7 ms·

I think DuckDuckGo is unfairly singled out here. They do more than most companies to protect privacy, and most of their users are specifically trying to deprive

I think DuckDuckGo is unfairly singled out here. They do more than most companies to protect privacy, and most of their users are specifically trying to deprive Google of more feed for its data silo. Of course they can't protect you from the NSA. Extremely few actors can. If your threat model includes actors within the US Federal Government (especially the intelligence community), run. Yesterday. That's a statement about our times, not about any particular company. The solution ought to be browbeating the US Government for unethical practices, not browbeating a company that does privacy better than most, and not as well as would be necessary to stand toe-to-toe with some of the most powerful and far reaching organizations in the world.

sandworm101 9y ago
Protection from the Nation State Actors cannot come from companies. One must implement protections on one's own client-side. Proper encryption always. Tor when needed. Software and, where possible, hardware only from trusted sources.
- Mtinie 9y ago
  Even then the concept of "trusted sources" is a dubious one. A source only needs to be trusted until it sells you down the river.
  - katastic 9y ago
    So Equifax were good guys until they ditched all out data?
  - xkarga00 9y ago
    We need more than "trust". We need open software and open hardware.
TAForObvReasons 9y ago
The article was a response to a guardian article that ultimately cited https://siliconangle.com/blog/2013/06/14/duckduckgo-the-prism-proof-search-engine-that-the-nsa-just-cant-track/ https://siliconangle.com/blog/2013/06/14/duckduckgo-the-pris... > “By not storing any useful information, DuckDuckGo simply isn’t useful to these surveillance programs,” says Weinberg. “We literally do not store personally identifiable user data, so if the NSA were to get a hold of all our data, it would not be useful to them since it is all truly anonymous.” DDG is "unfairly singled out" for good reason, namely that company representatives made an incorrect assertion. DDG is still useful for ongoing surveillance, as the article pondered: > But what if DuckDuckGo provided a splitter-feed to the NSA? DuckDuckGo can claim without lying that they store no personal information, but that speaks nothing of a collaborating partner storing it.
- chiefalchemist 9y ago
  Not to get off topic but there's a part of me that suspect the Equifax hack has the NSA (or will ultimately filter back to them). When I read Dragnet Nation a couple years ago one of the things that left an impression on me was the fact that the gov can buy "private" personal data on the open market just like anyone else can. That is, it's not spying (and a violate of right / laws) if the data is on the free market. Obviously, DDG isn't perfect. I'm not naive. But for me there's some value in trying not to succumb to Google's desire to have us all assimilate.
  - uabstraction 9y ago
    > there's a part of me that suspect the Equifax hack has the NSA This is ridiculous. It makes no sense why the NSA or any other members of the US Intelligence Community would cause this sort of reputational damage and nationwide outrage to a company when they could simply walk up to them with one of those fancy national security letters with a built in gag order and take the information with much less of a fuss. Other than that, I agree. Google should buy me a god damn drink if they really want to get to know me. :)
    - chiefalchemist 9y ago
      Ridiculous? Not at all. In the context of the history of the CIA and NSA it's standard procedure. And that's just the stuff we know about. Certainly Snowden taught us anything is possible, that they have no restraint. B On the other hand, politely asking an outfit like Equifax for (just about) ALL their data with no real reason would be out of character. Why bother? Why go on record? It's pretty simple. Why would they get via hack? Answer: Because they can.
      - djsumdog 9y ago
        > Snowden Snowden, a man who worked from home in Hawaii as an NSA contractor making over $200k a year with his smoking hot girlfriend, who suddenly decided he had a moral compass, was able to download tons of classified files over VPN to his laptops and run off to meet Greenwald et. al. to divulge all this information, then flee to Russia where he sends out anti-Russian tweets. Meanwhile, nothing has happened. The NSA is still spying. PRISM seems to be something everyone has forgotten about (did it even exist? Most companies denied it). His evidence were all rededicated power point slides. Question the narratives that are given to you.
KGIII 9y ago
If I were a conspiracy theorist, I'd think there was something nefarious going on when I see articles like this. What if the intended result is not actually browbeating DDG but, rather, making people think that DDG is no better than Google in the privacy arena so why invest the energy in switching? If DDG isn't any better than maybe nobody is, so we might as well get used to the lack of privacy. Why switch if you're just going to get worse results, expend more energy, and not actually get increased privacy? You might just as well give up the struggle... Fortunately, I'm not a conspiracy theorist,
- api 9y ago
  Conspiracy just means multiple people working together in secret toward some common goal. People do that all the time. Why just last week we had a closed door meeting at my company about how we might conspire to create more interest in the user community for our product. That's a conspiracy. Of course there are nutty conspiracy theories but there are nutty math and physics papers too. I feel like the blanket ridicule of any notion of conspiratorial action is meant to discourage any form of investigative journalism or deeper probing below the surface of the narrative. Your hypothesis is reasonable and plausible.
  - KGIII 9y ago
