Live data from Hacker News

Privacy Pass Authentication for Kagi Search

blog.kagi.com

211–220 of 359 posts

Re: Privacy Pass Authentication for Kagi Search

#211
post #140

Earlier quoted context omitted.

This is one of the best explanations I've seen for this phenomenon. If you try to build a network of paid users, you lose because you'll be run over by 'free' competitors monetizing indirectly.

Disagree. You don’t lose, you’re just smaller, better, and still very profitable. HBO used this model way back when. It’s been a lasting business.

But then you can’t blitzscale and exit after a few years as a centimillionaire!

Re: Privacy Pass Authentication for Kagi Search

#212
post #163

Earlier quoted context omitted.

Playing devil's advocate... Yeah, the ad supported model has its problems, but it also makes the internet way more accessible. If we think about it, companies and people with more money are basically subsidizing these services for everyone else. They're the ones seeing the ads that keeps the lights on for users who can't afford to pay. If everything was subscription only, a ton of people like students, low income fam…

Playing the... angel's advocate... There's no reason why a subscription model could not also be used to subsidize people who can not pay, other than that companies are structured to extract as much as possible (by law, if they are public). There are good network effect arguments about why this strategy can be effective, not simply 'altruistic.' Ads simply make the extraction happen across the board, except that the a…

Companies are not bound by law to extract as much as possible as soon as possible.

Re: Privacy Pass Authentication for Kagi Search

#213
post #107

Earlier quoted context omitted.

But how do I validate that I’m actually getting the same value as everyone else? Is the value I should get published somewhere (in a verifiable and not editable way) so I can see that I’m not being tracked? Or does the extension validate this and the correct value is hardcoded in the extension like stebalien suggested?

There's no auth required at this stage of the handshake, so you can test from any number of devices/locations/networks/etc and confirm you get the same value. We could publish it, but it will change every epoch/month. Plus, if you don't trust the service to not issue special key pairs to track you, you probably won't trust us to not do the same when publishing the key material. There are schemes involving third-parti…

Could you jam the bits into dummy ssl cert signing requests, then stick the result in the certificate transparency log?

Re: Privacy Pass Authentication for Kagi Search

#214
post #209

Does this actually work, though? The token can only be redeemed once, which means that, realistically, the client is going to be in a loop generating and redeeming tokens in a given search session, which makes the pairs trivial to correlate. The article even states it: > For this reason, it is highly recommended to separate token generation and redemption in time, or “in space” (by using an anonymizing service such a…

> The token can only be redeemed once, which means that, realistically, the client is going to be in a loop generating and redeeming tokens in a given search session, which makes the pairs trivial to correlate.

One token request can produce N tokens. We have it configured where N = 500, so most users will be requesting more tokens fairly infrequently.

Re: Privacy Pass Authentication for Kagi Search

#215
post #16

Pretty cool feature. The unstated downside is that any personalization settings like dark mode, translation, and lens settings are still seemingly tied to account login.

Couldn't those be passed as query parameters? Though those still get passed to the server, and your combination of personalization settings is likely to be globally unique, and it's almost certainly unique among the subset of users that are paranoid enough about their privacy not to store preferences in their session... But still.

If you did that, it would partially to nearly fully de-anonymize the searcher though (assuming your parameters are unique or near-unique).

Re: Privacy Pass Authentication for Kagi Search

#216
post #191

One of the biggest complaints about Kagi from people who have not yet adopted it is their privacy concerns around having to login and have payment information. I'm not one of the people that has been concerned about that, but I'm curious to what extent this alleviates those concerns among those that have had them.

> I'm not one of the people that has been concerned about that, but I'm curious to what extent this alleviates those concerns among those that have had them. I am, it's mind-blowing to me that anyone would login to a search engine (yes, I know how many do it, now). After a brief verification of the system, I'm pretty sure I'll sign up, now

Logging in to a search engine weirded me out at first, but after about a week I was so pleased with the results that I’ve been happily paying for almost a year now.

I honestly feel like any major free search engine is probably doing more to try to track you anyway.

And if you’re going to search something you want to be anonymous, you can just like use another search engine. I honestly haven’t run into the situation where I needed to.

I do worry that some day someone will be able to see how often I forget basic syntax for some JavaScript or Python method - or how often I can’t be bothered to type out a full domain and just search to navigate to it - but that’s a price I’m also willing to pay.

Re: Privacy Pass Authentication for Kagi Search

#217
post #201
post #19

Earlier quoted context omitted.

Implementor here. During the Privacy Pass "issuance" protocol, the client will generate a "message" that the server will process. The output from the server is returned to the client, that further modifies this output to produce the final tokens. The last client modification randomises these tokens in such a way that the server will be unable to identify to what issuance they belong. The very cool thing is that this…

If you can get Kagi to agree to it, definitely write a blog post on their behalf, please.

FWIW, the person you're replying to did write most of the blog post. We work together at Kagi on Privacy Pass.

Re: Privacy Pass Authentication for Kagi Search

#218
post #163

Earlier quoted context omitted.

Playing the... angel's advocate... There's no reason why a subscription model could not also be used to subsidize people who can not pay, other than that companies are structured to extract as much as possible (by law, if they are public). There are good network effect arguments about why this strategy can be effective, not simply 'altruistic.' Ads simply make the extraction happen across the board, except that the a…

Companies are not bound by law to extract as much as possible as soon as possible.

Correct. Wall Street will punish them for violating this principle, not the government.

Re: Privacy Pass Authentication for Kagi Search

#219
post #129

Can someone make a case for Kagi? I'm using Google + Claude for all my websearch needs. I don't feel like there's a gap there, but maybe that's because I've never experienced anything better and can't imagine it? I do value privacy, but I wouldn't pay extra for more private search results. I might pay extra for __better__ search results, but that's hard to measure. Just curious if anyone has had a legitimately great…

Auto filter for sources, downrank sources you dislike, sort results by recency, have an engine that actually respects what country or language you're trying to search into, and finally present results visually the way you want them. It's worth trying to use it actively for a month or so, and you'll see if you need it or not. I would not to back to google even if Google paid me.

I recently ran a search on Google. There were zero results on the first page. It was 100% ads. (15” MacBook).

I tried a different search on iPhone to be sure. The first result was on the 3rd screen.

When did they start doing that? How do people use that crap?

Re: Privacy Pass Authentication for Kagi Search

#220
post #209

Does this actually work, though? The token can only be redeemed once, which means that, realistically, the client is going to be in a loop generating and redeeming tokens in a given search session, which makes the pairs trivial to correlate. The article even states it: > For this reason, it is highly recommended to separate token generation and redemption in time, or “in space” (by using an anonymizing service such a…

[deleted]
Post reply on HN