Amazing! I used kagi at the very beginning, but my biggest concern was always this (that logging in is inherently less private than using something like duckduckgo, so I'm just forced to trust Kagi's will). This is the kind of thing that will force me to take a second look again.
Privacy Pass Authentication for Kagi Search
181–190 of 359 posts
Re: Privacy Pass Authentication for Kagi Search
#182I'm not affiliated with the Tor Project organization, but I have some questions. From Tor docs [0]: > Add-ons, extensions, and plugins are components that can be added to web browsers to give them new features. Tor Browser comes with one add-on installed: NoScript. You should not install any additional add-ons on Tor Browser because that can compromise some of its privacy features. How does Kagi square this with Priv…
I sat down on my desktop to take a closer look at how Kagi implemented this. It turns out that the privacy pass extension isn't the one implemented by CloudFlare (and rejected by Tor), but a new extension called Kagi Privacy Pass. Ok, let's look at the source. curl -L https://addons.mozilla.org/firefox/downloads/file/4436183/kagi_privacy_pass-1.0.2.xpi > /tmp/extension.xpi unzip /tmp/extension.xpi -d /tmp/extension c…
[I work at Kagi]
The extension is open-source [1], including the Rust code that produces the WASM [2]. You should be able to produce a bit-compatible binary from these repos, and if not, please file a bug!
Re: Privacy Pass Authentication for Kagi Search
#183This seems cool, but I still think the pricing of kagi is rather steep. It is $5/mo for 300 searches a month, which is really going to get you under 10 a day... That's insufficient. Then $10/mo (or $108/yr) for unlimited. I'm curious if anyone knows, are companies like Google and Microsoft making more than $10/mo/user? We often talk about paying with our data, but it is always unclear how much that data is worth. Kag…
FWIW I signed up about 4 months ago on the starter plan and I'm definitely going to run over. I could be smarter about my searches though. I've switched to kagi on ALL of my devices, including work devices. And I could have searched to using google for most gifts/maps stuff instead. some anecdotal data: 11/2024: 183 searches 12/2024: 360 1/2025: 376 2/2025: already at 222 Will definitely (happily) have to upgrade to…
I subscribed to kagi's $5/m plan since last March, and my usage until now is around 3.3k searches, with the monthly distribution similar to yours. Some months it's more, some months it's fewer.
Currently I'm debating with myself if I should go for the $10 plan. I'm all down for supporting kagi, but surprisingly I didn't use as many searches as I thought.
Re: Privacy Pass Authentication for Kagi Search
#184Earlier quoted context omitted.
I sat down on my desktop to take a closer look at how Kagi implemented this. It turns out that the privacy pass extension isn't the one implemented by CloudFlare (and rejected by Tor), but a new extension called Kagi Privacy Pass. Ok, let's look at the source. curl -L https://addons.mozilla.org/firefox/downloads/file/4436183/kagi_privacy_pass-1.0.2.xpi > /tmp/extension.xpi unzip /tmp/extension.xpi -d /tmp/extension c…
[I work at Kagi] The extension is open-source [1], including the Rust code that produces the WASM [2]. You should be able to produce a bit-compatible binary from these repos, and if not, please file a bug! [1] https://github.com/kagisearch/privacypass-extension [2] https://github.com/kagisearch/privacypass-lib/
Ah, nice, Firefox extension pages don't link to the source code and I missed it. Looking forward to digging into this more. Thanks!
Re: Privacy Pass Authentication for Kagi Search
#185This seems cool, but I still think the pricing of kagi is rather steep. It is $5/mo for 300 searches a month, which is really going to get you under 10 a day... That's insufficient. Then $10/mo (or $108/yr) for unlimited. I'm curious if anyone knows, are companies like Google and Microsoft making more than $10/mo/user? We often talk about paying with our data, but it is always unclear how much that data is worth. Kag…
I assume Kagi's customers (of which I've been one since 5/22) are apt to value retaining their privacy more than Google values selling their data. That is to say, it's worth more than $10 (and more than $23 a month) for me to believe my data isn't being sold to advertisers. If you don't take that position, or set different values on it, I can certainly see why $5 or $10 a month wouldn't be worth it to you.
There's also the matter of Google search quality being increasingly bad, while Kagi's is consistently... okay. They also have a a lot of nice features, liking being able to change the weight of different sites in your list of results.
Re: Privacy Pass Authentication for Kagi Search
#186I don’t really understand how the protocol can ensure that the server can’t identify the client. As far as I understand, the client sends some information A to the server, the server applies some private key X and returns the output B to the client, which then generates tokens C from the output. If the server uses a different X for every user and then when verifying just checks the X of every user to see which one is…
Here's a resource I found that walks through the ideas of the protocol, starting with simple implementations that have a problem, and then solving the problem one by one: https://privacypass.github.io/protocol/ I think that's the best conceptual overview of a crypto protocol I've ever seen.
I really love this style of explanation. There was another one I saw recently (OIDC, I think?) that I wish I'd bookmarked but I forgot to
Re: Privacy Pass Authentication for Kagi Search
#187What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
That's apparently explained in their citation [1], the paper about cryptographically anonymous token protocols. It's not a simple plaintext token. https://petsymposium.org/popets/2018/popets-2018-0026.php ( "Privacy Pass: Bypassing Internet Challenges Anonymously" ) I think Cloudflare implemented the same thing? At least the HN comments link to the same paper, https://news.ycombinator.com/item?id=19623110 ( "Privacy…
Yep, in fact Cloudflare are the original people who came up with this, when people were complaining about seeing turnstile screens too often
Re: Privacy Pass Authentication for Kagi Search
#188Neat! It's rare to see that a service you use actually does something that benefits the user rather that itself. An unexpected, but a really pleasant surprise. I wish this extension would integrate better with the browser by automatically understanding the context. That is, if I'm in a "regular" mode it'll use my session, but if I'm in a "private browsing" mode (`browser.extension.inIncognitoContext`) it'll use Priva…
> (I don't use Orion, as there's no GNU/Linux version.)
We commenced work on Orion for Linux yesterday.
Re: Privacy Pass Authentication for Kagi Search
#189This is really cool. How does the cryptography work?
EDIT: Seems like it works via https://en.wikipedia.org/wiki/Blind_signature
Re: Privacy Pass Authentication for Kagi Search
#190Earlier quoted context omitted.
This defeats the purpose of Privacy Pass. Something similar is discussed in the post: https://blog.kagi.com/kagi-privacy-pass#:~:text=customizatio...
Their suggestion is that when using Privacy Pass you'd also send "&config=XX" where XX is an ID of a publicly shared config, so that you get the customisation of whatever config you choose without tying the config to yourself, just tying it to the searches you're doing with Privacy Pass. So while it does add a data point that could help track you, it's not defeating the whole point.
Though the post doesn't touch on "community configs", it does touch on "the ten most popular configs", which would seem to be similar enough for this discussion.