Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by itake | Hacker News Reader

Full thread

itake·

What about Facebook's onion domain?

https://facebookcorewwwi.onion/

This seems to be human meaningful, secure, and decentralized.

https://m.facebook.com/nt/screen/?params=%7B%22note_id%22%3A...

View on HN

It's not actually secure and human meaningful. There are many possible domains at least as legit looking which are not owned by facebook, and so you must either have the machine remember that facebook is facebookcorewwwi.onion and not wwwfacebookcomyz.onion (secure) or trust the first domain that looks legit (human-meaningful).

I'd love to see some insight as to how they were able to generate that domain name. Surely if they can do that (years ago, even), then a well-funded adversary would be able to generate the same now, given enough time.

Maybe it took x thousands of compute years to generate the secret key for `facebokcorewww` - and they didn't care about the last character. But still, let's say you're a government agency with endless resources - how hard would it be to recreate that private key? If a private corp can do it once with finite resources - why can't you?

Was it is just a stroke of luck for those working on it? What are the chances?

They stress tested a compute farm for by brute forcing onion addresses. About 10 per week per CPU started with facebook. corewwwi was their favorite.[1] Onion addresses are longer now.

[1] https://alecmuffett.com/article/15996

Very interesting read. Thank you!

It is not secure by merit of the fact that they were able to brute-force it. The v2 onion domains are weak. the v3 onion domains are much longer.

Also worth noting that v2 domains are phased out now and will no longer work. Facebook's new onion address is facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion, which is not exactly human-meaningful.

I can't believe they managed to grind that one.

Reply on news.ycombinator.com