7 ms·
Some people are advising that duckduckgo can say that they are not tracking you but being based in the USA could be made to do so by the NSA.
by barking 10y ago
Some people are advising that duckduckgo can say that they are not tracking you but being based in the USA could be made to do so by the NSA.
- Tepix 10y agouse startpage.com then. They're based in the Netherlands.
- kriro 10y agoHadn't heard of it before. You basically trade a bit of search speed for more privacy. Trade off I'm willing to make it's my new default for now. It basically gives Google results with a better layer of privacy if I understand it correctly...which I guess means they could be cut out by Google eventually?
- lnalx 10y agohttps://ixquick.com/ https://ixquick.com/ is the same ?
- barking 10y agoI tried it but it doesn't like my ip (vpn) and makes me do a captcha before every single search. I have switched to duckduckgo, I can understand that they have reasons for doing that but it make it unbearable.
- jsingleton 10y agoAs they run on AWS they may not even know if this happens, but that isn't the threat model addressed by this article.
- whamlastxmas 10y agoThe lack of warrant canary on DDG is strange considering their entire premise.
- lnalx 10y agoAll is about trust. You can't completely verify a company does not store IP and other personal information even if the core is open-source... https://duckduckgo.com/privacy https://duckduckgo.com/privacy
- redwards510 10y agoprivatelee.com is a nice alternative to DDG.
- spartango 10y agoI'm not convinced this localization argument holds so much water. Consider the following: Case 1: If you're using a search engine not based in the US, and you're not a US person, then the NSA probably can't use any legal tools against you (depending on country). However, the NSA is allowed to use the full range of its capabilities to collect against you (PPD28 notwithstanding). They can infiltrate that service by technical or human means and carry out espionage activity without legal restriction (Title 50/EO12333). Further, they can retain the data unredacted for a long time.* Case 2: On the other end of the spectrum, if you're a US person and you're using a US-based search engine, surveillance activities against you are far more complex. Warrants, NSLs, and/or other legal paperwork is involved, and there are strict rules on data retention, sharing, and minimization. That's not to say that there isn't surveillance, just that it comes with substantially more overhead. Meanwhile, most of the NSA's technical exploitation approaches are off-limits, and any collection/exploitation activity must be carefully managed. Case 3: The intermediate case, where you're a non-US person using a US service, is a bit more hairy but still is better than the first case. While the NSA/FBI can utilize a range of legal tools (again, warrants, NSLs, etc) against you, because your data is likely entangled with US-persons data, it must also deal with all the overhead of minimizing and redacting that data (same as case 2). Similarly, the use of technical means against US providers is heavily restricted, so you won't be fighting against the same capabilities as you would be in case 1. At the end of the day, which do you think is easier for the engineers at NSA: exploiting, entering, and just taking everything (case 1) or filling out a huge amount of paperwork and carefully handling the redacted scraps of data that comes back from the provider eventually (cases 2 and 3)? I think you can make an argument for either side, but I tend to believe that technical exploitation is easier than legal, for now. *Caveat here is that this intelligence data is hard[er] to use in US law enforcement activity against you. It's worth noting, however, that NSLs and FISA data are also non-trivial.
- barking 10y agoyou're damned if you do and damned if you don't then