Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

Sometimes I wonder if it's a good idea to brute-force these kinds of "vanity" onion prefixes. Take a look at the addresses used in http://incoherency.co.uk/blog/stories/hidden-service-phishin... ; they brute-forced the same prefix with a different suffix. Would anyone really notice?

View on HN

If they didn't use vanity names, then people would only remember the first/last few random characters and the phishing scheme could very well still work, just it'd be less readable for visitors. I don't think we can assume that if all the characters were random they would remember them all better.

I don't think people would remember them better if completely random. Rather, I think if they're completely random, people might correctly assume they can't, and remain appropriately skeptical; if they include a vanity prefix, people seem likely to remember the vanity prefix and somewhat less likely to pay attention to the rest.

If you're that easily phished, why are you using TOR at all?

You aren't being attentive enough for high risk activities. You lack proper verification channels, to confirm authenticity, which matters in this context. You lack the situational awareness to proceed safely.

Admit that you might not be cut out for what it takes to maintain a secure posture on the internet, if that's what gets you. Just stop pretending to try.

What we need is some way for the vast majority of the population who are not nearly as good at security as you are and never could be, to be able to access such sites securely.

The first step to that involves educating the media that the big scary dark web isn't just for drugs and other like minded Bitcoin slinging criminals.

Oh, I'd hazard a guess that the media is well-educated, and handily equipped with an agenda similar to advertisers and marketers employing dark patterns and pervasive analytics.

And I never claimed I was good at anything. But I did intend to point out that with advanced persistent threats in the mix, and nation state actors operating with effectively unlimited resources, failing to notice the difference between two vaguely similar nonces (in a situation where it matters) is going to get you hanged, depending on what you're trying to fly below radar.

Can you CNAME with onion domains? For example

onion.nytimes.com CNAME nytimes3xbfgragh.onion

Edit to clarify - more a technical pondering than a solution to anything

.onion addresses aren't resolved using the DNS system. So... no?

I guess in theory a browser _could_ support something like that, but it'd be pretty unusual. I also think the idea of relying on DNS to resolve a hidden service would defeat a lot of the privacy and security guarantees associated with those services, so I don't think any browser serious about security would implement something like that.

Nice one cheers. I have no idea how .onion domains work, never used them/Tor

Would it make any sense to use something like tor.nytimes.com to redirect to their hidden service on the other hand? To allow people to be sure they're hitting the correct endpoint on Tor. If you're on TOR you typically have access to the rest of the internet, at least depending on setup.

Only if you're fine broadcasting in plaintext what tor site you're going to. The DNS lookup defeats the privacy of using an onion address.

Exit nodes could also manipulate DNS.

> guess in theory a browser _could_ support something like that, but it'd be pretty unusual.

Websites redirect all the time, there's 3 HTTP status codes for it.

An HTTP redirect is a completely different thing from a CNAME record in the DNS.

If you visit https://onion.nytimes.com/ and it sends you a 301 redirect to https://nytimes3xbfgragh.onion/ then yes, I'm pretty sure that'd work fine. However, if you perform a DNS lookup on `onion.nytimes.com` and receive in response a CNAME record pointing to `nytimes3xbfgragh.onion`, I seriously doubt the browser is going to respond to that by establishing a new Tor circuit to the named hidden service. Rather, it's most likely just going to do what every other DNS client does when it receives a CNAME record; it'll try to look up `nytimes3xbfgragh.onion` in the DNS. (And fail, because `.onion` is not a valid TLD in the regular DNS system.)

It is a bit silly considering you can trivially brute onion addresses consisting entirely of words.

I just generated "omen coins car hoof.onion" right now, in a couple of seconds, with my laptop CPU. With a couple of GTX1080s you could easily find some much better .onions than the ones NYT chose.

But can you easily get addresses that start with "nytimes" and end in words? (I'm genuinely curious btw)

I'd be inclined to go for something bit shorter for this, perhaps just "times", but yeah.

Lets pretend we've got a $5000 budget.

Quick back-of-the-envelope math shows that a 8xGTX1080¹ box will be able to generate ~3 onion addresses beginning with "nytimes" every second, we can afford 6.25 months of this.

Instead of waiting a really long time, we'll rent multiple boxes and squeeze all that into one month. In that month our servers will find approximately 44055283.1 onion addresses beginning with "nytimes".

At least with the wordlist² I use, without a prefix I discover approximately one "good" onion per 8 million random onions. Considering we've got a 7 character prefix for our 44 million onion candidates, so I'd expect a significantly better rate than just 1/8000000

So yeah, in a month you'd probably find at least 5 "better" onion addresses.

¹ $800 a month https://selectel.com/solutions/gpu/ Shouldn't be a problem for NYT to get a few of these.

² which besides words contains some easily memorable fillers such as "aaa" "bbb" and so on

Interesting, thanks for the comprehensive answer! In this case it seems it would actually be a viable, and arguably more secure, alternative.

Reply on news.ycombinator.com