Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Pass Authentication for Kagi Search

blog.kagi.com

Post reply on HN
Print view View original

261–270 of 359 posts

Re: Privacy Pass Authentication for Kagi Search

#261

Post by dave1010uk »

readyplayeremma wrote: post #243
Eji1700 wrote: post #230

So....is this privacy through assumed lack of logging? Not trying to be a dick, just legit don't understand a part of this. User A asks kagi for tokens. Kagi says "sure, here's 500 tokens". If kagi then logs the 500 tokens it just gave to user A, it now will know if any of those tokens is redeemed at a later date, that they're assigned to user A? Of course if Kagi just doesn't retain this data, then yeah all is good…

The server does not generate the tokens, the client generates the tokens. The server is supposed to be able to verify that they were generated by a client who was granted the authority to generate them, but not which client did so. At least, not without side-channel information. > The main building block of our construction is a verifiable oblivious pseudorandom function (VOPRF) I am not sure how well tested that pri…

This is my understanding of how it works, without knowing the actual maths behind the functions:

    # client
    r = random_blinding_factor()
    x = client_secret_input()
    x_blinded = blind(x, r)

    # Server
    y_blinded = OPRF(k, x_blinded)

    # Client
    y = unblind(y_blinded, r)
So you end up with y = OPRF(k, x). But the server never saw x and the client never saw k.

This feels like the same kind of unintuitive cryptography as homomorphic encryption.

Re: Privacy Pass Authentication for Kagi Search

#262

Post by [deleted] »

Eji1700 wrote: post #230

So....is this privacy through assumed lack of logging? Not trying to be a dick, just legit don't understand a part of this. User A asks kagi for tokens. Kagi says "sure, here's 500 tokens". If kagi then logs the 500 tokens it just gave to user A, it now will know if any of those tokens is redeemed at a later date, that they're assigned to user A? Of course if Kagi just doesn't retain this data, then yeah all is good…

[deleted]

Re: Privacy Pass Authentication for Kagi Search

#263

Post by growse »

dreamcompiler wrote: post #218
kennyloginz wrote: post #212

Earlier quoted context omitted.

Companies are not bound by law to extract as much as possible as soon as possible.

Correct. Wall Street will punish them for violating this principle, not the government.

Private companies' interest in what Wall Street thinks is generally not very large.

Re: Privacy Pass Authentication for Kagi Search

#266

Post by Mashimo »

hedora wrote: post #219
cmehdy wrote: post #129

Earlier quoted context omitted.

Auto filter for sources, downrank sources you dislike, sort results by recency, have an engine that actually respects what country or language you're trying to search into, and finally present results visually the way you want them. It's worth trying to use it actively for a month or so, and you'll see if you need it or not. I would not to back to google even if Google paid me.

I recently ran a search on Google. There were zero results on the first page. It was 100% ads. (15” MacBook). I tried a different search on iPhone to be sure. The first result was on the 3rd screen. When did they start doing that? How do people use that crap?

> 15” MacBook

I just tried it on Duck Duck Go and the first result was from Apple.com

On google I get 3 rows of "Products" but the first real result is also apple.com

Re: Privacy Pass Authentication for Kagi Search

#267

Post by jeroenhd »

Ajedi32 wrote: post #106

Is this the same Privacy Pass that Cloudflare was using to allow clients to bypass CAPTCHAs? If so, this is a really neat application of that system; it never occurred to me that it could be used to anonymously authenticate to a paid service.

Yes, though Cloudflare has ended their privacy pass trial as far as I know.

I remember Safari as the only browser that implemented it natively, but I guess Orion has it now too.

Re: Privacy Pass Authentication for Kagi Search

#268

Post by TingPing »

nvarsj wrote: post #254

I still cannot get iOS to reliably use Kagi as my default search engine. I've tried the extension, etc. but nothing works reliably. It's madness - how is it market fairness when iOS literally forces you to use Google? I know Google is paying Apple to do exactly that, but it's so beyond anti-consumer I can't believe it.

Anecdotally I’ve had zero issues with the Safari extension.

Re: Privacy Pass Authentication for Kagi Search

#269

Post by jorams »

aspensmonster wrote: post #203

Seeing as I'm not getting any traction in the fediverse ( https://tenforward.social/@aspensmonster/113999217587309328 ), maybe I can ask here instead. ================================= From their blog: >As standardized in [2 - 4], the Privacy Pass protocol is able to accommodate many “architectures.” Our deployment model follows the original architecture presented by Davidson et al. [1], called “Shared Origin, Attest…

From [2] RFC 9576 § 4.1 "Shared Origin, Attester, Issuer", right before the sentence you quoted:

> In this model, the Attester, Issuer, and Origin share the attestation, issuance, and redemption contexts.

I haven't read the RFC in detail, but I believe this is where the nuance is: When you enable the privacy pass setting in the extension/browser the redemption context is changed relative to the attestation context by removing the session cookie, to just the information sent by the browser for someone who is not logged in. What remains is your IP address and browser fingerprinting, which can be countered by using Tor.

Post reply on HN