Facebook opens up to anonymous Tor users with .onion address
Facebook is making it easier for users of the Tor anonymising service to access the social network, by launching a .onion address.
The company is describing it as “a way to access Facebook through Tor without losing the cryptographic protections provided by the Tor cloud”, in an effort to convince Tor users that their anonymity will be maintained.
The Tor network provides privacy both by having connections jump through different servers, known as relays, across the world, making it hard to tell where the user is based, and by encrypting all of a users’ traffic.
Facebook also provides encryption using SSL, as indicated by the ‘HTTPS’ portion of the URL in the address bar. But it’s been tricky for Tor users to access Facebook in the past because of the way the social networking giant blocks hacked accounts - where it sees a user is accessing from an unknown IP address it suspects something is wrong.
“Tor challenges some assumptions of Facebook’s security mechanisms - for example its design means that from the perspective of our systems a person who appears to be connecting from Australia at one moment may the next appear to be in Sweden or Canada,” explained software engineer Alex Muffett in a blog post.
“In other contexts such behaviour might suggest that a hacked account is being accessed through a “botnet”, but for Tor this is normal. Considerations like these have not always been reflected in Facebook’s security infrastructure, which has sometimes led to unnecessary hurdles for people who connect to Facebook using Tor.”
The new .onion address – https://facebookcorewwwi.onion/ – is described as an “experiment” by the social network, which it hopes to learn from over time, and improve by also providing a .onion address for Facebook’s mobile website. “In the meantime we expect the service to be of an evolutionary and slightly flaky nature,” wrote Muffett.
Runa Sandvik, a security researcher who was consulted by Facebook on the project and previously worked at the Tor Project, said the announcement marked a “very positive step for anyone who wants to access Facebook in a secure way”
“This hidden service will provide Tor users with end-to-end encryption whenever they visit Facebook, from the Tor Browser and directly into a Facebook data centre,” Sandvik told the Guardian.
Facebook has been pushing its privacy friendly message in earnest since it was implicated in assisting NSA surveillance programmes, which it denied knowledge of. A number of privacy complaints have also been made against the firm.