    Sorry, my post was mostly satire/tongue-in-cheek. If I were in a position of power, and I knew that DDG was more difficult to get user data from, then I'd absolutely find a way to have articles published like this. I imagine that disenfranchised people are less likely to seek alternatives and are more likely to resign themselves to being monitored. It also seems like it would be more politically acceptable as well as offering a layer for plausible deniability. Were I in charge, and a nefarious actor, I'd be slipping stories like this into the media quite frequently. It's low cost, low risk, and probably has a good chance at success with at least some percentage of the population. I'm not sure I have the lack of ethics required to really do such a job. I'd like to hope that I'd resign before I helped do those sorts of things.
    - raugustinus 9y ago
goptimize 9y ago
If they use Amazon servers, NSA can get data from Amazon without dealing with DDG at all.
ehsankia 9y ago
I don't get why Google is always singled out either. When was the last time Google leaked your data. As you said, very few actors can protect your data from the NSA, so the next best thing is to have it protected from hackers and leaks. Every other company out there keeps on getting hit left and right, but for their size, Google is only of the only company who has never messed up with user data, and you know they are probably one of the most targeted, especially by state actors such as china and russia.
- notenas2neon 9y ago
  >When was the last time Google leaked your data[?] According to the State of California Department of Justice [0], the last publicly acknowledged data breach from Google was March 9th, 2017. Before that it was August 10th, 2016, and before that March 29th, 2016. [0] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list
  - scarhill 9y ago
    According to the notification letters on that site, those three incidents all involve Google employees' information being leaked by third parties, not Google leaking users' data. Here's a quote from one of them: "We recently learned that certain hotel reservations made for Google business travel were among the many reservations affected by a security incident impacting a third-party provider’s electronic reservation system that serves thousands of travel agencies and hotels. This did not affect Google’s systems. However, this incident impacted one of the travel providers used by Googlers, Carlson Wagonlit Travel (CWT)."
- Stanish 9y ago
  All signs point to their active cooperation, and indeed their overlap with, the intelligence sector.
- yeukhon 9y ago
  I'd say every single company sitting on billions of assets are on the target list. Facebook, Apple, Microsoft, Google, Amazon, Uber, everyone (although Microsoft is the least attacked here). But the illusion here is we only see the big guys, we rarely question the smaller guys, unless someone publishes a CVE or publish a disclosure. Many users are paranoid about ToS and how companies (esp the big guys) make money either by learning your behaviors (search preference, sites you visited) or selling your data to a partner (Foursquare, although they claim to only sell location data which are anonymous). We have a blind-trust with service providers. We let service providers to collect everything about ourselves, but internally they can decide whether to discard "sensitive data" early on or not during data processing (but web logs would have the trace). Has anyone every inspect the traffic, or reverse the API in <your wearable device> (e.g. Fitbit?) What about file sharing companies? Are they storing your data in a secure way and without reading what's in your file? What about sites that let you compare prices across multiple stores? What about medtech startups? What about when the company is acquired? Because the giants are more eye-catching, we don't see the smaller guys; but we are willing to give away sensitive and private data to the smaller guys because? If the argument is "well the big guys should have known better and have more resources to do the right thing", then I argue that by 2017 the new startups are doing the right things (not making the same well-known security flaws for example). I have doubt; I doubt many achieve 50% of what is on the imaginary checklist. The claim "we build MVP" is the equivalent of the big guys saying "we know what we are doing, don't worry." No, we don't know better. No, your MVP should be secure enough so users can trust you. I almost never try a newly launched service because I really don't want to be a lab rat. I am sorry if that sounds cynical, but I don't trust myself doing everything right. If you let me choose between a new file sharing startup vs others, I'd go with either Dropbox, Google Drive or OneDrive (FWIW, Google is replacing Drive with a new service). Why? Because if the big guy is compromised, well, shit, thousands or millions will be affected. The least cynical version is, well, they are too big to do stupid things (of course not true in reality). Our biases create illusions.
bsder 9y ago
I care about "random idiot at NSA sitting in front of a computer being able to make my life miserable". I don't care about "NSA has decided to invest $10 million to make me personally miserable." At that point, they will simply fabricate the evidence they need. If someone at the NSA wants to come after me, I simply want someone to actually have to sign a piece of paper--cut a check, file a warrant, send a human being, etc.--rather than just write a script in Python. If someone in a bureaucracy has to sign their name and take responsibility, I'm fairly safe. Simply the possibility that something might cause political fallout will stop 99.9% of all such actions.

sandworm101 9y ago

Protection from the Nation State Actors cannot come from companies. One must implement protections on one's own client-side. Proper encryption always. Tor when needed. Software and, where possible, hardware only from trusted sources.

