Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PRISM fears give private search engine DuckDuckGo its best week ever

venturebeat.com

Post reply on HN
Print view View original

201–210 of 213 posts

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#201

Post by SilasX »

bigiain wrote: post #175
SilasX wrote: post #160

Earlier quoted context omitted.

Hm, should be easy enough to have some browser plugin that lets you select a text/data field and recipient list field and encrypt it with the appropriate key; and to do something similar for recognition and decryption of fields. If I implement this, will I become famous?

If you get it right you will. I think there are complications though - you need to be very sure that rogue javascript can't dig around in your plugin and extract my private key. I'm not sure how securely sandboxed plugins can be.

What's the normal procedure for making a call whose output depends on a file that must be kept secret? Is there a typical OS API pattern that's seen in the various programs like ssh, scp, and so on?

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#202

Post by brymaster »

isaacb wrote: post #159
boomzilla wrote: post #97

Earlier quoted context omitted.

This is most likely that Google has more user behavior data than DDG. If enough people use DDG and click on the StackExchange link for that query (or similar queries), DDG will be able to get that to the top. On the other hand, did DDG just use Bing API, and only Blekko crawls the web? Or do I get my search engines mixed up?

DDG actually uses a handful of search engines (including Bing), though I think that Yahoo! is the primary source.

Yahoo search results are already 'powered by' Bing.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#203

Post by bigiain »

SilasX wrote: post #201
bigiain wrote: post #175

Earlier quoted context omitted.

If you get it right you will. I think there are complications though - you need to be very sure that rogue javascript can't dig around in your plugin and extract my private key. I'm not sure how securely sandboxed plugins can be.

What's the normal procedure for making a call whose output depends on a file that must be kept secret? Is there a typical OS API pattern that's seen in the various programs like ssh, scp, and so on?

I think the one of the problems is that software like GPG and OpenSSL go to a lot of trouble to make sure private keys don't hang around in memory for any longer than absolutely required - minimising the risk of having the OS preempt the executing code and write the key out to swap (or having malicious code slurp it up out of ram). The bare-metal hoop-jumping required to get that right might not be possible in the context of a browser plugin.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#204

Post by meowface »

mtrimpe wrote: post #187
soitgoes wrote: post #179

Earlier quoted context omitted.

Having the root CA's private key doesn't give them access to the end entity's private keys. When you ask a CA for a cert, you only provide them with your public key (in the form of a CSR) for them to sign. The CSR does not contain the private key.

But getting an employee to hand over the private key and giving him a gag order afterwards is an option of course.

True, but they would have to do this for every single web server they would want to collect information from. Not impossible, but it'd be a lot of work.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#205

Post by meowface »

swombat wrote: post #45
oinksoft wrote: post #13

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

I've done the same. Also switched to Firefox with full Adblock and tracking bugs blocking. It's not much, but at least I'm no longer leaving a huge slimy trail behind me online.

You still very well may be leaving a trail behind; it's just likely that such a trail won't be correlated among multiple different domains you visit (from ad tracking bugs of a single company embedded into multiple websites you browse).

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#206

Post by meowface »

lurkinggrue wrote: post #66
riquito wrote: post #50

Earlier quoted context omitted.

It's a fair question, I'm ashamed by the snarky answers. If Google can't oppose the NSA in installing backdoors (by the way, this has to be demonstrated), DuckDuckGo can't oppose them neither. Best luck to the team of DuckDuckGo, it's a nice project.

They probably didn't install back doors and are just pulling in the data from the internet backbone. Tapping off the fiber.

Duckduckgo redirects all requests to HTTPS and uses only HTTPS; it is highly unlikely the NSA or anyone would be able to decrypt that traffic, unless of course they force DDG to divulge their SSL private key. Which I suppose is plausible.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#207

Post by erhardm »

icebraining wrote: post #189
Sami_Lehtinen wrote: post #176

Earlier quoted context omitted.

This is why I tell people that actual fingerprint check is much better than any CA.

Yes, but how do you get the fingerprint to check against?

I assume he also implies that fingerprints aren't any safer

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#209

Post by jlgaddis »

icebraining wrote: post #189
Sami_Lehtinen wrote: post #176

Earlier quoted context omitted.

This is why I tell people that actual fingerprint check is much better than any CA.

Yes, but how do you get the fingerprint to check against?

The EFF's "HTTPS Everywhere" extension is a great place to start.

    https://www.eff.org/https-everywhere

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#210

Post by pilsetnieks »

mtrimpe wrote: post #187
soitgoes wrote: post #179

Earlier quoted context omitted.

Having the root CA's private key doesn't give them access to the end entity's private keys. When you ask a CA for a cert, you only provide them with your public key (in the form of a CSR) for them to sign. The CSR does not contain the private key.

But getting an employee to hand over the private key and giving him a gag order afterwards is an option of course.

https://en.wikipedia.org/wiki/Perfect_forward_secrecy

https://en.wikipedia.org/wiki/ECDHE

Google is using it, a few other sites, too, though they are in the minority. OpenSSL supports it since version 1.0.0 that was released in March 2010.

Post reply on HN