Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PRISM fears give private search engine DuckDuckGo its best week ever

venturebeat.com

Post reply on HN
Print view View original

91–100 of 213 posts

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#91

Post by [deleted] »

jpdoctor wrote: post #38
oinksoft wrote: post #13

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

> Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.

[deleted]

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#92

Post by diminoten »

paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

Spoiler alert: They can't decrypt it. That's why they have to ask these companies for the info, rather than just take it from the ISPs.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#93

Post by cinquemb »

lignuist wrote: post #84
cinquemb wrote: post #77

Earlier quoted context omitted.

Fair enough. > Why step into the footsteps of the dinosaurs? I'd think adding E2EE to email would be like what pagerank did to the search engine. Why build from the ground up when you can build on the shoulders of the giants?

If only someone solved the problem of bringing PGP to the masses. Maybe the need has to reach a critical mass.

I agree, and that's why I was thinking that a company that is still growing and is known for their privacy practices could be good (beach-head?) at doing this (at least being able to advertise it on their own services to get some traction and feedback).

It's not like google or anyone else is going to do it. And looking at DDG traffic, it seems like it is a growing need. Then again, how to you monetize encrypted emails? contextual encyrpted ads? ;)

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#94

Post by jerf »

paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

"How much are you willing to bet they can't decrypt https?"

I'd bet quite a bit, though not "my life", that they do not have a generalized "read everything" ability for all forms of SSL. They may have what cryptographers would call "a crack", but that's a low bar, and doesn't prove they have a practical attack.

However, DDG is currently using 128-bit RC4, which is very weak. [1] I wouldn't care to bet anything that the NSA doesn't have an RC4 cipher crack that is practical to run on wide swathes of traffic.

RC4 is very popular, which I believe is because some people claimed it was a defense against the BEAST attack. I researched this for work, and I couldn't find anyone whom I trusted saying that was a good mitigation. The people I trusted merely observed that RC4 was not vulnerable, but never said you should switch to it. Only secondary sources ever suggested that. My conclusion was that there was a reason for the primary sources never suggesting that; in response to a theoretical break of the rest of SSL, the correct move was not to move to a solution that had much more practical attacks already known than what BEAST demonstrated. But now it's even sillier; BEAST has been either entirely or almost entirely mitigated in browsers (there's no server-side defense against BEAST, but there's a client-side one you can use, and browsers now have it). As far as I can tell, RC4 should be abandoned and we should resume using stronger ciphers for SSL. Anyone still concerned about BEAST should update their browser.

[1]: http://nakedsecurity.sophos.com/2013/03/16/has-https-finally...

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#95

Post by smaili »

diminoten wrote: post #92
paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

Spoiler alert: They can't decrypt it. That's why they have to ask these companies for the info, rather than just take it from the ISPs.

Doesn't necessarily mean they don't have the ability to decrypt, it just means that they have a process in place so in case shit ever hit the fan (like it just did) they can come back and say "what's the big deal? we have a process in place"

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#96

Post by tracker1 »

jpdoctor wrote: post #38
oinksoft wrote: post #13

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

> Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.

For programming questions, I almost always append site:stackoverflow.com to my search term... generally the anser is on SO, but I prefer the search engine's results over SO's search... on DDG and Google.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#97

Post by boomzilla »

jpdoctor wrote: post #38
oinksoft wrote: post #13

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

> Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.

This is most likely that Google has more user behavior data than DDG. If enough people use DDG and click on the StackExchange link for that query (or similar queries), DDG will be able to get that to the top.

On the other hand, did DDG just use Bing API, and only Blekko crawls the web? Or do I get my search engines mixed up?

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#98

Post by zwegner »

mikemoka wrote: post #81

I like DDG, but has it ever mentioned how this TRACKING data is used? http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org... (every time you click on a search result you actually click on a link like this,which redirects you to the actual page) Is it just for pagerank?

This irritated me, as it makes me somewhat skeptical of the "we don't track" claim.

However, I noticed that if you use their HTML version (i.e., use duckduckgo.com/html/ instead), that they don't do the click-tracking. The only downside I've noticed is that there's no infinite-scrolling mode, you have to hit "next".

Whether they're still tracking the search queries, though, I have no idea...

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#99

Post by jiggy2011 »

jackpirate wrote: post #41
adamtj wrote: post #32

Earlier quoted context omitted.

In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of " https://duckduckgo.com" , it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.

>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.

If you have an hour to kill.

http://www.youtube.com/watch?v=MFol6IMbZ7Y

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#100

Post by jackpirate »

enoch_r wrote: post #71
jackpirate wrote: post #41

Earlier quoted context omitted.

>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.

The initial request/redirect response is insecure. So a MITM can intercept the redirect response and replace it with his own content. That content could be, for example, a 200 response status and HTML pulled from the attacker's HTTPS connection to the target site. So rather than being redirected to a secure connection, I happily communicate with the attacker instead.

But a redirect would change the status bar, right? So presumably it would still be pretty noticeable.
Post reply on HN