> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. The .onion URL is created by hashing the publi

> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname. The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database. [1] https://security.stackexchange.com/questions/23241/how-are-tor-hidden-nodes-services-found https://security.stackexchange.com/questions/23241/how-are-t...