Anyone else wondering if DDG will come out with their version of email? Maybe something that uses end to end encryption (maybe working together with Mozilla Foundation)?
PRISM fears give private search engine DuckDuckGo its best week ever
61–70 of 213 posts
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#62Why would anyone believe that DuckDuckGo isn't already penetrated?
Really. If understood correctly, the NSA had direct lines to the fiber. It doesn't matter what search engine you use.
the issue is with HTTPS. To read that traffic NSA collects private keys from limited number of [big] companies as collecting them from all companies would be a very public affair. Thus from NSA's price/performance point of view smaller enterprises may be still be off the hook (for now).
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#63It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…
If you're using HTTPS, they can't even see your URLs or headers. That's sort of the point.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#64I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.
> Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.
http://www.samuru.com is better for concise answers.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#65It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…
> I dont understand all the hubbub about direct server access
It's upsetting. It's a breach of trust for the provider and the government. It's more principle than technical.
Both the "upstream" and "direct" methods are upsetting, just in different ways and for different reasons.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#66Why would anyone believe that DuckDuckGo isn't already penetrated?
It's a fair question, I'm ashamed by the snarky answers. If Google can't oppose the NSA in installing backdoors (by the way, this has to be demonstrated), DuckDuckGo can't oppose them neither. Best luck to the team of DuckDuckGo, it's a nice project.
They probably didn't install back doors and are just pulling in the data from the internet backbone.
Tapping off the fiber.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#67Anyone else wondering if DDG will come out with their version of email? Maybe something that uses end to end encryption (maybe working together with Mozilla Foundation)?
This is where they would kill it. Search would be supplementary, but if they pivoted and focused on email (eventually rebranding it), then that's a home run in my book. I'd like to see this, and would be interested in beta testing if/when it happens.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#68Earlier quoted context omitted.
In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of " https://duckduckgo.com" , it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.
>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.
You are assuming they are looking exactly at search requests. Email is unencrypted and so is DNS. The rest they store in case they can break it later.
They were doing this in 2007 at AT&T Worldcom I expect it only got better over the past 6 years.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#69It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…
If you're using HTTPS, they can't even see your URLs or headers. That's sort of the point.
Email is unencrypted in transit.
Re: PRISM fears give private search engine DuckDuckGo its best week ever
#70Not that this is going to help. The NSA is probably tapping the fiber at the ISP's backbone in front of Google. Why do you think it is called PRISM? It's probably named for the way they are splitting the fiber and recording everything.
Or it could be an API for issuing FISA warrants and collecting the requested data. (The NSA may very well be doing both.)
They are probably doing both.