On Fri, Oct 31, 2014 at 08:54:27AM -0400, Roger Dingledine wrote:
> I talked to them about this. The short answer is that they did the vanity
> name thing for the first half of it ("facebook"), which is only 40 bits
I've put up many other thoughts at
https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs
--Roger