[Llevel]

> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database.

[1] https://security.stackexchange.com/questions/23241/how-are-t...

[mike-cardwell]

No, the way it works is the hidden service with the most recent announcement is the one that is currently used.