Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Pass Authentication for Kagi Search

blog.kagi.com

Post reply on HN
Print view View original

111–120 of 359 posts

Re: Privacy Pass Authentication for Kagi Search

#111

Post by dan353hehe »

jerf wrote: post #90
echoangle wrote: post #72

I don’t really understand how the protocol can ensure that the server can’t identify the client. As far as I understand, the client sends some information A to the server, the server applies some private key X and returns the output B to the client, which then generates tokens C from the output. If the server uses a different X for every user and then when verifying just checks the X of every user to see which one is…

Here's a resource I found that walks through the ideas of the protocol, starting with simple implementations that have a problem, and then solving the problem one by one: https://privacypass.github.io/protocol/ I think that's the best conceptual overview of a crypto protocol I've ever seen.

That is an excellent explanation of how the protocol works. Thank you for bringing it to the discussion!

Re: Privacy Pass Authentication for Kagi Search

#112

Post by echoangle »

abound wrote: post #107
echoangle wrote: post #103

Earlier quoted context omitted.

But how do I validate that I’m actually getting the same value as everyone else? Is the value I should get published somewhere (in a verifiable and not editable way) so I can see that I’m not being tracked? Or does the extension validate this and the correct value is hardcoded in the extension like stebalien suggested?

There's no auth required at this stage of the handshake, so you can test from any number of devices/locations/networks/etc and confirm you get the same value. We could publish it, but it will change every epoch/month. Plus, if you don't trust the service to not issue special key pairs to track you, you probably won't trust us to not do the same when publishing the key material. There are schemes involving third-parti…

Makes sense in general, but to make sure I understand it:

> Plus, if you don't trust the service to not issue special key pairs to track you, you probably won't trust us to not do the same publishing the key material.

You could publish it on some sort of blockchain to make sure it can’t be changed and is public for everyone, right?

> A malicious server could maintain separate key pairs for users it wanted to track, but you can't do it for every user because 1) it'd be clear from the WWW-Authenticate header changing, and 2) you'd have to validate tokens against every key, which would quickly get too slow to work.

Makes sense, thanks for explaining!

Re: Privacy Pass Authentication for Kagi Search

#113

Post by dsp_person »

autoexec wrote: post #102
mhitza wrote: post #10

The post hints at this, but having a shop where one can buy a privacy pass without an account makes sense. Should support some crypto currency (probably monero), and something like GNU Taler if that technology ever becomes usable.

I agree that third party stores selling tokens without any account at all would be the ideal solution, but without an account you'd be missing out on many of the features that make kagi worth using like being able to remove certain domains from results or prioritizing types of results over others.

Add the ability to export your account config (yaml?) and use it with privacy pass. Maybe even sync it with git.

To avoid fingerprinting by config, have a page where the community can share and vote on best configs, then clone and use a popular one that suits your needs.

Re: Privacy Pass Authentication for Kagi Search

#114

Post by RupertWiser »

Ajedi32 wrote: post #106

Is this the same Privacy Pass that Cloudflare was using to allow clients to bypass CAPTCHAs? If so, this is a really neat application of that system; it never occurred to me that it could be used to anonymously authenticate to a paid service.

The cryptography privacy pass is based off [1] actually comes from Ecash[2] so we’ve gone full circle.

[1] https://www.petsymposium.org/2018/files/papers/issue3/popets... [2] https://en.m.wikipedia.org/wiki/Ecash

Re: Privacy Pass Authentication for Kagi Search

#115

Post by Bromeo »

amazingamazing wrote: post #104

Do people have news articles of Microsoft, Google et al using search history to the searcher's detriment? How frequently does this happen? I'm imagining it must be like one in a million.

Per-user search history can directly be sold to advertisers, no? I was under the impression Google and Microsoft do that, or at least use it internally to build a profile of each user, again used for advertising.

Re: Privacy Pass Authentication for Kagi Search

#116

Post by theschmed »

drdaeman wrote: post #28

Neat! It's rare to see that a service you use actually does something that benefits the user rather that itself. An unexpected, but a really pleasant surprise. I wish this extension would integrate better with the browser by automatically understanding the context. That is, if I'm in a "regular" mode it'll use my session, but if I'm in a "private browsing" mode (`browser.extension.inIncognitoContext`) it'll use Priva…

FYI in case you’re not aware, they announced in a podcast near the end of 2024 that a Linux version of Orion is planned.

Re: Privacy Pass Authentication for Kagi Search

#117

Post by wasabi991011 »

echoangle wrote: post #72

I don’t really understand how the protocol can ensure that the server can’t identify the client. As far as I understand, the client sends some information A to the server, the server applies some private key X and returns the output B to the client, which then generates tokens C from the output. If the server uses a different X for every user and then when verifying just checks the X of every user to see which one is…

In the simplest terms, the token generation process B->C is done with the user's private key. So even if the server knows A,X,B they can't link it to the token C.

Re: Privacy Pass Authentication for Kagi Search

#118

Post by sedatk »

mortar wrote: post #65

I’m not insinuating for even a second that Kagi actually do this, but as a general rule, isn’t any privacy claim dubious at the moment given that more and more governments appear to be able to compel companies to identify their users (especially those searching for illegal content) and further forcefully insist they not disclose it? It’s disheartening to think the great progress we’re making in this sector could be u…

Government's power over companies does not negate cryptographic privacy protections. For example, one criminal who used ProtonMail got caught because ProtonMail handed over their recovery GMail address to the law enforcement after they were compelled[1]. However, that means end-to-end encryption worked: that was the only thing they could hand over. I think the same principle applies here.

[1] https://www.techradar.com/computing/cyber-security/proton-ma...

Re: Privacy Pass Authentication for Kagi Search

#119

Post by perdomon »

Can someone make a case for Kagi? I'm using Google + Claude for all my websearch needs. I don't feel like there's a gap there, but maybe that's because I've never experienced anything better and can't imagine it?

I do value privacy, but I wouldn't pay extra for more private search results. I might pay extra for __better__ search results, but that's hard to measure.

Just curious if anyone has had a legitimately great experience with this product and can communicate its benefits. Bonus points if you're in software dev.

Post reply on HN