Making Connections to Facebook More Secure

https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237

by jboynyc • 12 years ago

258 112 12 years ago

It concerns me that they were able to brute force a key for facebookcorewwwi.onion. If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

Looks like Tor hidden services are now broken to me...

[edit] What's to stop Facebook from brute forcing a key for any of the existing hidden services?

[edit2] If Facebook can brute force keys like this, so can the NSA and GCHQ. Tor hidden services are officially broken.

[edit3] A colleague of mine suggested that this might be simply Facebooks way of making it public knowledge that Tor hidden services can no longer be relied upon.

[edit4] Facebook are saying (on the Tor Talk list) that they generated a load of keys starting "facebook" and then just picked the one which looked most memorable, and were extremely lucky to get such a good one:

http://archives.seul.org/tor/talk/Oct-2014/msg00433.html

shawabawa3• 12 years ago

I'm hoping they just lucked out and came up with a backronym for it. I don't really know much about tor so I don't know how feasible bruteforcing is

sgrenfro3• 12 years ago

FB engineer here. We got extremely lucky then went the backronym route as shawabawa3 guessed.

im2w1l2• 12 years ago

Agreed. Likely they required facebook, and required that the rest of it would form words from some dictionary. I'd guess that the "i" at the end is a random alphanumeric (2⁵ possibilities). The positions of the words were likely arbitrary, since www comes after facebook. Lets arbitrarily say they have a word list of 128 words, that they want words from, all four letters long. This means we have 2⁷2⁷2⁵*4!/2 ~= 2²³ acceptable possibilities(the division because of the order of the random words).

mike_hearn6• 12 years ago

Nothing, and it's interesting that they have enough computational power to do that for a relatively trivial project.

Meanwhile, whilst I applaud Facebook going above and beyond here, this doesn't set a good precedent.

Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone.

Secondly, by doing this, there's now a risk that other firms who want to be on the cutting edge of privacy will try to copycat this approach, even though it makes no sense and is very complex and expensive to set up. Worse, users might think it's some kind of "gold standard".

Thirdly, it doesn't actually solve any of the reasons why Tor traffic is routinely discriminated against and harassed: Tor is effectively a "bulletproof ISP" that shields a lot of abuse and hacking. Merely making a Tor hidden service specifically for Facebook doesn't solve that, at all.

justcommenting9• 12 years ago

Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden.

As long as you don't have to use it, I don't see why offering users a choice is a problem.

If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone.

ExoneraTor does this quite well in my opinion, and I don't follow how/why you think this will slow things down for everyone. Surely you're not referring to the entire Tor network?

The main value in using this, in my opinion, is reducing the potential attack surface associated with MITM attacks--including CDNs--after your traffic exits Tor. Attacks on Facebook users involving Akamai have been documented by NSA, for example; Facebook is a PRISM partner, but this would arguably still stack the deck in favor of "going through the front door" to access Facebook user data.

meowface• 12 years ago

[quoted comment was deleted]

How do you differentiate between this and account takeovers though? If someone constantly lives in from California, and then someone elsegets their Gmail password and logs in through Tor, can you know it's actually a compromised account and not the registrant just deciding to use Tor?

bostik2• 12 years ago

Worse, users might think it's some kind of "gold standard".

That may be the worst unexpected consequence. Once onion services become more mainstream, I fear FB's example - no matter how well intentioned - will turn into an engineering nightmare. After all, after one of the best known online brands does something clever, you can expect copycats to follow.

First, we'll get clueless PHB types demanding long vanity names.

Second, some services will happen upon neat onion addresses and ride the wave. Their very existence will act as a goal post for the others.

Third, a vocal segment of users becomes accustomed to seeing "perfect" vanity names. After all, such name means that the entity behind the name has enough resources to actually get a proper vanity name.

Amidst all that, somewhere between stages #2 and #3, we will see (horribly misguided) vanity onion service name markets. A bit like domain name squatting from the late 90's, but with far worse consequences: at least with domain names the only thing transferred was the control over the DNS entry. Because onion service names are directly mapped to the private keys, selling a $VANITY.onion address is the same as selling a copy of the private key.

Caveat emptor, indeed.

wowaname7• 12 years ago

There is no need to pay this cost for a service whose ownership is not actually hidden.

