Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Duck Duck Go: Illusion of Privacy (2013)

etherrag.blogspot.com

Post reply on HN
Print view View original

51–60 of 128 posts

Re: Duck Duck Go: Illusion of Privacy (2013)

#51

Post by fish_fan »

jacquesm wrote: post #49
fish_fan wrote: post #45

Earlier quoted context omitted.

You didn't actually disagree with your parent comment. It is possible to be anonymous on TOR. It does not come for free.

Well, if you want to trust your anonymity to luck or not being monitored then yes, you can be anonymous on Tor. But that's little comfort. It's possible to cross a highway blindfolded too. But it isn't smart to do so and it is even less smart to assume that it will always work just because you can't see the danger with your silly blindfold on.

Thankfully, none of your assumptions are true if you consider TOR one part of anonymity as your parent comment did.

Not to mention, you conspicuously avoid comparing degrees of anonymity. Obviously TOR is better than SSL, which doesn't provide any anonymity.

Re: Duck Duck Go: Illusion of Privacy (2013)

#52

Post by kasbah »

KGIII wrote: post #41
kasbah wrote: post #7

Recently I have been using the free and open source Searx more and more (admittedly mostly using the !searx shortcut from DDG). Results seem better than DDG sometimes. Would be interesting to try and host my own instance or write something that picks a random public instance. https://asciimoo.github.io/searx/

Along that same line is YaCy. https://yacy.net/en/index.html

I think YaCy didn't give me very good results last I tried it. It's not a fair comparison, as it has been a few years for sure, but if I had to guess then I would say that Searx, being just a search engine aggregator (it doesn't do crawling), gives better results.

Re: Duck Duck Go: Illusion of Privacy (2013)

#53

Post by uabstraction »

chiefalchemist wrote: post #18
TAForObvReasons wrote: post #14

Earlier quoted context omitted.

The article was a response to a guardian article that ultimately cited https://siliconangle.com/blog/2013/06/14/duckduckgo-the-pris... > “By not storing any useful information, DuckDuckGo simply isn’t useful to these surveillance programs,” says Weinberg. “We literally do not store personally identifiable user data, so if the NSA were to get a hold of all our data, it would not be useful to them since it is all truly…

Not to get off topic but there's a part of me that suspect the Equifax hack has the NSA (or will ultimately filter back to them). When I read Dragnet Nation a couple years ago one of the things that left an impression on me was the fact that the gov can buy "private" personal data on the open market just like anyone else can. That is, it's not spying (and a violate of right / laws) if the data is on the free market.…

> there's a part of me that suspect the Equifax hack has the NSA

This is ridiculous. It makes no sense why the NSA or any other members of the US Intelligence Community would cause this sort of reputational damage and nationwide outrage to a company when they could simply walk up to them with one of those fancy national security letters with a built in gag order and take the information with much less of a fuss.

Other than that, I agree. Google should buy me a god damn drink if they really want to get to know me. :)

Re: Duck Duck Go: Illusion of Privacy (2013)

#54

Post by confounded »

blfr wrote: post #40
confounded wrote: post #22

Earlier quoted context omitted.

Is it? For who? Do you think people's data would be more secure at the border if - You kernal-hacked iOS so that it booted into a vanilla account upon entry of a certain passcode, and encouraged people to install your hack from GitHub, potentially borking their phones - People couldn't be compelled (or face being denied entry) to allow search of their electronic devices ? What about trying to do everything via a VPN…

Is it? For who? For HN readers. And probably in general. As for your questions, I would definitely like to first use software which doesn't compromise my privacy and security and only as a very distant second have some bureaucrat who would maybe in the best case scenario fine a company which leaks my data. The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in th…

Don't get me wrong, I'm all for using technology to preserve privacy.

> The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in the general elections.

I kind of agree, but, not if the new leader outlaws using Tor tomorrow, as they have in China and Iran, and are attempting to do in Russia and France.

> bureaucrat who would maybe in the best case scenario fine a company which leaks my data

You may be selling the power of legislation short. It has the power to entirely transform the default business model of the Internet away from surveillance capitalism, for example. In terms of privacy, this would eliminate entire classes of "threat".

We frequently under-estimate our power as technologists to influence these things; we have very much more than a single vote. The narrative of 'technology' in the media is almost entirely that of billionaires and spies, and the media are gradually starting to realize that they're being led along. Getting the voice of technologists to explain the societal impacts of technology policy is a problem that we need to identify with as group.

Re: Duck Duck Go: Illusion of Privacy (2013)

#55

Post by KGIII »

kasbah wrote: post #52
KGIII wrote: post #41

Earlier quoted context omitted.

Along that same line is YaCy. https://yacy.net/en/index.html

I think YaCy didn't give me very good results last I tried it. It's not a fair comparison, as it has been a few years for sure, but if I had to guess then I would say that Searx, being just a search engine aggregator (it doesn't do crawling), gives better results.

