Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Pass Authentication for Kagi Search

blog.kagi.com

Post reply on HN
Print view View original

101–110 of 359 posts

Re: Privacy Pass Authentication for Kagi Search

#101

Post by 1propionyl »

In general I am a very happy Kagi subscriber, but I have noticed in the past month or so that sometimes my searches (via the Safari extension) just hang. Navigating it kagi.com also hangs.

When I'm in a rush this forces me to fall back to Google which often doesn't provide good results for my queries, which is unfortunate

It generally resolves itself in under a minute, but it is still a mildly irritating availability issue that wasn't present earlier. Maybe something to do with load balancing? No clue.

Re: Privacy Pass Authentication for Kagi Search

#102

Post by autoexec »

mhitza wrote: post #10

The post hints at this, but having a shop where one can buy a privacy pass without an account makes sense. Should support some crypto currency (probably monero), and something like GNU Taler if that technology ever becomes usable.

I agree that third party stores selling tokens without any account at all would be the ideal solution, but without an account you'd be missing out on many of the features that make kagi worth using like being able to remove certain domains from results or prioritizing types of results over others.

Re: Privacy Pass Authentication for Kagi Search

#103

Post by echoangle »

abound wrote: post #97
stebalien wrote: post #86

Earlier quoted context omitted.

See section 5.5 of the linked paper https://petsymposium.org/popets/2018/popets-2018-0026.php . I'm not sure if/how Kagi implemented this, but the idea is that Kagi's "public" component can be committed to publicly (e.g., in the browser extension itself).

[I implemented this at Kagi] And you can validate this, if you try to issue a Privacy Pass search without a private token, you'll get a `WWW-Authenticate` header that kicks off the handshake, and that should be the same for all users for a given epoch (month). E.g. curl -v -H 'X-Kagi-PrivacyPass-Client: true' 'https://kagi.com/search?q=test'

But how do I validate that I’m actually getting the same value as everyone else? Is the value I should get published somewhere (in a verifiable and not editable way) so I can see that I’m not being tracked?

Or does the extension validate this and the correct value is hardcoded in the extension like stebalien suggested?

Re: Privacy Pass Authentication for Kagi Search

#105

Post by jjice »

autoexec wrote: post #85
redserk wrote: post #33

Earlier quoted context omitted.

$10 felt a bit steep until I realized there is probably the economies of scale at play here. 1) There is a marginal payment overhead. I'd assume $0.50-0.75, leaving their amount down to $9-ish. 2) It's a fairly niche product with a still-small userbase. ~40k users at ~$9/mo = $360k/mo (I know there's $5/mo users and $25/mo users but I'd assume there are far more $5/mo and $10/mo users than $25/mo users) 3) They have…

As the user of a service things like payment overhead, a small userbase, and dev salaries aren't my problem. My only concern is what I'm getting for what I'm paying. $5 a month for fewer than 10 searches a day is clearly not a good deal. $10 a month might be worth it for some, but an extra $15 a month on top of that for AI results is kind of crazy.

That extra $15 a month is for access to LLMs. They currently support the Claudes, the GPTs (not o1), Mistral, Gemini, Llamma, Qwen QWQ, Nova, and DeepSeek. It's currently unlimited access in the standard chat format.

You can also choose if you want the chat to RAG search results into the context for additional info, and then cite those sources. To me, replacing a Claude/ChatGPT subscription with $15 on top of a company I already like, while also getting a bunch of other models was a no-brainer.

Re: Privacy Pass Authentication for Kagi Search

#107

Post by abound »

echoangle wrote: post #103
abound wrote: post #97

Earlier quoted context omitted.

[I implemented this at Kagi] And you can validate this, if you try to issue a Privacy Pass search without a private token, you'll get a `WWW-Authenticate` header that kicks off the handshake, and that should be the same for all users for a given epoch (month). E.g. curl -v -H 'X-Kagi-PrivacyPass-Client: true' 'https://kagi.com/search?q=test'

But how do I validate that I’m actually getting the same value as everyone else? Is the value I should get published somewhere (in a verifiable and not editable way) so I can see that I’m not being tracked? Or does the extension validate this and the correct value is hardcoded in the extension like stebalien suggested?

