Facebook started out blocking users of the Tor network in 2013, but have recently had a change of mind and now Facebook allows Tor access to the site even providing a special .onion address for users of the network to directly connect to Facebook infrastructure.
It’s an interesting decision as many of the Facebook ‘security controls’ will fail due to a Tor users appearing to come from many different geographical locations during one browsing session.
Facebook has changed its stance on Tor traffic and will now provide users with a way to connect to its free content ad network using the anonymizing service.
The company said that it will now offer a special URL – https://facebookcorewwwi.onion – that will allow users running Tor-enabled browsers to access the service.
Facebook had previously blocked Tor access, citing security concerns and the possibility that Tor could be used to conduct attacks on its servers.
The social network said back in 2013 that it would work with Tor on a possible solution. Now, more than a year later, it seems one is at hand. Even as it launched of the Tor access address, however, Facebook acknowledged that the Tor network poses some risks.
“Tor challenges some assumptions of Facebook’s security mechanisms – for example its design means that from the perspective of our systems a person who appears to be connecting from Australia at one moment may the next appear to be in Sweden or Canada,” Facebook senior engineer Alec Muffett said in announcing the move.
You can view the Facebook post about this here: Making Connections to Facebook more Secure
There’s still a major issue with this though, as you can see in the comments, Facebook still only has a front end based around JavaScript (the mobile interface doesn’t work via the Onion address) – which is a big no-no for the privacy paranoid Tor users.
“In other contexts such behavior might suggest that a hacked account is being accessed through a ‘botnet’, but for Tor this is normal.”
The company said the service would also use SSL atop Tor with a certificate that cites the unique Tor address. This, the company said, will allow Tor to maintain a secure connection and prevent users from being redirected to fake sites.
“The idea is that the Facebook onion address connects you to Facebook’s Core WWW Infrastructure – check the URL again, you’ll see what we did there – and it reflects one benefit of accessing Facebook this way: that it provides end-to-end communication, from your browser directly into a Facebook datacentre,” Muffett said.
Those who are privacy conscious may still want to note, however, that measures such as Facebook’s controversial “Real Name” policy remain in effect.
The fact it’s running over SSL is a good move too as a Tor user, it means your connection is direct and encrypted right into the Facebook datacenter. Although what you are doing on Facebook that’s so critically important and needs protecting – I really don’t know.
Either way, it’s a cool move from Facebook and we’ll be watching to see what else they come out with.
Source: The Register
godspyre says
Might be a move by the US/NSA to study Tor and compromise it later on.