I tried it last about six months ago. It was a marked improvement over what it was a couple of years prior. I like that it is decentralized and stores no private data. To me, the decentralized part is important. But, I'm not sure I'd say it's ready for prime time.

With Searx, you still need the regular search engines. I suspect that your traffic can still be identified, say through timing requests or from piecing together behavioral data. I haven't really dug that deep to investigate the risks.

I will give it a shot tomorrow, just to try it out. I've seen it in passing but you're the first person I've seen, in the wild, that uses it. I'll give it a test run.

Re: Duck Duck Go: Illusion of Privacy (2013)

#56

Post by Fice »

fiatjaf wrote: post #16
stinkytaco wrote: post #6

Earlier quoted context omitted.

I've argued here at HN before that I don't think this is a technological problem, but a social one. There is nothing that stops a powerful enough actor from breaking encryption with a rubber hose, except for a strong stigma against that kind of behavior. We need to give digital privacy the same social protection. The other problem with making a purely technical solution is that you leave out people who are not capabl…

Solving the problem with technology is 1000000 times easier than solving it from the "social" side.

A decentralized technology only works until some corporation with large advertising resources creates a proprietary centralized service around it and most people flock to their offering. E.g. Bitcoin is becoming centralized around popular online wallets, exchanges and pools; email was supposed to be decentralized, but now most people use Gmail; etc. We will not achieve full decentralization until it becomes both technological and social norm.

Re: Duck Duck Go: Illusion of Privacy (2013)

#57

Post by goptimize »

jerheinze wrote: post #32

If you're worried that DDG may log your IP you can simply use it with the Tor Browser (it's the default search engine) or use their onion service ( https://3g2upl4pq6kufc4m.onion/ ) for increased security and anonymity.

Tor is designed to make sure that the most active sheeples stay close and so it is cheaper to deal with them.

Re: Duck Duck Go: Illusion of Privacy (2013)

#58

Post by goptimize »

sfRattan wrote: post #8

I think DuckDuckGo is unfairly singled out here. They do more than most companies to protect privacy, and most of their users are specifically trying to deprive Google of more feed for its data silo. Of course they can't protect you from the NSA. Extremely few actors can. If your threat model includes actors within the US Federal Government (especially the intelligence community), run. Yesterday. That's a statement a…

If they use Amazon servers, NSA can get data from Amazon without dealing with DDG at all.

Re: Duck Duck Go: Illusion of Privacy (2013)

#59

Post by belorn »

pmoriarty wrote: post #48
belorn wrote: post #34

Earlier quoted context omitted.

While that is always possible, I think its more plausible that they then simply buy out key companies rather than found a bunch of new companies in hope that one will succeed. The question then is, what is the likelihood that NSA is the secret owner and operator of Microsoft, Apple or Yahoo, which each would likely be the cost effective choice if one wanted access to all search queries done on the Internet. Independe…

"I think its more plausible that they then simply buy out key companies rather than found a bunch of new companies in hope that one will succeed." How many new search engines were focusing on privacy and security as their main differentiator from the competition? I know of only one: DDG

Here is a meta article with the clicky 5 best search engines that respect your privacy with the lesser clicky official title: Privacy Search Engines 2017 Group Review. :"https://www.bestvpn.com/privacy-search-engines/

https://en.wikipedia.org/wiki/List_of_search_engines

That list is long and show that there has been quite a few people have tried to get momentum in the search engine space. Would be interesting if anyone did a meta study to see how many uses the words "security" and "privacy" as marketing to gain users.

I think we should also include open source search engines and p2p, since if NSA developed them they could build backdoors in them. Most of them seems to have "privacy and security" as explicit goals.

Re: Duck Duck Go: Illusion of Privacy (2013)

#60

Post by indefenseofddg1 »

The issues brought up in this post apply to every single service operating online, and it only applies to DuckDuckGo in any special way because of their increasing size. This includes "client" encrypted webmail and similar applications: they can be forced to deliver malicious JS that gives up your keys, or the JS client delivery can be MitM'ed.

Many people seeking enhanced privacy from DuckDuckGo are seeking privacy from Google, not from state actors. For that, you'd need additional measures like Tor, for which DuckDuckGo provides a convenient .onion service. Even if DDG is secretly tracking all our searches, they have less data to correlate it with.

My current privacy complaint on DuckDuckGo, combined with browser search UI issues (looking at you, Chrome) is over the !bangs. If you're doing "!w [sensitive topic]" instead of tabbing to Wikipedia search in your browser and searching that way, you're risking DDG or anyone who's compromised DDG seeing your Wikipedia searches, when the search should go straight to Wikipedia, Twitter, Stack Overflow, and so on.

Post reply on HN