Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

searchenginewatch.com

Post reply on HN
Print view View original

51–60 of 128 posts

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#51

Post by rdouble »

spodek wrote: post #18

Google's strategy is to profit from advertising. It fundamentally benefits from knowing as much about its users as possible. Every tactic it has will always support that strategy or it will risk failure. You can tell its strategy motivates it toward evil (its term, not mine), because its slogan is "Don't be evil." It chose that slogan because it risks being evil, in its own terms. It doesn't need a slogan like "Don't…

The slogan was probably more about not being like Microsoft, which was the top example of a successful software firm at the time, and was considered pretty evil.

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#53

Post by JoshTriplett »

wcchandler wrote: post #43
JimJames wrote: post #28

Earlier quoted context omitted.

IIRC HTTPS would encrypt your data from your ISP.

Until PRISM subpoenas DDG and gets their private keys -- after which they can decrypt the SSL traffic.

Not necessarily possible even with the private keys. If you use an SSL cipher with ephemeral keys, such as the DHE_* or ECDHE_* family of ciphers, then an eavesdropper with a recorded but not MITMed conversation cannot decrypt it even with the server's private SSL key.

See http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se... for example.

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#54

Post by craigching »

mbq wrote: post #10
clicks wrote: post #6

Earlier quoted context omitted.

Yep, exactly. Now, this makes me wonder: What could be an equivalent implementation for e-mails. An e-mail host that encourages immediate download, totally deletes e-mail contents, deletes logs of any sort, etc. when you delete messages?

You can start your own mail server and make it encrypt all incoming messages with your GPG or SMIME public key. This way NSA will have to collect your old messages from various senders' servers (or the archive made by their sniffers).

That's the second time I've seen someone use GPG and the first time I assumed it was a mistype and they meant "PGP", so I looked it up. Just in case anyone was in the same boat as me:

http://gnupg.org

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#55

Post by bionsuba »

DominikR wrote: post #50
spodek wrote: post #18

Google's strategy is to profit from advertising. It fundamentally benefits from knowing as much about its users as possible. Every tactic it has will always support that strategy or it will risk failure. You can tell its strategy motivates it toward evil (its term, not mine), because its slogan is "Don't be evil." It chose that slogan because it risks being evil, in its own terms. It doesn't need a slogan like "Don't…

You are absolutely right, this is clear evidence that Google is evil. In fact, this chain of evidence is of such brilliance and importance for mankind, you should be appointed US Attorney General. We should once and for all end this evil and put all Google employees in prison.

Wow, the snark in this comment is so thick that you could cut it with a knife. How about instead you comment on why he's wrong instead of just being condescending.

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#56

Post by craigching »

senthilnayagam wrote: post #27

I changed my default search engine on safari to DDG, am I happy, no but willing to give them a chance and also using other search sources(github) for my purposes

On mobile safari you can't change the search engine (that I know of), so I've switched to the Mercury browser which does allow me to use DDG. I'm actually quite happy with Mercury, it's a snappy little browser with a good feature set!

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#57

Post by chris_mahan »

jusben1369 wrote: post #39
Kylekramer wrote: post #32

Earlier quoted context omitted.

Isn't DuckDuckGo's strategy to profit from advertising? Does that mean it will inevitably become "evil"?

No! Because it has cleverly avoided having any reference to "evil" in its slogan.

It is evidently trying to avoid becoming a duck.

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#58

Post by lgray »

JimJames wrote: post #21
hawkharris wrote: post #12

At the end of the article the author insinuates that the Bing ad partnership might lend itself to tracking users or otherwise making the service less secure and anonymous. Is that possible?

IIRC it depends how the ads are routed. The ads could be piped through duckduckgo so Bing only receives searches to return contextual ads for but has no knowledge of the IPs for each search. Duckduckgo then embeds the ads in the search page and returns it to the searcher, then forgets their IP. On the other hand if there's just a bit of javascript on the search page that says "Tell bing to put ads on this page using…

I was looking into this recently, and I found this, on the FAQ:

"Ads cannot be retrieved from the developer directly but instead through the end user's browser. Calling for the Ads from a server will lead to detection and termination of the customer."

http://developer.yahoo.com/boss/search/boss_api_guide/sb_spo...

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#59

Post by faddotio »

JoshTriplett wrote: post #53
wcchandler wrote: post #43

Earlier quoted context omitted.

Until PRISM subpoenas DDG and gets their private keys -- after which they can decrypt the SSL traffic.

Not necessarily possible even with the private keys. If you use an SSL cipher with ephemeral keys, such as the DHE_* or ECDHE_* family of ciphers, then an eavesdropper with a recorded but not MITMed conversation cannot decrypt it even with the server's private SSL key. See http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se... for example.

What's preventing the government from coercing DDG to start log collections at their end, and then sealing it with a gag order?

Re: DuckDuckGo Sees Record Traffic After NSA PRISM Scandal

#60

Post by Zikes »

dotmanish wrote: post #36
arnoooooo wrote: post #26

Earlier quoted context omitted.

POST parameters also usually won't show up in logs, unlike GET parameters.

Whose logs?

Web server logs typically don't record POST parameters. It's possible that the web server could record them anyways, though.
Post reply on HN