DuckDuckGo is being irrational? Keybase? Riseup? Sorry, but I don't see how knowing the owner of a service can immediately disqualify the service from having the privilege of a hidden service. The only thing limiting Facebook is the stress that may be placed on so many connections at once on a single onion. It should not cost too much out of actual resources to run one single gateway, especially when Facebook is a very successful business and can afford to invest in something that may expand their audience even more.

I'm not saying anything for or against Facebook's ethics in general; I am a little hesitant given their history to trust them at all, but this is admittedly a huge step in shedding light on what Tor actually is. It's not just for drugs or child pornography; it can actually be used by the everyday Joe wanting to check on his friends and see if there's a party nearby. What people seem to miss is that Tor provides IP anonymity. Yes, encouraging users to be more careful about their browsing habits is a good thing, but if people want to give out their personal information, in the end that cannot be stopped. If the website owner wants to disclose his or her identity, that cannot be stopped. Tor provides anonymity of IP addresses and nothing else.

sarciszewski• 12 years ago

Signups from Tor on the other hand always require phone verification.

If you use Tor, what's the point in providing a phone number. All that does is give Google data that can be subpoena'd by the feds. :(

untrothy• 12 years ago

I'm guessing they used something like scallion [0] or Shallot [1].

Bench marking Shallot on an Intel 3350P@3.10GHz:

  time ./shallot ^a      -> 0.09 sec user
  time ./shallot ^aa     -> 0.12 sec user
  time ./shallot ^aaa    -> 0.12 sec user
  time ./shallot ^aaaa   -> 0.47 sec user
  time ./shallot ^aaaaa  -> 5.92 sec user
  time ./shallot ^aaaaaa -> 118 sec user

Unfortunately OpenCL doesn't work with the nouveau drivers so I can't test scallion.

Who knows how much they spent trying to brute force that onion address.

EDIT: Ok looks like they went the backronym route

[0] https://github.com/lachesis/scallion [1] https://github.com/katmagic/Shallot

tyho3• 12 years ago

There is a program called scallion [1] which can generate Vanity addresses like these. I am assuming that they searched for facebookwww?.onion and then just made up the acronym for the last character.

They are therefore trying to brute force the first 11 characters of the address. The author of scallion estimates one can achieve 520 MH/s with a AMD Radeon HD5770 GPU [2] which retails for $190 [3], they then give the formula for calculating the time (in seconds) to have a 50% chance of finding a matching URL: 2^(5length-1) / hashspeed Which with a length of 11 and a hashspeed of 520M, would take about a year with the one GPU [4]. The total cost of the hardware to have a 50% chance of finding the vanity address "facebookwww?.onion" within a week would therefore be around $11 000 [5].

Imho, this is well within the realms of possibility for a company as large as Facebook and does not suggest a weakness in the .onion scheme.

[1] https://github.com/lachesis/scallion

[2] https://github.com/lachesis/scallion#speed--performance

[3] https://www.amazon.com/dp/B0032F63TW

[4] http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+5...

[5] http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1...

[edit]

Dustcore is very correct, correcting for my initial mistake, it would take 1.1 million years on a single GPU using scallion. Finding that sort of result in a month would require $2.6 billion worth of GPUs. Now I know facebook is known for spending billions on questionable purchases, but this would be a bit extreme even for them. How the hell have they managed this?

Reply

dustcoin• 12 years ago

The url isn't facebookwww? though, it is facebookcorewww?. The additional 4 characters didn't have to be "core", but the fact that it is an english word and relevant adds significant difficulty to your estimates.

Reply

Llevel• 12 years ago

If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database.

[1] https://security.stackexchange.com/questions/23241/how-are-t...

Reply

mike-cardwell2• 12 years ago

No, the way it works is the hidden service with the most recent announcement is the one that is currently used.

Reply

nly3• 12 years ago

If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

IIRC it's 80bit truncated SHA-1, so it's not even close to feasible unless there's a substantial preimage attack against the function (and none are known). It's clearly feasible to find something close enough to the human eye for a phishing/spoofing attack, but that's hardly a problem exclusive to Tor.

Reply

akavel2• 12 years ago

Actually, to me the first thought after seeing the URL was totally: "wow, I wonder what backronym they invented for the ugly wwwi suffix." And the others posts in this thread seem to confirm that this was the case, and that this prettification mechanism is actually quite common on Tor already.

