Making Connections to Facebook More Secure
It concerns me that they were able to brute force a key for facebookcorewwwi.onion. If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.<p>Looks like Tor hidden services are now broken to me...<p>[edit] What's to stop Facebook from brute forcing a key for any of the existing hidden services?<p>[edit2] If Facebook can brute force keys like this, so can the NSA and GCHQ. Tor hidden services are officially broken.<p>[edit3] A colleague of mine suggested that this might be simply Facebooks way of making it public knowledge that Tor hidden services can no longer be relied upon.<p>[edit4] Facebook are saying (on the Tor Talk list) that they generated a load of keys starting "facebook" and then just picked the one which looked most memorable, and were extremely lucky to get such a good one:<p><a href="http://archives.seul.org/tor/talk/Oct-2014/msg00433.html" rel="nofollow">http://archives.seul.org/tor/talk/Oct-2014/msg00433.html</a>