Alec Muffett

They stress tested a compute farm for by brute forcing onion addresses. About 10 per week per CPU started with facebook. corewwwi was their favorite.[1] Onion addresses are longer now. [1] https://alecmuffett.com/article/15996

Related: https://mullvad.net/en/blog/2023/11/2/eu-digital-identity-framework-ei… https://alecmuffett.com/article/108139 (via https://news.ycombinator.com/item?id=38109581 and https://news.ycombinator.com/item?id=38109731 respectively, but we merged the comments hither)

Alec Muffet, who helped Twitter on this, replied to your question on his blog: Why offer an Onion Address rather than just encourage browsing-over-Tor? [0] [0] https://alecmuffett.com/article/16007

One of the devs working on this already answered - https://alecmuffett.com/article/16007

> let's assume it's accurate. This article tries to understand where that number comes from (and fails to do so): https://alecmuffett.com/article/15902

Confusingly, perhaps intentionally so, it's a global number, not a UK one. Details here. https://alecmuffett.com/article/15902 Disclosure: I wrote the blogpost.

A comment by an ex-facebooker with a few suggested workarounds for this sort of block: "... the the situation presents an educational opportunity to explore simple means to bypass to such mechanisms; ... reverse search terms, add extra search terms, mis-spell names so that the system “helpfully” fixes your typo for you after the block would have been applied in the pipeline." https://alecmuffett.com/article/15333

> Not encrypted, hashed. I'm sure you know this, but to provide some context for others - this is one of the few spots where ambiguity between [password] encryption and hashing may have played a role. OP stated they used crack(1) shortly before L0pth was founded. That puts the timeline somewhere between 1989 and 1992. Although salted MD5 passwords had already become a known thing by then, there would have been legacy setups where some of the password database entries were indeed outputs from ancient implementations of crypt(3). Which implies DES. To this day, if anyone wants to take a look at the crack sources[0], or download a prebuilt package[1], the default mode of operation is "I want to run passwords through crypt(3)". According to crypt(5) manpage, the legacy DES mode is still supported - just look for the string "descrypt". 0: https://alecmuffett.com/alecm/software/crack/ 1: https://packages.debian.org/sid/crack (has a link to "crack-md5" package; description states: "This package provides the runtime files for the crypt() version.")

The whitepapers: Messaging: https://engineering.fb.com/wp-content/uploads/2023/12/MessengerEnd-to-… Labyrinth E2EE storage: https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncr… --- Comments by: Jon Millican https://twitter.com/JonMillican/status/1732582565884702982 Matt Green https://twitter.com/matthew_d_green/status/1732567051607089348 Alec Muffet https://alecmuffett.com/article/108588