Now, the other, more important for me observation is, that reportedly the TLS certificate is actually worth close to nothing, and giving false security, as a HNer claims to have got a valid cert issued for this very same facebook's .onion address already: https://news.ycombinator.com/item?id=8539066 -- if I understand correctly, cert issuers seem to happily accept any .onion URLs in "alternative addresses" in SSL certs without any verification. Anybody else could confirm/deny?

Reply

wowaname7• 12 years ago

I cannot confirm nor deny, but if this is true, that just proves how flawed the CA system is.

Reply

justcommenting9• 12 years ago

Although this will be useful, I hope users will keep in mind that identifying themselves while using Tor could make their other traffic less than anonymous. In the Tor Browser Bundle, compartmentalizing your traffic via frequent use of the 'New Identity' feature is usually a good idea.

Using this would also add to the data that one of the world's most aggressive advertisers and an NSA PRISM partner will have about you as a Facebook user.

One plus: at least the login page appears to load correctly without javascript enabled.

Edit to add: someone whose only interest is in not sharing their IP address/location with Facebook could access this URL via facebookcorewwwi.tor2web.org but the usual browser fingerprinting and potential tracking caveats apply

Reply

driverdan• 12 years ago

identifying themselves while using Tor could make their other traffic less than anonymous

Why? With data encrypted end to end the only people who know you've identified yourself are you and the end service.

Reply

justcommenting9• 12 years ago

suppose you see an article in your news feed while using the hidden service and click on it; facebook still has a good chance of learning about your browsing habits that way, even if you start from a hidden service. facebook might then learn which exit your non-hidden-service traffic exits to, and from there, it might have information to offer to advertisers about the identities of tor users using a given exit around the same time.

even just having a strong authenticator of your real identity active on tor at a given time may be concerning, depending on your threat model.

Reply

0x02• 12 years ago

Are they serving all of the CDN contents (photos) via .onion as well?

Reply

spacefight3• 12 years ago

Which CA signed the .ontion cert in that case? Self signed?

Reply

spindritf2• 12 years ago

No. It's a fully valid ceritifcate issued by DigiCert to

    CN = *.facebook.com
    O = "Facebook, Inc."
    L = Menlo Park
    ST = CA
    C = US

with a bunch of altnames
DNS Name: *.facebook.com DNS Name: facebook.com DNS Name: *.fb.com DNS Name: *.fbsbx.com DNS Name: *.fbcdn.net DNS Name: *.xx.fbcdn.net DNS Name: *.xy.fbcdn.net DNS Name: fb.com DNS Name: facebookcorewwwi.onion DNS Name: fbcdn23dssr3jqnq.onion DNS Name: fbsbx2q4mvcl63pw.onion

Reply

spacefight3• 12 years ago

Thanks - learned something that you can put anything in the alt names list. So digicert is not checking those to be valid domains and controlled by the cert requester?

Reply

scrollaway• 12 years ago

How much would a certificate like this actually cost, to someone browsing for ssl certs?

Reply

lclarkmichalek• 12 years ago

oo a wildcard CN? I thought that was considered bad form. Well this makes me feel less guilty now!

Reply

justcommenting9• 12 years ago

.onion addresses don't work that way. but if you're asking about Facebook's SSL cert when accessing the login page via the .onion address, it's a 2048-bit DigiCert SHA-1 cert, and no ECC love..at least on the login page.

Reply

iancarroll9• 12 years ago

You can still issue internal name certs but they won't work soon as CA/B will block the issuance of them later on next year IIRC.

Reply

evgen3• 12 years ago

If by "soon" you mean November of next year, then you are correct. There is also a RFC in process to get .onion and a few similar pseudo-tlds recognized/protected.

Reply

lorddoig• 12 years ago

I dread to think how much electricity it cost them to brute that vanity URL.

Reply

jgrahamc• 12 years ago

The most interesting part of this (to me) is that they brute-forced the .onion address (which is normally the SHA-1 hash of a public key).

Good thread on StackExchange about how to do that: http://security.stackexchange.com/questions/29772/how-do-you...

Reply

sgrenfro3• 12 years ago

Also commented downthread, but we got extremely lucky then went the backronym route as shawabawa3 guessed. (I'm an engineer at FB.)

