Alec Muffett, a security engineer who worked on Facebook's Tor onion site, writes about Tor, encryption, and UK and EU surveillance policy.
HN links it for explanations of onion addresses, answers from the author himself, and posts on UK and EU encryption and surveillance proposals.
> Not encrypted, hashed.
I'm sure you know this, but to provide some context for others - this is one of the few spots where ambiguity between [password] encryption and hashing may have played a role.
OP stated they used crack(1) shortly before L0pth was founded. That puts the timeline somewhere between 1989 and 1992. Although salted MD5 passwords had already become a known thing by then, there would have been legacy setups where some of the password database entries were indeed outputs from ancient implementations of crypt(3). Which implies DES.
To this day, if anyone wants to take a look at the crack sources[0], or download a prebuilt package[1], the default mode of operation is "I want to run passwords through crypt(3)". According to crypt(5) manpage, the legacy DES mode is still supported - just look for the string "descrypt".
0: https://alecmuffett.com/alecm/software/crack/
1: https://packages.debian.org/sid/crack (has a link to "crack-md5" package; description states: "This package provides the runtime files for the crypt() version.")
The whitepapers:
Messaging:
https://engineering.fb.com/wp-content/uploads/2023/12/MessengerEnd-to-EndEncryptionOverview_12-6-2023.pdf
Labyrinth E2EE storage:
https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf
---
Comments by:
Jon Millican
https://twitter.com/JonMillican/status/1732582565884702982
Matt Green
https://twitter.com/matthew_d_green/status/1732567051607089348
Alec Muffet
https://alecmuffett.com/article/108588
A comment by an ex-facebooker with a few suggested workarounds for this sort of block:
"... the the situation presents an educational opportunity to explore simple means to bypass to such mechanisms; ... reverse search terms, add extra search terms, mis-spell names so that the system “helpfully” fixes your typo for you after the block would have been applied in the pipeline."
https://alecmuffett.com/article/15333
Related:
https://mullvad.net/en/blog/2023/11/2/eu-digital-identity-framework-eidas-another-kind-of-chat-control/
https://alecmuffett.com/article/108139
(via https://news.ycombinator.com/item?id=38109581 and https://news.ycombinator.com/item?id=38109731 respectively, but we merged the comments hither)
They stress tested a compute farm for by brute forcing onion addresses. About 10 per week per CPU started with facebook. corewwwi was their favorite.[1] Onion addresses are longer now.
[1] https://alecmuffett.com/article/15996
Alec Muffet, who helped Twitter on this, replied to your question on his blog: Why offer an Onion Address rather than just encourage browsing-over-Tor? [0]
[0] https://alecmuffett.com/article/16007