Getting big companies to run onion services
Levers for facebook
Genuine name policy
How do we make FB authenticity (give them fb without a hop from the exit node)
Website runs faster User is happier More secure More private Almost free
Round out with 1:1 data collection/conversations
Tool: EOTK: https://github.com/alecmuffett/eotk
Enterprise Onion Toolkit
Alec Muffett's role when initiated: Data privacy group
What business/security objections did you run into / what response?
How many people come to fb over Tor: 425-500k/mo => surprise
Exceptionally motivated / non-robots
Went to Community Ops. "Look for this. Pick a sample. Evaluate for evil."
Data driven response. Output <10% evil. Higher/lower than normal? Slightly more than general sample.
Hack code Bi-directional translation
Get powerful people on board Work with spam fighting teams to ensure you're not overrun by spammers when you launch
Anticipated objections: did stakeholder and impact analysis How to get PR on board?
Enabling those who already access us via Tor to do it better, faster, more securely Non-political arguments (e.g., NOT about censorship evasion) Less limiting (video, etc.)
Negligible running cost Best alternative for Tor support at FB
If facebook ran relays, fb is trying to deanonymize tor to expose them to the NSA If fb funded tor, it would be perceived as buying tor off FB site on Tor = nothing to object to
Baseline what you need
Problem statement, awareness Usage metrics External good PR case
Frame as experiment
Launch it as we're experimenting: trying to accomplish xxx benefits
De-escalates failure is shame: flaky
Have other companies come to you about how do we do this?
Yes, many Tries to help, sometimes works (e.g., propublica)
Need to at least create integration tests to make sure it won't break
Negligible running cost
Contributions to external OS projects might be a legal battle: so modifying and distributing becomes a different thing.
Initially, service will be fragile for unpredictable reasons: constant monitoring (chron jobs) required
Redundancy Have powerful friends on the inside
Do the simplest, vanilla thing and then iterate on it.
Libraries Health services Government services Retail
How/how long to come up with facebookcorewwwi.com
just grabbed a couple of clusters that were being underutilized having matt jones (-type guy) on your side helps: fb engineer, well respected, gravitas/seriousness