Reply

AlyssaRowan• 12 years ago

That is extremely lucky. That's, what, 82 bits if you'd chosen the whole thing?

A more manageable 61 bits for 12 characters or so, from my recollection. Did you pile a dictionary attack on top of that?

I don't believe this does "break hidden services". That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error.

Reply

higherpurpose• 12 years ago

Tor still uses SHA1? I understand clueless download sites (such as FossHub) and projects still using MD5 and SHA1, but I would hope projects that are supposed to be about security would've stopped using SHA1 a long time ago. If they dread moving to SHA2 because of its much slower performance, they should at least use BLAKE2 [1].

Even NSA-influenced NIST recommended against using SHA1 after Dec. 2013. And when NIST recommends a deadline for change, you know you should be doing that at least 3-5 years earlier to be safe against state sponsored/NSA attacks.

[1] https://blake2.net/

Reply

haakon2• 12 years ago

Agree. I never understood why onion names are so short; they're not even the full SHA-1 hash:

The .onion name is computed as follows: first the SHA1 hash of the DER-encoded ASN.1 public key is calculated. Afterwards the first half of the hash is encoded to Base32 and the suffix ".onion" is added. Therefore .onion names can only contain the digits 2-7 and the letters a-z and are exactly 16 characters long.

(Source: https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...)

Reply

nly3• 12 years ago

Even using MD5 for .onion URL generation would be pretty safe. While MD5 is completely and utterly broken when it comes to collision resistance, there aren't any (public) preimage attacks that indicate that cracking it is feasible[0].

The move to slower hash functions is really only important when you're dealing with passwords because the input is enumerable enough to bruteforce to begin with. In general, having a fast cryptographic hash function is extremely desirable, and, for applications where the input is essentially random (nonces and randomly generated keys etc) it's fine.

[0] https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability

Reply

aestetix• 12 years ago

While Facebook gets props for their astonishingly clever .onion address, it seems rather odd to promote unlinkability while continuing to enforce their legal names policy. I'd probably respect this a lot more if it was accompanied by setting up Tor exit nodes, which invites actual risk and things like FBI visits.

Reply

sp332• 12 years ago

You can at least browse public Facebook posts without logging in. But I think the main point is to avoid local censorship, reducing Tor to a simple proxy.

Reply

diggan• 12 years ago

There is no difference from accessing Facebook from .com and .onion in that case. If the main point would be to avoid local censorship, they would have a bigger effect if they instead of focusing power on running a hidden service, spent the effort on running an exit node.

Reply

nly3• 12 years ago

it seems rather odd to promote unlinkability

They're not, they just want users on networks that block facebook.com, or try to perform MITM (by hijacking DNS or the switch from HTTP to HTTPS), to be able to reach them safely.

Reply

frostmatthew• 12 years ago

while continuing to enforce their legal names policy

They've recently announced they plan to ease the real name policy http://bits.blogs.nytimes.com/2014/10/01/facebook-agrees-to-...

Reply

wtbob2• 12 years ago

Heh, my first reaction was, 'shoot, they brute-forced an address!' and I see that a lot of others had the exact same idea. I wonder how tough that was to do—I'm guessing that they didn't use Shallot!

Looks like some sort of CA structure is going to be pretty vital to Tor…

Reply

tyho3• 12 years ago

CA structure is not vital to tor at all. All connections to hidden services are encrypted and authenticated end to end. the URL serves as the public key.

Reply

wtbob2• 12 years ago

The public key which is obviously brute-forceable…

Reply

steakejjs• 12 years ago

If you want more information on the specifics behind how FB did this, here is a really really informative mailing list conversation about it. Instead of coming up with facebookcorewwwi and then searching for it, they found a bunch of "facebook" first, and then picked the best one.

https://lists.torproject.org/pipermail/tor-talk/2014-October...

Reply

dataminded2• 12 years ago

Can someone help me understand the intended user experience?

As I currently understand it, you connect anonymously to Facebook, login and link your activities to your real life identity and Facebook turns over the information that you provide to whatever powerful government entity you are hiding from.

Why would anyone do this?

Reply

evgen3• 12 years ago

Probably because the latter half of your assertion, that "Facebook turns over the information you provide to whatever government entity you are hiding from" is a lie. This protects people who feel they need to hide the fact that they are connecting to Facebook from an observer/ISP.

