Facebook Password.org
Download ->->->-> https://bltlly.com/2t8mTd
Does a little prompt in the upper left hand corner come up when you sign into your account? if so it will ask you to 'update password' for : facebook.com, hit update or yes and it should 'autofill' the next time.
At this point I was convinced that, despite its quirks, the message was probably legit. To further support this judgment, I combed through the original message and checked all the links. A scam message that uses deadlines or other scare tactics to make you click a link will almost certainly link to a dangerous page. All the links in this message went straight to facebook.com.
The short answer is that for the first half of it ("facebook"), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits of the hash matched the string they wanted.
So to be clear, they would not be able to produce exactly this name again if they wanted to. They could produce other hashes that start with "facebook" and end with pronouncable syllables, but that's not brute forcing all of the hidden service name (all 80 bits).
In terms of combating total commercial overtake of the public internet, I've recently come to think of and refer to what you term the public web as the corporate web. I really believe that one should be very careful here with terms, as it would seem thatfacebook is making inroads into "the private web" .
As facebook's business model is corporate surveillance (based on tracking you and profiting from that), this is a step towards merging the public and private webs and so leads towards the private web becoming commercialised.
This blog post didn't mention that at all. If nything, facebook having a hidden service means it "legitimizes" it to regular people, and might be the catalyst Tor needs to have more people running dual setup sites. One clear and one hidden.
Isn't one argument in favor of using https for hidden services that it allows authentication of clients through client certificates? (Obviously, this isn't an argument that is relevant to the facebook case).
"Then they had some keys whose name started with "facebook", and they looked at the second half of each of them to pick out the ones with pronouncable and thus memorable syllables. The "corewwwi" one looked best to them..."
Right. The reason not to use https directly to www.facebook.com is that any of the 300+ certificate authorities around the world can produce an https cert for www.facebook.com that your browser will trust. Those include Turkish Telekom, China has one, etc. Go read about Diginotar for an example of how this can go wrong: The "CA infrastructure" is not particularly robust.
It should be kept in mind that facebook is just another surveillance project. It has all properties. And it is most intrusive, the users give all their data about every aspect of their lives. The NSA does the same, but without people knowing about it for the most part. Facebook is severe data retention. The NSA is larger, but both are doing the same. Think about that. Most websites have like-buttons which tell facebook on pageload who opens which websites, even without being logged on to facebook. This isn't funny anymore.
The certificate isn't just to stop MitM between Facebook's hidden service and Facebook's core, but to give users confidence that the hidden service is run by Facebook. The certificate is not for facebookcorewwwi.onion, but for *.facebook.com with a subject alt name of facebookcorewwwi.onion. This is not something the browser UI makes obvious, but it at least gives visitors to the hidden service who care to check a good degree of assurance that it belongs to the same owner as facebook.com. Before issuing a certificate for facebook.com, the CA would have performed at least some checks that the request really came from Facebook.
This could also allow for clear distinction between tor and non tor users. As we already know, anonymity systems are a breeding ground for unscrupulous behavior that undermines legitimate use. Normal facebook users would previously see this behavior and dismiss it as random trolling or contamination. If FB now chooses to clearly distinguish tor users, such behavior will now be by many previously unaware, directly associated with tor, it's users and the anonymity world altogether. This could reverse growth by slowly programming users of the social giant to detest Tor/Anonymity users because of the acts of the immature and inconsiderate. I mean, wow! The crap I've seen submitted to facebook by likely untraceable users is without a doubt the worst thing a person will see in their lifetimes. A deep scar experienced by a huge user base with a clear link to TOR. Time to take mitigating steps.
P.S. I wonder the costs incurred by FB for this undertaking. How profitable will this be? Hidden services are currently very inefficient. Only a fraction of tor users access facebook using tor. Censoring governments could (if tor users are now labeled) then more effectively target it's users. If FB helps to improve the HS protocol, great! Otherwise we could likely walk away from this with a darker cloud over the anonymity scene with nothing to show for it other than a foul experience cause of some impulsive small minded closet monsters. This of course predicated on tor user labeling.
Exactly. The facebook administrative are aware of the difference but average users could (if tor users are clearly labeled when using this new service) now see the distinction. Now your everyday clearnet user will be able to associate abuse and tom fuckery with Tor users. This could have a slow degenerative effect on public opinion regarding tor and anonymity.
Now, if facebook admins choose to clearly label a tor user as such. Any inappropriate behavior on part of the tor user will be easily associated with tor. Clearnet users will now know and attribute the misuse of facebook to the perpetrating tor users.
With facebooks far reaching social structure, it's feasible that a small group of attackers could ruin tor's public image by gathering a large amount of facebook "friends" over a period of say 3 to 6 months to then finally drop a cp bomb viewed by millions. If each of those viewers could easily link the image to tor, then game over. Public outcry would be enormous and arguing the primary goal of tor and it's benefits could fall on dead ears. Most people can't think rationally when angry, and as we all know cp is endless fuel.
1. facebook continues to block tor traffic with checkpoints.2. facebook filters out tor traffic when trying to register. forces phone verification.3. facebook checkpoints and auto locks outs users with pre existing accounts that connect over tor
It is very nice to see https together with onion, Not for tls itself, As if it is Run On the same machine it would be only adding Extra round trips and thus increasing latency upon Connection BUT:There Are some nice benefits of this Setup see:facebookcorewwwi.onion:443 direct:// spdy/3.1fbcdn23dssr3jqnq.onion:443 direct:// spdy/3.1This means, SPDY through darknet is increasing your Connection throughput alot. You can compare or Benchmark it On your own by Connecting To :80 and actually feel the difference. For load balancing reason they may offloading by https Proxy wich means in this Setup your Connection is encrypted even To the last End. See Facebook Statement, Look nsa google internal Network unencrypted eavedropping traffic papers.
I think there is an exploit there.1) You have to enable javascript to sign up.2) After signing up facebook ask me to confirm my identity with a mobile phone number or legal documentation of my identity.
Yes the password for facebook is stored in Mozilla cookie. Also I have one stored in Chrome. But I think I'm doing something wrong. Once the Password Extractor boots up, there's no option to load the files located in 'Entries' folder. FPE simply pops up an error "No authentication data for facebook accounts were found on this computer". Opening the encrypted entries with the "FPE" program hasn't helped either.
so i could use some help, i cant get access to either my old facebook or gmail. and unlike the above user i have a open and honest explanation. i just got outta jail, and the password i made two years ago high on drugs is something i havent the slightest hope of remembering. if anyone could help id be forever grateful 2b1af7f3a8