Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Pass Authentication for Kagi Search

blog.kagi.com

Post reply on HN
Print view View original

311–320 of 359 posts

Re: Privacy Pass Authentication for Kagi Search

#311

Post by ignoramous »

literallyroy wrote: post #289
SamuelAdams wrote: post #287

Earlier quoted context omitted.

So if they add “credit to raphaelrobert”, or a copy of your license to their code somewhere, Kagi will be compliant? I’ve never had any of my open source software used, and I typically license it with MIT, so I’m curious how other groups and organizations actually comply with the license.

They are compliant, the code being used is under the MIT license.

Kagi isn't MIT compliant if they lifted code and removed the copyright of the original author (as claimed by OP) only to replace it with theirs.

https://github.com/kagisearch/privacypass-lib/blob/83c9be8cb...

Re: Privacy Pass Authentication for Kagi Search

#312

Post by potamic »

readyplayeremma wrote: post #243
Eji1700 wrote: post #230

So....is this privacy through assumed lack of logging? Not trying to be a dick, just legit don't understand a part of this. User A asks kagi for tokens. Kagi says "sure, here's 500 tokens". If kagi then logs the 500 tokens it just gave to user A, it now will know if any of those tokens is redeemed at a later date, that they're assigned to user A? Of course if Kagi just doesn't retain this data, then yeah all is good…

The server does not generate the tokens, the client generates the tokens. The server is supposed to be able to verify that they were generated by a client who was granted the authority to generate them, but not which client did so. At least, not without side-channel information. > The main building block of our construction is a verifiable oblivious pseudorandom function (VOPRF) I am not sure how well tested that pri…

Using a client provided by Kagi can be a side-channel then? Should we rather be using an independent, standard client?

Re: Privacy Pass Authentication for Kagi Search

#313

Post by prophesi »

joshuaturner wrote: post #202
freediver wrote: post #188

Earlier quoted context omitted.

> (I don't use Orion, as there's no GNU/Linux version.) We commenced work on Orion for Linux yesterday.

I remember the announcement for Orion but I haven't followed closely at all - any support for container proxies like in Firefox? Can't lose that feature

If you mean Firefox containers[0], the closest you'll get is Profiles[1] since Orion is based on WebKit. Its location in settings is different from the Safari docs, and that's the only difference in Orion's implementation as far as I can tell. You can't open a tab in a certain profile, instead each profile opens in its own window, which is a lot more cumbersome than Firefox containers.

Arc, another Webkit-based browser, has an interesting implementation combining Profiles and Arc Spaces[2]. Instead of switching between windows, you switch between "Spaces" in the sidebar that are linked to a profile.

[0] https://addons.mozilla.org/firefox/addon/multi-account-conta...

[1] https://support.apple.com/en-us/105100

[2] https://www.youtube.com/watch?v=A5BzkowY_B8

Re: Privacy Pass Authentication for Kagi Search

#314

Post by 1propionyl »

freediver wrote: post #134
1propionyl wrote: post #101

In general I am a very happy Kagi subscriber, but I have noticed in the past month or so that sometimes my searches (via the Safari extension) just hang. Navigating it kagi.com also hangs. When I'm in a rush this forces me to fall back to Google which often doesn't provide good results for my queries, which is unfortunate It generally resolves itself in under a minute, but it is still a mildly irritating availability…

We haven't heard about this issue before, do you mind reaching out to support@kagi.com with more details so we can debug?

Sure, I'll try to catch it in action and send you something useful.

Re: Privacy Pass Authentication for Kagi Search

#316

Post by brookst »

azinman2 wrote: post #310
brookst wrote: post #308

Earlier quoted context omitted.

I knew door holding was weak, but I think the principle holds. To me, it is reasonable to release under MIT with expectation of helping lots of people, and also to expect (not require) some credit if a notable company adopts kit and kaboodle.

Door holding falls under a social contract.

So does saying thanks. That was my point :)

Re: Privacy Pass Authentication for Kagi Search

#317

Post by graypegg »

raphaelrobert wrote: post #279

I love that Kagi now uses Privacy Pass, and they look like a cool company in general. That being said, they essentially took the IETF draft I worked on for a while [1] and also my Rust implementation [2]. They built a thin wrapper [3] around my implementation and now call it "Kagi’s implementation of Privacy Pass". I think giving me some credit would have been in order. IETF work and work on open-source software is m…

Captured 14 Feb 2025 ~12:15pm EST from README header

> This repository contains the source code of the core library implementing the Privacy Pass API used by Kagi.

Yeah... that doesn't feel great. Though I do think the folks at Kagi would be open to more accurately reframing that as "core library implementing a Crystal Lang wrapper for raphaelrobert/privacypass". It's likely unintentional, they were probably just focusing on getting it working and didn't get someone to reread this stuff.

Re: Privacy Pass Authentication for Kagi Search

#318

Post by nicholasjarnold »

Sakos wrote: post #255
cootsnuck wrote: post #223

Earlier quoted context omitted.

I think I can finally buy into the Kagi hype now that I've found a sincere negative opinion.

Kagi has its share of issues. The whole shirt thing was a debacle and I wish they'd just sunk the absurd amount of money back into the product. I just often find the criticism from non-users to be disingenuous.

Just adding a $0.02 here - I placed an order for the free/gifted-with-subscription Kagi shirt and received it about a month later. Worn twice so far. Largest complaint? It shrank quite a bit in the dryer on medium heat.

The search engine works great for me. I will almost certainly renew my subscription when it's time to. Glad to see them continually delivering user-benefiting features.

Re: Privacy Pass Authentication for Kagi Search

#319

Post by grg0 »

abound wrote: post #214
grg0 wrote: post #209

Does this actually work, though? The token can only be redeemed once, which means that, realistically, the client is going to be in a loop generating and redeeming tokens in a given search session, which makes the pairs trivial to correlate. The article even states it: > For this reason, it is highly recommended to separate token generation and redemption in time, or “in space” (by using an anonymizing service such a…

> The token can only be redeemed once, which means that, realistically, the client is going to be in a loop generating and redeeming tokens in a given search session, which makes the pairs trivial to correlate. One token request can produce N tokens. We have it configured where N = 500, so most users will be requesting more tokens fairly infrequently.

Thanks for the clarification.
Post reply on HN