Privacy Pass Authentication for Kagi Search • Hacker News Board

Re: Privacy Pass Authentication for Kagi Search

#131

Post by CGamesPlay » Thu, Feb 13, 2025, 10:29 PM UTC

dsp_person wrote: post #113

autoexec wrote: post #102

Earlier quoted context omitted.

I agree that third party stores selling tokens without any account at all would be the ideal solution, but without an account you'd be missing out on many of the features that make kagi worth using like being able to remove certain domains from results or prioritizing types of results over others.

Add the ability to export your account config (yaml?) and use it with privacy pass. Maybe even sync it with git. To avoid fingerprinting by config, have a page where the community can share and vote on best configs, then clone and use a popular one that suits your needs.

This defeats the purpose of Privacy Pass. Something similar is discussed in the post: https://blog.kagi.com/kagi-privacy-pass#:~:text=customizatio...

Re: Privacy Pass Authentication for Kagi Search

#132

Post by echoangle » Thu, Feb 13, 2025, 10:30 PM UTC

wasabi991011 wrote: post #117

echoangle wrote: post #72

I don’t really understand how the protocol can ensure that the server can’t identify the client. As far as I understand, the client sends some information A to the server, the server applies some private key X and returns the output B to the client, which then generates tokens C from the output. If the server uses a different X for every user and then when verifying just checks the X of every user to see which one is…

In the simplest terms, the token generation process B->C is done with the user's private key. So even if the server knows A,X,B they can't link it to the token C.

But if the server is allowed to vary X, it can basically act like different servers to each client, and can then when given a token check for which server would have been valid. The solution I got from the other replies is to make sure that the server uses the same X for everyone by verifying it as a client.

Re: Privacy Pass Authentication for Kagi Search

#133

Post by freediver » Thu, Feb 13, 2025, 10:31 PM UTC

cyanydeez wrote: post #120

When does the API. become GA. I really want a reason to spend on a valuable search engine.

In about two months!

Re: Privacy Pass Authentication for Kagi Search

#134

Post by freediver » Thu, Feb 13, 2025, 10:32 PM UTC

1propionyl wrote: post #101

In general I am a very happy Kagi subscriber, but I have noticed in the past month or so that sometimes my searches (via the Safari extension) just hang. Navigating it kagi.com also hangs. When I'm in a rush this forces me to fall back to Google which often doesn't provide good results for my queries, which is unfortunate It generally resolves itself in under a minute, but it is still a mildly irritating availability…

We haven't heard about this issue before, do you mind reaching out to support@kagi.com with more details so we can debug?

Re: Privacy Pass Authentication for Kagi Search

#135

Post by mortar » Thu, Feb 13, 2025, 10:32 PM UTC

echoangle wrote: post #91

mortar wrote: post #89

Earlier quoted context omitted.

The method is secure until they change it. Their docs mention that generating a token is not anonymous, but using a token is. Considering they already know who generated it, it could be trivial for them (to change something server side where the validation occurs, if compelled) to link a particular search to a user.

You don’t get the token itself from the server though, you get something so you can make your own token for which the server doesn’t know who created it. So they can do whatever they like on the server, they can’t identify you.

Indeed, thanks for clearing that up!

Re: Privacy Pass Authentication for Kagi Search

#136

Post by amazingamazing » Thu, Feb 13, 2025, 10:35 PM UTC

Bromeo wrote: post #115

amazingamazing wrote: post #104

Do people have news articles of Microsoft, Google et al using search history to the searcher's detriment? How frequently does this happen? I'm imagining it must be like one in a million.

Per-user search history can directly be sold to advertisers, no? I was under the impression Google and Microsoft do that, or at least use it internally to build a profile of each user, again used for advertising.

Which search engine sells results directly?

Re: Privacy Pass Authentication for Kagi Search

#137

Post by aryonoco » Thu, Feb 13, 2025, 10:35 PM UTC

Klaus23 wrote: post #127

drdaeman wrote: post #28

Neat! It's rare to see that a service you use actually does something that benefits the user rather that itself. An unexpected, but a really pleasant surprise. I wish this extension would integrate better with the browser by automatically understanding the context. That is, if I'm in a "regular" mode it'll use my session, but if I'm in a "private browsing" mode (`browser.extension.inIncognitoContext`) it'll use Priva…

The downside of this is that if you are not on a larger network, the IP address will probably deanonymise you. Kagi knows you are logged in, and if you open a private browsing window to do a spicy search, they could link the searches. Fast switching between modes is undesirable.

And that's why Kagi has simultaneously rolled out their service availability on tor: http://kagi2pv5bdcxxqla5itjzje2cgdccuwept5ub6patvmvn3qgmgjd6...

Tor has its flaws and criticisms, but it's really not on Kagi to fix them. With the combination of tor and their privacy pass, Kagi has gone further in allowing their paid users access to their services than anyone else.

Disclaimer: Not associated with Kagi in anyway other than being a very happy user.

Re: Privacy Pass Authentication for Kagi Search

#138

Post by beeflet » Thu, Feb 13, 2025, 10:35 PM UTC

It's a shame that their $5 tier is only 300 searches/month, or 10 searches per day. It's kind of ridiculously low. I could burn through half of that in a single day of debugging

Also I just tried it and you can't really search for porn

Re: Privacy Pass Authentication for Kagi Search

#139

Post by AutistiCoder » Thu, Feb 13, 2025, 10:40 PM UTC

Trying to understand Privacy Pass here.

My understanding is, it's analogous to writing a note to your manager.

That note is a random number written in ink your manager can't actually read; all they can do with that note is sign it. They ask God (used here to represent math itself) how to sign this note, and God gives them a unique signature that also theoretically cannot be used to calculate the number that's written. This signature also proves what you're authorized to do. And then your manager hands the note back to you.

The note's sole function past that point is so you can point to the signature thereon and say "this signature proves I can do this, that, etc."

Re: Privacy Pass Authentication for Kagi Search

#140

Post by api » Thu, Feb 13, 2025, 10:41 PM UTC

sxg wrote: post #98

_fat_santa wrote: post #56

Earlier quoted context omitted.

> It's rare to see that a service you use actually does something that benefits the user rather that itself The reason it's become so rare is most companies in this space (heck tons of tech companies period) have used a business model of offering a thing to one group of users and then turning around and selling the results of that thing to another group of users, where the latter group is the one actually driving you…

The other part to this is that the internet accelerates network-effects, which you can further supercharge by making your product as cheap as possible or free to the former group in your example. It’s hard to make money by charging a lot to a small group of people since now you’re dealing with anti-network effects. Doubling the price of a product will likely more than halve your user base.

This is one of the best explanations I've seen for this phenomenon.

If you try to build a network of paid users, you lose because you'll be run over by 'free' competitors monetizing indirectly.