News for hackers. Stuff that matters.
Re:Making Connections to Facebook More Secure by haakon on Friday October 31, 2014 @10:12AM (#8538795)
Agree. I never understood why onion names are so short; they're not even the full SHA-1 hash:

> The .onion name is computed as follows: first the ​SHA1 hash of the ​DER-encoded ​ASN.1 public key is calculated. Afterwards the first half of the hash is encoded to ​Base32 and the suffix ".onion" is added. Therefore .onion names can only contain the digits 2-7 and the letters a-z and are exactly 16 characters long.

(Source: https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...)

Re:Making Connections to Facebook More Secure by wowaname on Friday October 31, 2014 @07:38PM (#8541623)
Then move to I2P where there are inanely long .b32.i2p hashes. I believe Tor stuck to sixteen to balance ease of use with security. I2P decided not to truncate their hashes since they already have memorable short.i2p entries in downloadable hosts files.
Re:Making Connections to Facebook More Secure by haakon on Saturday November 01, 2014 @06:29AM (#8542663)
.onion addresses aren't particularly memorable anyway (Facebook's nonwithstanding). They wouldn't have to go to insane lengths like I2P does, but it seems like not cutting the SHA-1 in half would make it much stronger. I just feel like in striking a balance, they should err on the side of huge security margins. On the other hand, I don't really have an intuition for the strength of the current addresses, so it's not meant as criticism as much as a quest for understanding.
Re:Making Connections to Facebook More Secure by wowaname on Wednesday November 05, 2014 @05:08PM (#8564573)
Although I agree it isn't cakewalk to memorise an onion URL, it is possible and many people do it usually by grouping or mnemonics. I'm not against any change/improvement to the current address generation system in Tor; there are certainly other better possibilities for both security and scalability.