Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Duck Duck Go: Illusion of Privacy (2013)

etherrag.blogspot.com

Post reply on HN
Print view View original

111–120 of 128 posts

Re: Duck Duck Go: Illusion of Privacy (2013)

#111

Post by nickpsecurity »

api wrote: post #66
KGIII wrote: post #39

Earlier quoted context omitted.

If I were a conspiracy theorist, I'd think there was something nefarious going on when I see articles like this. What if the intended result is not actually browbeating DDG but, rather, making people think that DDG is no better than Google in the privacy arena so why invest the energy in switching? If DDG isn't any better than maybe nobody is, so we might as well get used to the lack of privacy. Why switch if you're…

Conspiracy just means multiple people working together in secret toward some common goal. People do that all the time. Why just last week we had a closed door meeting at my company about how we might conspire to create more interest in the user community for our product. That's a conspiracy. Of course there are nutty conspiracy theories but there are nutty math and physics papers too. I feel like the blanket ridicule…

It's good to finally see someone else say that. If you want more data to use, I tried to hit this in a systematic way in a counterpoint to Bruce Schneier on psychology of conspiracy theory:

https://www.schneier.com/blog/archives/2013/06/the_psycholog...

I meant to turn that into a standalone essay, too, but forgot about it. Thanks for the reminder.

Re: Duck Duck Go: Illusion of Privacy (2013)

#113

Post by korzun »

djsumdog wrote: post #109
Quiark wrote: post #107

Earlier quoted context omitted.

Can you be a bit more specific on your claim that the various agencies can break TLS?

They don't have to DDG runs on AWS. In theory, court orders could grant access to the underlying VMs via Amazon without DDG even being notified.

That would be pointless if DDG is using autoscale, etc. EC2 is not metal. Furthermore, this would be similar to getting a warrant that covers whole county because of a single resident. Amazon would easily shut it down.

Re: Duck Duck Go: Illusion of Privacy (2013)

#114

Post by albinofrenchy »

chiefalchemist wrote: post #102
albinofrenchy wrote: post #69

Earlier quoted context omitted.

This vaguely reminds me of the time a paranoid coworker told me not to store tax documents on the cloud because the government could get at it.

You're missing the point. That is it's possible, if not probable (per books like Dragnet Nation, Snowden, etc.) that data is being collected and you have no idea why, who, etc. I'm not saying i think that's what happened. I'm saying there's a part of me that has good reason it it's possible it could be that. Crazy? Not more than some of things we know the intelligence community has done or tried to do.

I'm not missing the point. I'm not saying it isn't happening because it's some crazy Tom Clancy plot. I'm saying the intelligence agencies have better ways of getting that data without also giving it to a ton of other bad actors

Re: Duck Duck Go: Illusion of Privacy (2013)

#115

Post by alsadi »

To be fair here is ceo response quote

Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business.

We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt.

There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example.

Re: Duck Duck Go: Illusion of Privacy (2013)

#116

Post by pdimitar »

oelmekki wrote: post #98
pdimitar wrote: post #3

The only conclusion I can make from this article is to avoid services hosted in the USA but even that is not guaranteed to work -- having in mind that US agents have been known to go abroad to request access to foreign company's servers. (They were even supposedly thrown out from Iceland once -- assuming that wasn't a honey pot propaganda operation to lure people to host stuff in Iceland, of course.) What's left for…

> The only conclusion I can make from this article is to avoid services hosted in the USA The thing is, there are absolutely no guarantees it's any better in other countries : the fact that NSA activities were revealed doesn't mean other countries don't do as bad. It's probably still a good idea to segments services across countries, though, so that it's not a single country who have access to all data. I was thinkin…

I have asked myself the same. I see two-fold answer:

(1) Business who are familiar with web tech and for them it's simply good business to not invest in entirely new (for the dev teams in there) stacks and data formats.

(2) Political pressure -- we know that NSA successfully pushed a broken crypto once in the past, so it's not a stretch to theorize that influential people were whispering in the right ears at the right time.

Even though #2 is just as likely as #1, please note that I think #2 probably happened much, much less than #1. We should never attribute to malice that which can be attributed to incompetence and short-sightedness.

EDIT: There are several very good candidates for data formats out there which are much more efficient than JSON. Adoption is seldom an issue; if one corporation pushes for the format, it's a matter of several months at the most before that format becomes widely supported. Replacing JS might be much harder but efforts continue even today.

Re: Duck Duck Go: Illusion of Privacy (2013)

#117

Post by asmdev »

alsadi wrote: post #115

To be fair here is ceo response quote Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us…

Here is the link to the CEO's response for those interested: http://etherrag.blogspot.in/2013/07/duck-duck-go-illusion-of...

Re: Duck Duck Go: Illusion of Privacy (2013)

#118

Post by enraged_camel »

djsumdog wrote: post #110
chiefalchemist wrote: post #99

Earlier quoted context omitted.

Ridiculous? Not at all. In the context of the history of the CIA and NSA it's standard procedure. And that's just the stuff we know about. Certainly Snowden taught us anything is possible, that they have no restraint. B On the other hand, politely asking an outfit like Equifax for (just about) ALL their data with no real reason would be out of character. Why bother? Why go on record? It's pretty simple. Why would the…

> Snowden Snowden, a man who worked from home in Hawaii as an NSA contractor making over $200k a year with his smoking hot girlfriend, who suddenly decided he had a moral compass, was able to download tons of classified files over VPN to his laptops and run off to meet Greenwald et. al. to divulge all this information, then flee to Russia where he sends out anti-Russian tweets. Meanwhile, nothing has happened. The NS…

What does Snowden's girlfriend have anything to do with... well, anything?

Re: Duck Duck Go: Illusion of Privacy (2013)

#119

Post by justin66 »

asmdev wrote: post #117
alsadi wrote: post #115

To be fair here is ceo response quote Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us…

Here is the link to the CEO's response for those interested: http://etherrag.blogspot.in/2013/07/duck-duck-go-illusion-of...

The amount of unearned confidence the author of the blog displays in his reply is kind of embarrassing. "I read a CNET article once that contradicts what you're saying!"

He created that blog account just to write that article and it's the only one up there. Stuff like this makes me wonder what motivates some people.

Re: Duck Duck Go: Illusion of Privacy (2013)

#120

Post by bsder »

sfRattan wrote: post #8

I think DuckDuckGo is unfairly singled out here. They do more than most companies to protect privacy, and most of their users are specifically trying to deprive Google of more feed for its data silo. Of course they can't protect you from the NSA. Extremely few actors can. If your threat model includes actors within the US Federal Government (especially the intelligence community), run. Yesterday. That's a statement a…

I care about "random idiot at NSA sitting in front of a computer being able to make my life miserable".

I don't care about "NSA has decided to invest $10 million to make me personally miserable." At that point, they will simply fabricate the evidence they need.

If someone at the NSA wants to come after me, I simply want someone to actually have to sign a piece of paper--cut a check, file a warrant, send a human being, etc.--rather than just write a script in Python.

If someone in a bureaucracy has to sign their name and take responsibility, I'm fairly safe. Simply the possibility that something might cause political fallout will stop 99.9% of all such actions.

Post reply on HN