Facebook announced on October 31 that it has made it easier and safer for users to gain access to its social network by using a dedicated Tor hidden service at https://facebookcorewwwi.onion. A dedicated hidden service access point is a powerful move to protect journalists and anyone else who uses Tor to protect privacy or circumvent censorship.
Tor is a free and open-source software tool for making network connections anonymous. When it is in use local Internet service providers [ISPs] can’t see what a user is doing online. Sites or services that are visited can’t identify the user or where they are connecting from. In fact, an online service couldn’t even tell that a particular Tor connection is the same person who used it yesterday, unless the user deliberately identifies themselves. Since an ISP doesn’t know what a user is doing online, it can’t censor specific services or publications for a Tor user.
This makes Tor incredibly useful for journalists and sources for whom anonymity is vital for their safety. Tor is one of the most popular and effective censorship-circumvention tools in the world. It can be instrumental in enabling access to news and commentary for readers, or access to sources for journalists.
Facebook has become an everyday feature for the media. Reporters log in to cultivate sources and share work. Readers sign in to discover stories, read articles, and comment on the news. In regions such as China and North Korea access to Facebook is uniformly blocked, according to CPJ research. ISPs in Egypt, Iran, and Syria have all temporarily blocked access to Facebook during periods of unrest. This makes it harder to hear voices from those regions, denies access to a useful journalistic tool in times of crisis, and prevents candid exchange of news and commentary.
Using Facebook via Tor–Tor hidden services are accessible only with a Tor-enabled browser– provides a substantial usability and security boon for journalists, their sources, and readers. Tor is a critical component of technical security practices used by many reporters. And, for a potential reader for whom Facebook is blocked Tor may be one of the only ways to access the site.
From Facebook’s perspective, it is now easier to ensure Tor users can gain access. Connections to a hidden service can be managed individually making it less likely that actions by one user could confuse Facebook’s security filters and accidentally trigger a suspicious-activity alert for a different user. Previously, there was the risk that Facebook would lump Tor users together because they appear to be coming from the same place, and bundled activity is more likely to trip the site’s suspicious-activity alerts. By having a hidden service, journalists and others using Tor will spend less time dealing with security alerts, passing authentication tests, or being locked out of their accounts.
Facebook is a high-traffic site, and it’s reasonable to expect that its hidden service will have a lot of use. The Committee to Protect Journalists hopes that Facebook’s moves will encourage the Tor project’s upcoming work on improving hidden services. Hidden services are a fantastic tool for journalists and media organizations. Facebook’s adoption of a hidden service provides a valuable vote of confidence in their robustness, as well as a test bed to plan improvements.
Accessing Facebook via the Tor hidden service also removes the possibility of network-based interception or attack. Not only is browsing protected with HTTPs — a security measure all sites should adopt— the entire connection is encapsulated within Tor’s encrypted tunnel. Even the HTTPs connection is never available to an ISP or exit node (the final link between Tor and the regular Internet.) Only Facebook and the user are privy to those communications, or even the knowledge that a user is connecting to Facebook, which will make it safer for journalists and sources connecting over the social network.
A normal browser reveals a journalist’s IP address to Facebook when they visit the site, and this can pin down their location to within a fraction of a mile. Browsing Facebook via Tor provides no such information to Facebook. However, Tor does not prevent Facebook from knowing a journalist’s name or seeing their activity on the site.
The change was announced at the Facebook London office by the company’s software engineer for security infrastructure, Alec Muffett, who credited longtime Tor Protect volunteers Runa Sandvik and Steven Murdoch for their advice and assistance. The Tor Project also published a blog post about the change.
Enabling access for Tor users via a dedicated hidden service demonstrates a commitment to making a service safe and easy to use for journalists and others with significant privacy needs. It is a critical step in preventing censorship of that service. CPJ hopes that other online services and news sites will follow suit.