3 ms·

You lost my interest when I saw an ad manager in your HTML source: adannonce.com. I'll stick with DuckDuckGo thanks. You can't be privacy focused when you're al

You lost my interest when I saw an ad manager in your HTML source: adannonce.com. I'll stick with DuckDuckGo thanks. You can't be privacy focused when you're already giving away data to a 3rd party. I see a "Clear my activity" link, why would it keep my activity at all? https://hulbee.com/Utils/ClearSettings?returnUrl=%2F%3Fquery%3Dnsa%26region%3Dbrowser%26uiLanguage%3Dbrowser https://hulbee.com/Utils/ClearSettings?returnUrl=%2F%3Fquery... Surly you could have afforded a better certificate than a C+ graded GoDaddy one? Sure, its 2048 bit SSL, but that is quite the SSL chain for being privacy focused. https://www.ssllabs.com/ssltest/analyze.html?d=hulbee.com https://www.ssllabs.com/ssltest/analyze.html?d=hulbee.com -vs- https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.co... Offering advertising on a privacy focused search engine? Could work, but when you're marketing to privacy focused individuals, you've just lost them. In the end, I'm from Canada, my connection routes through New York (like most North American connections). My privacy is still being abused by greater forces whom likely have at least one of the private keys for one of the many certificates that make up that GoDaddy certificate, so I'll likely just stick with Google, or perhaps even DuckDuckGo.

Hermel 11y ago
> You lost my interest when I saw an ad manager in your HTML source: adannonce.com Are you aware that adannonce.com belongs to Hulbee? Loading ads from adannonce.com should not bother you more than loading ads from hulbee.com . And the fact that it contains ads is no secret. Please do your research before crying wolf in future.
- captaincrunch 11y ago
  Thanks for the info, care to dive into my other concerns?
  - Hermel 11y ago
    While an SSL certificate from GoDaddy is not ideal, attacks are still detectable in theory by verifying the public key of Hulbee independently of the chain of trust. What I personally would be more concerned about is the fact that DuckDuckGo is hosted by Amazon. As an US company, Amazon is required to collaborate with US three letter agencies by law. Thus, whatever is hosted by Amazon is within reach of the NSA. In contrast, Hulbee is hosted in Switzerland on servers which are under physical control of Hulbee.
    - captaincrunch 11y ago
      Doesn't really matter where its hosted when most North American connections go through New York when we're talking about the NSA... does it. This should make you feel a lot better about the site... ignore the perl stuff, it was just part of my test. https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.knowtechie.netdna-cdn.com%2Fwp-content%2Fuploads%2F2014%2F12%2Fhacker1.jpg%3E%22%3B'%20%3E%20out&region=en-CA&uiLanguage=browser https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S...
      - Hermel 11y ago
        > Doesn't really matter where its hosted when most North American connections go through New York Actually, it does matter. Https is end-to-end encryption. An eavesdropper in New York would have to crack SSL in order to see anything meaningful beyond the fact that you exchanged some data with hulbee.com .
        captaincrunch 11y ago
        I would bet that the NSA has access to most root certificates... specially when they've had access to hard drive firmware for the last few years... http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/
        astrange 11y ago
        If you used a CA certificate to sign a new SSL cert for any popular domain, it'd be detected by certificate fingerprinting and you'd burn the CA. Not worth it over public networks.
nadams 11y ago
> Surly you could have afforded a better certificate than a C+ graded GoDaddy one It really doesn't matter what the CA cert is (I mean the CA infrastructure itself is kind of weak coughdiginotarcough) - what should matter more is configuring the server and the key size of the certificate. I should note it's not hard to get an A+ on the test - I run a small source code hosting service and I have an A+ result from ssllabs. gitlab has an A-/A and github has an A/A+ (yes - they are 2 different scores based on different servers.

Hermel 11y ago

> You lost my interest when I saw an ad manager in your HTML source: adannonce.com Are you aware that adannonce.com belongs to Hulbee? Loading ads from adannonce.com should not bother you more than loading ads from hulbee.com . And the fact that it contains ads is no secret. Please do your research before crying wolf in future.

captaincrunch 11y ago
Thanks for the info, care to dive into my other concerns?
- Hermel 11y ago
  While an SSL certificate from GoDaddy is not ideal, attacks are still detectable in theory by verifying the public key of Hulbee independently of the chain of trust. What I personally would be more concerned about is the fact that DuckDuckGo is hosted by Amazon. As an US company, Amazon is required to collaborate with US three letter agencies by law. Thus, whatever is hosted by Amazon is within reach of the NSA. In contrast, Hulbee is hosted in Switzerland on servers which are under physical control of Hulbee.
  - captaincrunch 11y ago
    Doesn't really matter where its hosted when most North American connections go through New York when we're talking about the NSA... does it. This should make you feel a lot better about the site... ignore the perl stuff, it was just part of my test. https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.knowtechie.netdna-cdn.com%2Fwp-content%2Fuploads%2F2014%2F12%2Fhacker1.jpg%3E%22%3B'%20%3E%20out&region=en-CA&uiLanguage=browser https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S...
    - Hermel 11y ago
      > Doesn't really matter where its hosted when most North American connections go through New York Actually, it does matter. Https is end-to-end encryption. An eavesdropper in New York would have to crack SSL in order to see anything meaningful beyond the fact that you exchanged some data with hulbee.com .
      - captaincrunch 11y ago
        I would bet that the NSA has access to most root certificates... specially when they've had access to hard drive firmware for the last few years... http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/
        astrange 11y ago
        If you used a CA certificate to sign a new SSL cert for any popular domain, it'd be detected by certificate fingerprinting and you'd burn the CA. Not worth it over public networks.

nadams 11y ago

> Surly you could have afforded a better certificate than a C+ graded GoDaddy one It really doesn't matter what the CA cert is (I mean the CA infrastructure itself is kind of weak coughdiginotarcough) - what should matter more is configuring the server and the key size of the certificate. I should note it's not hard to get an A+ on the test - I run a small source code hosting service and I have an A+ result from ssllabs. gitlab has an A-/A and github has an A/A+ (yes - they are 2 different scores based on different servers.