Tor Project Blog

Interestingly, since Onion addresses are derived from the public key of the host server, Facebook had to basically brute force this address.

The process is described in "Part three" here: https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs

"The short answer is that for the first half of it ('facebook'), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits of the hash matched the string they wanted."

"Then they had some keys whose name started with 'facebook', and they looked at the second half of each of them to pick out the ones with pronouncable and thus memorable syllables. The 'corewwwi' one looked best to them — meaning they could come up with a story about why that's a reasonable name for Facebook to use — so they went with it."

(Corrected: Hash of public key not private key per itsbenweeks below)

>Like, how do I know any of those links aren't the NSA?

Well, I've only linked to communities listed by the Tor Project itself.

Otherwise, the same way you would check whether HN or your local tea store is the NSA. You do your own research, run your own risk analysis, and if you want to stay sane, by default you give people the benefit of the doubt.

Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

If you are going to be an exit node, then you should inform yourself about he legal challenges you might face, since you don't know what people will access with your IP address.

https://blog.torproject.org/tips-running-exit-node

https://www.eff.org/torchallenge/faq.html

Being an entry or middle-level node is less of a problem but some uncertainties remain, so this depends on your local laws.

> That doesn't prove he'd never use AI, but it does mean it's not some random blogger trying to sell their reputation for cheap karma before anyone notices.

It wouldn't be the first time I've seen a formerly reputable web site start churning out AI slop, unfortunately. And, for what it's worth, this other article on the site, published a few days ago, doesn't fill me with confidence either:

https://www.linuxjournal.com/content/veil-vigilance-tails-60s-new-frontiers-surveillance-resistance

It's mostly a paraphrase of the official release notes (https://blog.torproject.org/new-release-tails-60/), and it's over a year late - Tails 6.0 was released in February 2024. Even if it's human-written, it's a weird topic to choose and an extremely lazy way to write about it.

I was looking for the name of the CAP theorem, thanks for posting this!

HN discussed (https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now.

Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it.

curl -I https://www.cia.gov/index.html
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
ETag: "<>"
Last-Modified: Tue, 28 May 2019 15:05:25 GMT
Content-Length: <>
ID: <>
SESSION: <>
Date: Thu, 30 May 2019 12:36<> GMT
Connection: keep-alive
Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly
ID: <>
SESSION: <>

In general, tunneling through HTTP2 turns out to be a great choice. There is an RPC protocol built on top of HTTP2: gRPC[1].

This is because HTTP2 is great at exploiting a TCP connection to transmit and receive multiple data structures concurrently - multiplexing.

There may not be a reason to use HTTP3 however, as QUIC already provides multiplexing.

I expect that in the future most communications will be over encrypted HTTP2 and QUIC simply because middlebox creators can not resist to discriminate. It may even be necessary to serve some random (perhaps AI generated) HTTP2/HTTP3 content to mitigate active probing[2].

[1] <https://grpc.io>

[2] <https://blog.torproject.org/learning-more-about-gfws-active-probing-system>

Tor in 20202: We've succesfully killed off 90% of all actually used (as opposed to botnet) tor onion services and we're happy about it. We're protecting our end users from themselves by forcing the removal of Tor v2 protocol from the codebase. We don't care because onion services were never really something we cared about, just an add-on to trick people into thinking Tor was a real network worth building a community in. It isn't. Tor is only for people who want a pseudoanonymous clear web proxy. Forget .onion domains.

https://www.darkowl.com/blog-content/tor-v2-depreciation-shifts-darknet-landscape

https://blog.torproject.org/v2-deprecation-timeline/

https://metrics.torproject.org/hidserv-dir-onions-seen.html