5 ms·

Does the POST switch works when you are using DDG via the Google Chrome URL bar? (I have it set at "https://duckduckgo.com/?q=%s https://duckduckgo.com/?q=%s)

okahn 16y ago
Doesn't seem to, no. The page I land on is still http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news.
- mike-cardwell 16y ago
  Encrypting the url parameters is the way to go: Requests for: http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news Should HTTP redirect to something like: http://duckduckgo.com/?enc=34g7h3giuh3g http://duckduckgo.com/?enc=34g7h3giuh3g Where 34g7h3giuh3g would be the ciphertext generated by encrypting "hacker news". That page knows what the search term was because it will have decrypted the parameters on the server side, but any referers would just contain "garbage", and it would also mean people can copy/paste the address bar about.
  - apgwoz 16y ago
    all the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you could easily write a script to scrape the actual terms...
    - mike-cardwell 16y ago
      Yes, you're right. I didn't think of that.
    - erikpukinskis 16y ago
      What if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?
      - epi0Bauqu 16y ago
        That embeds the IP in the process and could theoretically be reverse-engineered.
        apgwoz 16y ago
        Are there session ids? I assume that HMAC(secret + sessionID + ip + search terms) would be fine.
        epi0Bauqu 16y ago
        No sessions.
        apgwoz 16y ago
        I see you do settings through a cookie or URL params. I'm out of ideas unless you hash the cookie + ip for a session ID fir that purpose.
clusterfu_k 16y ago
I search using ixquick.com because of their good privacy measures and they searh using post. They have a button on their website that adds it to you list of search engines in chrome (chromium in my case), so it definitely can be done. EDIT: it turns out that ixquick switches to a different URL and uses get instead of post for this, so forget what I said. PS: the opera urlbar inline search has post support.

okahn 16y ago

Doesn't seem to, no. The page I land on is still http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news.

mike-cardwell 16y ago
Encrypting the url parameters is the way to go: Requests for: http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news Should HTTP redirect to something like: http://duckduckgo.com/?enc=34g7h3giuh3g http://duckduckgo.com/?enc=34g7h3giuh3g Where 34g7h3giuh3g would be the ciphertext generated by encrypting "hacker news". That page knows what the search term was because it will have decrypted the parameters on the server side, but any referers would just contain "garbage", and it would also mean people can copy/paste the address bar about.
- apgwoz 16y ago
  all the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you could easily write a script to scrape the actual terms...
  - mike-cardwell 16y ago
    Yes, you're right. I didn't think of that.
  - erikpukinskis 16y ago
    What if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?
    - epi0Bauqu 16y ago
      That embeds the IP in the process and could theoretically be reverse-engineered.
      - apgwoz 16y ago
        Are there session ids? I assume that HMAC(secret + sessionID + ip + search terms) would be fine.
        epi0Bauqu 16y ago
        No sessions.
        apgwoz 16y ago
        I see you do settings through a cookie or URL params. I'm out of ideas unless you hash the cookie + ip for a session ID fir that purpose.

clusterfu_k 16y ago

I search using ixquick.com because of their good privacy measures and they searh using post. They have a button on their website that adds it to you list of search engines in chrome (chromium in my case), so it definitely can be done. EDIT: it turns out that ixquick switches to a different URL and uses get instead of post for this, so forget what I said. PS: the opera urlbar inline search has post support.