Reply

dataminded2• 12 years ago

Maybe my phrasing was overly strong. As I understand it, there are no guarantees that the information that we put into a service like Facebook can be kept out of the government's hands. Whether or not Facebook is doing it willingly, is not relevant to my question.

What is the value in using tor to connect anonymously to a system that ties back to your real life identity?

http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-faceb...

Reply

sinaa• 12 years ago

As I understand it, they are now making it easier for someone(i.e. hacker) to login to your account using Tor.

The attacker will not raise any flags anymore (since it could be you).

Reply

nintendo18892• 12 years ago

I have a facebook account that uses an online handle and does not have my real name or my birthday. I am now locked out of it, because I tried to login to it just _once_ through TOR. I could still have logged in, but I could not get past the identity checks. Now I am still locked out, even on the clearnet.

Reply

cordite2• 12 years ago

Huh.. I wonder if something like Cloudflare would offer something like this next? (Whether or not they might brute force vanity URLs is another matter)

Reply

justcommenting9• 12 years ago

not sure if you're trolling, but i wish cloudflare weren't so overtly hostile to tor users! i've already stopped using all but a few cloudflare sites for this reason.

Reply

cordite2• 12 years ago

I was not aware that cloudflare was hostile to tor users. I mean, I know they apparently bother my friend who uses a VPS with checking if he is human or not.

Reply

jonknee2• 12 years ago

On the other hand, tor users are very hostile to Cloudfare. The percentage of traffic from tor that is malicious is not small.

Reply

revelation• 12 years ago

Last I checked, Facebook doesn't work at all unless you are logged in.

So I can now tell Facebook my personal information and a list of associates securely, which it will then promptly share with any government interested.

I guess its the best way yet to illustrate the basic problem with Tor (no technology in the world can protect you from giving the bad guys your home address), but can't shake the feeling that this makes an utter mockery of the idea behind Tor.

Reply

justcommenting9• 12 years ago

two words for you: censored users

Reply

balderdash• 12 years ago

awesome! I can now securely hand over my personal data to a company that will turn around and sell it...what a relief...

Reply

junto• 12 years ago

Can the NSA 'tag' a specific user using Tor? If so, wouldn't using Facebook over Tor then provide them with a direct link between your FB identity and your other Tor activity?

Reply

kreneskyp• 12 years ago

Yes. If someone captures identifiable information then a user can be identified. This can be minimized by using SSL to connect to services. A service may share data so you should also use only a single service within a Tor session. That includes closing tabs to prevent ajax requests.

A new session can be created by restarting Tor or from the tor indicator if within TAILS.

Reply

lucb1e• 12 years ago

Note that, although you are right that you should usually use https on tor, it does NOT APPLY to hidden services. Hidden Services are end-to-end encrypted, regardless of whether you use http or https. That is also why a site like Silk Road simply used http: it was a hidden service.

The reason for this is that it never leaves the Tor network. Traffic from a tor client to a hidden service goes (encrypted) through relays, but never exits. Basically you are entering a validation of the public key when you type in the .onion address, so nobody can tamper with the connection.

Reply

xnull• 12 years ago

From Tor:

"So I'm totally anonymous if I use Tor?

No.

First, Tor protects the network communications. It separates where you are from where you are going on the Internet. What content and data you transmit over Tor is controlled by you. If you login to Google or Facebook via Tor, the local ISP or network provider doesn't know you are visiting Google or Facebook. Google and Facebook don't know where you are in the world. However, since you have logged into their sites, they know who you are. If you don't want to share information, you are in control."

Reply

DanBlake• 12 years ago

I think its much more likely that facebook is utilizing this to better track abuse. Its not always easy to tell if a user is using tor, and a statistically higher percentage of tor users are doing things facebook doesnt like.

By creating a entry point, they can more easily track and label users that even use that entry point, to better handle abuse.

Reply

bhartzer• 12 years ago

I'm sorry, but even the thought of a more secure Facebook site won't get me to post on there.

Reply

justcommenting9• 12 years ago

adding a link to roger's super-thoughtful and basically authoritative blog post on the subject: https://blog.torproject.org/blog/facebook-hidden-services-an...

Reply

Making Connections to Facebook More Secure

Related Stories