3 ms·

Thanks for the info, care to dive into my other concerns?

Hermel 11y ago
While an SSL certificate from GoDaddy is not ideal, attacks are still detectable in theory by verifying the public key of Hulbee independently of the chain of trust. What I personally would be more concerned about is the fact that DuckDuckGo is hosted by Amazon. As an US company, Amazon is required to collaborate with US three letter agencies by law. Thus, whatever is hosted by Amazon is within reach of the NSA. In contrast, Hulbee is hosted in Switzerland on servers which are under physical control of Hulbee.
- captaincrunch 11y ago
  Doesn't really matter where its hosted when most North American connections go through New York when we're talking about the NSA... does it. This should make you feel a lot better about the site... ignore the perl stuff, it was just part of my test. https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.knowtechie.netdna-cdn.com%2Fwp-content%2Fuploads%2F2014%2F12%2Fhacker1.jpg%3E%22%3B'%20%3E%20out&region=en-CA&uiLanguage=browser https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S...
  - Hermel 11y ago
    > Doesn't really matter where its hosted when most North American connections go through New York Actually, it does matter. Https is end-to-end encryption. An eavesdropper in New York would have to crack SSL in order to see anything meaningful beyond the fact that you exchanged some data with hulbee.com .
    - captaincrunch 11y ago
      I would bet that the NSA has access to most root certificates... specially when they've had access to hard drive firmware for the last few years... http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/
      - astrange 11y ago
        If you used a CA certificate to sign a new SSL cert for any popular domain, it'd be detected by certificate fingerprinting and you'd burn the CA. Not worth it over public networks.

While an SSL certificate from GoDaddy is not ideal, attacks are still detectable in theory by verifying the public key of Hulbee independently of the chain of trust. What I personally would be more concerned about is the fact that DuckDuckGo is hosted by Amazon. As an US company, Amazon is required to collaborate with US three letter agencies by law. Thus, whatever is hosted by Amazon is within reach of the NSA. In contrast, Hulbee is hosted in Switzerland on servers which are under physical control of Hulbee.

captaincrunch 11y ago
Doesn't really matter where its hosted when most North American connections go through New York when we're talking about the NSA... does it. This should make you feel a lot better about the site... ignore the perl stuff, it was just part of my test. https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20SRC%3Dhttp%3A%2F%2Fkt-media.knowtechie.netdna-cdn.com%2Fwp-content%2Fuploads%2F2014%2F12%2Fhacker1.jpg%3E%22%3B'%20%3E%20out&region=en-CA&uiLanguage=browser https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S...
- Hermel 11y ago
  > Doesn't really matter where its hosted when most North American connections go through New York Actually, it does matter. Https is end-to-end encryption. An eavesdropper in New York would have to crack SSL in order to see anything meaningful beyond the fact that you exchanged some data with hulbee.com .
  - captaincrunch 11y ago
    I would bet that the NSA has access to most root certificates... specially when they've had access to hard drive firmware for the last few years... http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/
    - astrange 11y ago
      If you used a CA certificate to sign a new SSL cert for any popular domain, it'd be detected by certificate fingerprinting and you'd burn the CA. Not worth it over public networks.