Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by jared314 | Hacker News Reader

Parent Full thread

jared314·

> But what remains interesting, and glaringly obviously absent, is user identification.

I wonder if using Facebook over Tor would help in that regard.

https://www.facebook.com/notes/protect-the-graph/making-conn...

View on HN

This is very interesting. Are you suggesting that Facebook over Tor could be a step in the wrong direction? Official NSA Facebook partnerships are for now very unlikely, but I am interested to know how Facebook over Tor could in principle solve the user identification problem listed by grand parent.

Please correct me if I'm wrong, but if someone is logged in to Facebook while browsing over Tor, aren't you just one CSRF from getting all personal details for the user?

You're corrrect. Fast Tor user attribution is a different, much harder problem, and one they don't appesr to have cracked.

If you're using Facebook over Tor, you probably shouldn't be using an account that you created on an non-Tor connection or an account tied to your real-world identity.

If you are, and you're concerned about being identified... :/

I don't think Facebook will let you register new accounts using a Tor IP.

Indeed, it works like freenet IRC where you have to make an account first then log in to it with Tor. This is solved by making a throwaway VPS or virtual desktop you ssh into with Tor, make your account, shred the VPS and then change the password when you log in directly to Fb with Tor.

You can also edit Torrc to temporarily only use your own Tor exit nodes if worried about malicious exits while setting up accounts.

Someone's WIFI connection with a modified MAC is also a good way. Just make sure it's not the neighbours WIFI.

Using Facebokk would be considered harmful, and make tge situation worse.

I'm sure they're disscussing fixes on the tor dev irc and mailing list right now if anyone's interested.

Reply on news.ycombinator.com