241–250 of 359 posts
I want to pay for Kagi, but it's priced way too high (for me). Would love it if they implemented Purchasing Power Parity (PPP).
Starting at $5 a month seems very reasonable to me for a non-essential premium search experience.
Neat! It's rare to see that a service you use actually does something that benefits the user rather that itself. An unexpected, but a really pleasant surprise. I wish this extension would integrate better with the browser by automatically understanding the context. That is, if I'm in a "regular" mode it'll use my session, but if I'm in a "private browsing" mode (`browser.extension.inIncognitoContext`) it'll use Priva…
> It's rare to see that a service you use actually does something that benefits the user rather that itself The reason it's become so rare is most companies in this space (heck tons of tech companies period) have used a business model of offering a thing to one group of users and then turning around and selling the results of that thing to another group of users, where the latter group is the one actually driving you…
The main driver of hostility to users is due to ad-based business models. I think we would see a much more healthy internet if we had regulation which prohibited companies from choosing ads based on any information associated with the user that the ad is shown to. That is, any data collected in the past and any data associated with the session and request must not be taken into account when choosing the ad; two requests by different users in different locations should have the exact same ad probability distributions.
I know we are never getting this because it would kill or severely harm the business models of some of the most profitable businesses in the world.
So....is this privacy through assumed lack of logging? Not trying to be a dick, just legit don't understand a part of this. User A asks kagi for tokens. Kagi says "sure, here's 500 tokens". If kagi then logs the 500 tokens it just gave to user A, it now will know if any of those tokens is redeemed at a later date, that they're assigned to user A? Of course if Kagi just doesn't retain this data, then yeah all is good…
> The main building block of our construction is a verifiable oblivious pseudorandom function (VOPRF)
I am not sure how well tested that primitive is, but it definitely appears to be more than the server handing clients tokens and then pretending not to know who it gave them to.
The referenced paper: https://petsymposium.org/popets/2018/popets-2018-0026.pdf
Earlier quoted context omitted.
This is one of the best explanations I've seen for this phenomenon. If you try to build a network of paid users, you lose because you'll be run over by 'free' competitors monetizing indirectly.
Playing devil's advocate... Yeah, the ad supported model has its problems, but it also makes the internet way more accessible. If we think about it, companies and people with more money are basically subsidizing these services for everyone else. They're the ones seeing the ads that keeps the lights on for users who can't afford to pay. If everything was subscription only, a ton of people like students, low income fam…
Seeing as I'm not getting any traction in the fediverse ( https://tenforward.social/@aspensmonster/113999217587309328 ), maybe I can ask here instead. ================================= From their blog: >As standardized in [2 - 4], the Privacy Pass protocol is able to accommodate many “architectures.” Our deployment model follows the original architecture presented by Davidson et al. [1], called “Shared Origin, Attest…
In the RFC's architecture, the request flow is like so:
1. CLIENT sends anonymous request to ORIGIN
2. ORIGIN sends token challenge to CLIENT
3. CLIENT uses its identity to request token from ISSUER/ATTESTER
4. ISSUER/ATTESTER issues token to CLIENT
5. CLIENT sends token to ORIGIN
You can see how the ISSUER/ATTESTER can identify the client as the source of the "anonymous request" to the ORIGIN because the ISSUER, ATTESTER and ORIGIN are the same entity, so it can use a timing attack to correlate the request to the ORIGIN (1.) with the request to the ISSUER/ATTESTER (3.).
However you can also see that if a lot of time passes between steps (1.) and (3.), then such an attack would be infeasible. Reading past your quote from RFC 9576 § 4.1., it states:
> Origin-Client, Issuer-Client, and Attester-Origin unlinkability requires that issuance and redemption events be separated over time, such as through the use of tokens that correspond to token challenges with an empty redemption context (see Section 3.4), or that they be separated over space, such as through the use of an anonymizing service when connecting to the Origin.
In Kagi's architecture, the "time separation" requirement is met by making the client generate a large batch of tokens up front, which are then slowly redeemed over a period of 2 months. The "space separation" requirement is also satisfied with the introduction of the Tor service.
There is some more discussion in RFC 9576 § 7.1. "Token Caching" and RFC 9577 § 5.5. "Timing Correlation Attacks".
One question you may have is: Why wasn't this solution used in the RFC?
This can be understood if you look at the mentions of "cross-ORIGIN" in the RFC. This RFC was written by Cloudflare, who envisioned it's use across the whole Internet. Different ORIGINs would trust different ISSUERs, tokens from one ORIGINISSUER network might not work in another ORIGINISSUER network. This made it infeasible for clients to mass-generate tokens in advance, as a client would need to generate tokens across many different ISSUERS.
Of course, adoption was weak and there ended up being only one ISSUER - Cloudflare, so they adopted the same architecture as Kagi where clients would batch generate tokens in advance (batch size was only 30 tokens though).
RFC 9576 § 7.1. also mentions a "token hoarding" attack, which Cloudflare felt particularly threatened by. Cloudflare's Privacy Pass system worked in concert with CAPTCHAs. Users could trade a completed CAPTCHA for a small batch of tokens, allowing a single CAPTCHA completion to be split into multiple redemptions across a longer time period.
However, rudimentary "hoarding"-like attacks were already in use against CAPTCHAs through "traffic exchanges". Opening up another avenue for hoarding through Privacy Pass would have only exacerbated the problem.
Earlier quoted context omitted.
Companies are not bound by law to extract as much as possible as soon as possible.
Correct. Wall Street will punish them for violating this principle, not the government.
I'm a firm believer of this but we need more people to join in.
And it already works to some degree.
I've now had a working search engine for almost 3 years.
My last 3 jobs (9 years) haven't forced me to use Windows.
I can chat and organize events without Facebook knowing.
And it is not like the quality has gone down either. My choices have mostly given me better experiences in a number of ways.
Edit:
If more people start
- advocating for better hardware and software,
- canceling subscriptions and memberships when it becomes clear they are reducing value or increasing price,
- building skills both to get independent from their current cloud (so you can move around or at least having a credibile possibility to do so)
- and for individuals to get better jobs
then I think things will change.
For inspiration: at least here in Norway, with several gym memberships, if you cancel they will quickly approach you with good offers, and they can get really good: I got several months free, a friend got offered free months and a sizable gift card.
Bonus: if more people join in this will get picked up by Wall Street and they will begin punishing this nonsense too ;-)
I want to pay for Kagi, but it's priced way too high (for me). Would love it if they implemented Purchasing Power Parity (PPP).
Earlier quoted context omitted.
What's the mechanism by which a private company does e.g. income verification to figure out who gets subsidy or not? Or would the idea be to only subsidize students and not poor adults? It would be one thing if we had like a national "verify I'm on SNAP or equivalent API"
Think of Discord. Anyone can create and participate in a discord server. There are no ads. People with money pay for the premium features and perks and that is how the company makes money [1]. Not every product category is amenable to such business models but many are. [1] To be fair, Discord likely sells user data to advertisers to make additional money.
Earlier quoted context omitted.
(vlad here) Rather, we are opportunistic about it and we want to focus on things that make impact (which most of the time is search, not billing). If there is enough demand, we will work on Monero support - and yes I agree, buying privacy pass tokens, without even needing an account, is one of those super-cool use cases.
I know I’m just one guy, but lack of Monero support kept me away. This feature looks like it narrows the gap a bit though. Nice work
Are the conversion fees too high?