why does Facebook have a tor address?

So that you can access Facebook without leaving tor through an exit node.

I guess I don't see the point of using Tor with Facebook. So much of your identity is already tracked. It's like trying to sneak up on somebody while wearing those squeaky clown shoes.

The idea is not to hide from Facebook, the idea is to not unhide for Facebook.

To avoid state censorship.

https://en.wikipedia.org/wiki/Censorship_of_Facebook

And to enable state surveillance.

When you have a very small subset of users who will go through the trouble of trying out Facebook's onion address, it is much easier to be successful with surveillance tools on that small sample.

Not for the Egyptian government.

No, mainly for Five Eyes and friends

That's the point. It makes you more vulnerable for some threats, less vulnerable for others.

Because not everyone uses their real name on Facebook, especially in a Middle Eastern country, I would imagine. And Facebook isn't just for your family and real friends anymore (and hasn't been for years).

so Facebook can spy on users from China too!

Vanity Onion addresses are a bad idea. They teach users to ignore part of the address instead of treating the whole address like an IP address.

The GNU Name System gets this sort of thing correct though.

> Vanity Onion addresses are a bad idea. They teach users to ignore part of the address instead of treating the whole address like an IP address.

This assumes that users aren't ignoring the address anyway. There is a near 100% success rate in tricking users into visiting fake URLs in laboratory conditions. While trying to explain my research to a tenured professor, she literally typed each domain I was spelling out into Firefox's search box instead of punching it in manually.

Reply on news.ycombinator.com