Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PRISM fears give private search engine DuckDuckGo its best week ever

venturebeat.com

Post reply on HN
Print view View original

51–60 of 213 posts

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#51

Post by Skalman »

aacook wrote: post #16

This is great news for DuckDuckGo and I'm all for it, however, DuckDuckGo isn't completely private right? From what I see, DuckDuckGo obtains much of its data from 3rd parties, such as Bing/Microsoft and Yahoo. http://help.duckduckgo.com/customer/portal/articles/216399-s... "While our indexes are getting bigger, we do not expect to be wholly independent from third-parties. Bing and Google each spend hundreds of milli…

I think you're not quite understanding how it works. They retrieve the data from e.g. Bing behind the scenes and the 3rd parties have no way to connect a query to an individual user.

That said, maybe there'd be an issue if you enter personally identifiable information as a query. But who does that?

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#52

Post by oneye »

betterunix wrote: post #42
oneye wrote: post #17

Earlier quoted context omitted.

Or because their entire business differentiation from the beginning has been privacy. This does not mean that it is not compromised, of course. But its why people would believe it isn't compromised. And its a much better reason than your sarcastic imitation.

"Or because their entire business differentiation from the beginning has been privacy." The same is true of Hushmail. How did that work out?

I have no idea. I (as I said) was not trying to assert that DuckDuckGo is not compromised, I was asserting that the reason that people believe it to be secure is because they've differentiated on privacy since the beginning.

Mostly, I don't like seeing condescending, inaccurate statements.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#53

Post by betterunix »

jackpirate wrote: post #41
adamtj wrote: post #32

Earlier quoted context omitted.

In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of " https://duckduckgo.com" , it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.

>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.

http://www.wired.com/threatlevel/2010/03/packet-forensics/

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#54

Post by icebraining »

jackpirate wrote: post #41
adamtj wrote: post #32

Earlier quoted context omitted.

In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of " https://duckduckgo.com" , it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.

>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.

They don't need the existing SSL cert. The "beauty" of SSL is that they can use a cert generated by any CA trusted by your browser - or even a second one from the same CA -, even if there's already a cert issued by one.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#55

Post by ghshephard »

jmillikin wrote: post #11
bcoates wrote: post #3

Earlier quoted context omitted.

They have access to IP+time, your search query, and cookies for correlation to other requests. It's valuable information and Google openly documents that they are keeping and using it, along with anything else you leak to them: http://www.google.com/policies/privacy/ IP+time is enough to get your personal identity information from your ISP (physical location of the endpoint, billing information), I have no idea if Go…

> They have access to IP+time, your search query, and > cookies for correlation to other requests. It's > valuable information Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless. > IP+time is enough to get your personal iden…

"Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification."

Maybe not when I'm coming from our company's NAT (700+ employees behind a single IP address) - but the number of people on my Comcast connection is limited.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#56

Post by paulsutter »

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion.

http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the...

They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the slide), when "Upstream" access is just as big a concern.

EDIT: rephrased my concern about direct vs upstream

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#58

Post by betterunix »

oneye wrote: post #52
betterunix wrote: post #42

Earlier quoted context omitted.

"Or because their entire business differentiation from the beginning has been privacy." The same is true of Hushmail. How did that work out?

I have no idea. I (as I said) was not trying to assert that DuckDuckGo is not compromised, I was asserting that the reason that people believe it to be secure is because they've differentiated on privacy since the beginning. Mostly, I don't like seeing condescending, inaccurate statements.

Well, the Hushmail story is pretty famous:

http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/

There is nothing inaccurate about claiming that people believe that DDG is protecting their privacy because of how the website presents itself and the claims made by the company. That is exactly why people believed (and many continue to believe) that Hushmail is protecting their privacy. The way companies advertise themselves is not necessarily reflective of reality.

Post reply on HN