There's no auth required at this stage of the handshake, so you can test from any number of devices/locations/networks/etc and confirm you get the same value. We could publish it, but it will change every epoch/month. Plus, if you don't trust the service to not issue special key pairs to track you, you probably won't trust us to not do the same when publishing the key material. There are schemes involving third-parties we could employ, but it's trust and turtles all the way down.

A malicious server could maintain separate key pairs for users it wanted to track, but you can't do it for every user because 1) it'd be clear from the WWW-Authenticate header changing, and 2) you'd have to validate tokens against every key, which would quickly get too slow to work.

Re: Privacy Pass Authentication for Kagi Search

#108

Post by MostlyStable »

autoexec wrote: post #85
redserk wrote: post #33

Earlier quoted context omitted.

$10 felt a bit steep until I realized there is probably the economies of scale at play here. 1) There is a marginal payment overhead. I'd assume $0.50-0.75, leaving their amount down to $9-ish. 2) It's a fairly niche product with a still-small userbase. ~40k users at ~$9/mo = $360k/mo (I know there's $5/mo users and $25/mo users but I'd assume there are far more $5/mo and $10/mo users than $25/mo users) 3) They have…

As the user of a service things like payment overhead, a small userbase, and dev salaries aren't my problem. My only concern is what I'm getting for what I'm paying. $5 a month for fewer than 10 searches a day is clearly not a good deal. $10 a month might be worth it for some, but an extra $15 a month on top of that for AI results is kind of crazy.

The way I think about it is how much time do I save by having better search results. I'm on a family plan currently, but was on an unlimimited 10/month plan. At the rate I value my time, Kagi needs to save me well under an hour per month through better search results. I'm quite confident it reaches and exceeds that bar relative to google. And that's even before you get into any philosophical/moral preferences for being the direct customer rather than being the product (as in ad-supported services).

Re: Privacy Pass Authentication for Kagi Search

#109

Post by redserk »

autoexec wrote: post #85
redserk wrote: post #33

Earlier quoted context omitted.

$10 felt a bit steep until I realized there is probably the economies of scale at play here. 1) There is a marginal payment overhead. I'd assume $0.50-0.75, leaving their amount down to $9-ish. 2) It's a fairly niche product with a still-small userbase. ~40k users at ~$9/mo = $360k/mo (I know there's $5/mo users and $25/mo users but I'd assume there are far more $5/mo and $10/mo users than $25/mo users) 3) They have…

As the user of a service things like payment overhead, a small userbase, and dev salaries aren't my problem. My only concern is what I'm getting for what I'm paying. $5 a month for fewer than 10 searches a day is clearly not a good deal. $10 a month might be worth it for some, but an extra $15 a month on top of that for AI results is kind of crazy.

Perhaps the product isn't for you.

I don't know Kagi's financials, but this is usually the case for a lot of products with a smaller customer base. For example, a block of Kraft cheddar will be a lot cheaper than an equivalent-sized block from an organic local dairy. There's always a customer base that is willing to pay for a differentiating feature or value.

I'm satisfied paying for it because the product works well and saves me time. I can't say the same for a lot of the random $10 impulse buys I make in a month.

Re: Privacy Pass Authentication for Kagi Search

#110

Post by sedatk »

godelski wrote: post #18

This seems cool, but I still think the pricing of kagi is rather steep. It is $5/mo for 300 searches a month, which is really going to get you under 10 a day... That's insufficient. Then $10/mo (or $108/yr) for unlimited. I'm curious if anyone knows, are companies like Google and Microsoft making more than $10/mo/user? We often talk about paying with our data, but it is always unclear how much that data is worth. Kag…

Kagi Ultimate plan ($25/mo) includes Kagi Assistant with more than 15 different models (including Claude 3.5 Sonnet, Gemini 2.0, ChatGPT 4o + o3 mini, DeepSeek R1 etc). That plan suddenly becomes the cheapest, IMHO. I know that paid versions of LLM services offer more advanced models, but you at least get ahead of the rate limits this way.
Post reply on HN