Hacker News Reader

Comment by Serow225 | Hacker News Reader

I'm pretty much ignorant about Tor, but I'm curious why the .onion strongbox address they give is a string of random characters, instead of something recognizable/memorable?

View on HN

The address is also a public key. No one else can pretend to be the New Yorker unless they have the corresponding private key.

If the address was just "newyorker.onion", you'd still need to find some way of safely verifying the public key to make sure you're really talking to the New Yorker.

This could be a naive question, but would it be possible to allow the site to choose their public key text? That way they could choose 'newyorkerstrongbox' or similar.

No, that would pretty much break the whole public-key cryptography if it were possible.

Agreed, my wording was poor - see reply below by aceberry for what I was trying to get at.

Somewhat - you can keep generating keys until the characters look like something. SR's address starts with "silkroad" followed by a few more random characters.

If they wanted to make a memorable address, they would have to run something like Shallot [1]. This is essentially brute forcing private keys until you find the public key you want. Depending on the name, that could take a very long time.

[1] https://github.com/katmagic/Shallot

Thanks, that's what I was thinking of.

I don't really understand how they can claim that shallot-generated keys are as secure as normal keys. If you are able to essentially brute force your key (to create the customized address), wouldn't the adversarial (with presumably much greater computing power) be able to do the same?

If you combine Namecoin with Tor you could get close. Have a Namecoin .bit address point to a Tor .onion address.

As long as you don't let the .bit address expire, you'll have a secure, easy to remember address people can use to access your hidden server.

I don't know the specifics, but my understanding is that the seemingly random string of characters is a crypto signature.

If I'm not mistaken, it makes the site safe from Man In The Middle attacks.

From the Tor design paper[1] section 5.2:

> Location-hidden services use a virtual top level domain called .onion: thus hostnames take the form x.y.onion where x is the authorization cookie and y encodes the hash of the public key.

[1] https://svn.torproject.org/svn/projects/design-paper/tor-des...

Reply on news.ycombinator.com