Privacy Pass Authentication for Kagi Search
blog.kagi.com
Privacy Pass Authentication for Kagi Search
1–10 of 359 posts
Re: Privacy Pass Authentication for Kagi Search
#2The biggest flaw I always saw in Kagi has now been addressed by this. Thank you for listening and working to make the product appealing to (almost) everyone!
Re: Privacy Pass Authentication for Kagi Search
#3That's a cool idea! Seeing the screenshot I almost immediately figured this would be related to Chaum's digital cash and blind signatures, and it seems to be cited in the linked paper. I had thought of using blind signatures for anonymous authorization, but I was not aware that there was an actual design for that application.
I think government issued digital identities should also use this.
Re: Privacy Pass Authentication for Kagi Search
#4What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
Re: Privacy Pass Authentication for Kagi Search
#5What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
Exactly the question I had in mind. You can't rely on server side trust so I'm curious if I just misunderstood something...
Re: Privacy Pass Authentication for Kagi Search
#6What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
I believe "Privacy Pass" uses blind signatures, so the token that the TokenResponse contains can't be correlated to the one provided in the search query, if I understand it correctly.
Re: Privacy Pass Authentication for Kagi Search
#7What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
That's apparently explained in their citation [1], the paper about cryptographically anonymous token protocols. It's not a simple plaintext token.
https://petsymposium.org/popets/2018/popets-2018-0026.php ("Privacy Pass: Bypassing Internet Challenges Anonymously")
I think Cloudflare implemented the same thing? At least the HN comments link to the same paper,
https://news.ycombinator.com/item?id=19623110 ("Privacy Pass (cloudflare.com)", 53 comments)
Re: Privacy Pass Authentication for Kagi Search
#8Will the extension eventually be made available for Firefox on Android? Right now the Firefox extension link says that it's not compatible.
P. S: I don't use the Kagi app in Android.
Re: Privacy Pass Authentication for Kagi Search
#9What's to stop someone on the Kagi side from just adding a new column to the token table that has the user (with their SessionCookie) who generated the token next to it? I don't see how this can't be trivially connected to the original token generator.
The tokens are "generated" on the client, and the server just gives the client enough information to make that locally generated token become "valid", without being able to link that token to a specific validation attempt
Re: Privacy Pass Authentication for Kagi Search
#10The post hints at this, but having a shop where one can buy a privacy pass without an account makes sense.
Should support some crypto currency (probably monero), and something like GNU Taler if that technology ever becomes usable.