Mtinie 9y ago
Even then the concept of "trusted sources" is a dubious one. A source only needs to be trusted until it sells you down the river.
- katastic 9y ago
  So Equifax were good guys until they ditched all out data?
- xkarga00 9y ago
  We need more than "trust". We need open software and open hardware.

TAForObvReasons 9y ago

The article was a response to a guardian article that ultimately cited https://siliconangle.com/blog/2013/06/14/duckduckgo-the-prism-proof-search-engine-that-the-nsa-just-cant-track/ https://siliconangle.com/blog/2013/06/14/duckduckgo-the-pris... > “By not storing any useful information, DuckDuckGo simply isn’t useful to these surveillance programs,” says Weinberg. “We literally do not store personally identifiable user data, so if the NSA were to get a hold of all our data, it would not be useful to them since it is all truly anonymous.” DDG is "unfairly singled out" for good reason, namely that company representatives made an incorrect assertion. DDG is still useful for ongoing surveillance, as the article pondered: > But what if DuckDuckGo provided a splitter-feed to the NSA? DuckDuckGo can claim without lying that they store no personal information, but that speaks nothing of a collaborating partner storing it.

chiefalchemist 9y ago
Not to get off topic but there's a part of me that suspect the Equifax hack has the NSA (or will ultimately filter back to them). When I read Dragnet Nation a couple years ago one of the things that left an impression on me was the fact that the gov can buy "private" personal data on the open market just like anyone else can. That is, it's not spying (and a violate of right / laws) if the data is on the free market. Obviously, DDG isn't perfect. I'm not naive. But for me there's some value in trying not to succumb to Google's desire to have us all assimilate.
- uabstraction 9y ago
  > there's a part of me that suspect the Equifax hack has the NSA This is ridiculous. It makes no sense why the NSA or any other members of the US Intelligence Community would cause this sort of reputational damage and nationwide outrage to a company when they could simply walk up to them with one of those fancy national security letters with a built in gag order and take the information with much less of a fuss. Other than that, I agree. Google should buy me a god damn drink if they really want to get to know me. :)
  - chiefalchemist 9y ago
    Ridiculous? Not at all. In the context of the history of the CIA and NSA it's standard procedure. And that's just the stuff we know about. Certainly Snowden taught us anything is possible, that they have no restraint. B On the other hand, politely asking an outfit like Equifax for (just about) ALL their data with no real reason would be out of character. Why bother? Why go on record? It's pretty simple. Why would they get via hack? Answer: Because they can.
    - djsumdog 9y ago
      > Snowden Snowden, a man who worked from home in Hawaii as an NSA contractor making over $200k a year with his smoking hot girlfriend, who suddenly decided he had a moral compass, was able to download tons of classified files over VPN to his laptops and run off to meet Greenwald et. al. to divulge all this information, then flee to Russia where he sends out anti-Russian tweets. Meanwhile, nothing has happened. The NSA is still spying. PRISM seems to be something everyone has forgotten about (did it even exist? Most companies denied it). His evidence were all rededicated power point slides. Question the narratives that are given to you.

KGIII 9y ago

If I were a conspiracy theorist, I'd think there was something nefarious going on when I see articles like this. What if the intended result is not actually browbeating DDG but, rather, making people think that DDG is no better than Google in the privacy arena so why invest the energy in switching? If DDG isn't any better than maybe nobody is, so we might as well get used to the lack of privacy. Why switch if you're just going to get worse results, expend more energy, and not actually get increased privacy? You might just as well give up the struggle... Fortunately, I'm not a conspiracy theorist,

api 9y ago
Conspiracy just means multiple people working together in secret toward some common goal. People do that all the time. Why just last week we had a closed door meeting at my company about how we might conspire to create more interest in the user community for our product. That's a conspiracy. Of course there are nutty conspiracy theories but there are nutty math and physics papers too. I feel like the blanket ridicule of any notion of conspiratorial action is meant to discourage any form of investigative journalism or deeper probing below the surface of the narrative. Your hypothesis is reasonable and plausible.
- KGIII 9y ago
  Sorry, my post was mostly satire/tongue-in-cheek. If I were in a position of power, and I knew that DDG was more difficult to get user data from, then I'd absolutely find a way to have articles published like this. I imagine that disenfranchised people are less likely to seek alternatives and are more likely to resign themselves to being monitored. It also seems like it would be more politically acceptable as well as offering a layer for plausible deniability. Were I in charge, and a nefarious actor, I'd be slipping stories like this into the media quite frequently. It's low cost, low risk, and probably has a good chance at success with at least some percentage of the population. I'm not sure I have the lack of ethics required to really do such a job. I'd like to hope that I'd resign before I helped do those sorts of things.
  - raugustinus 9y ago

goptimize 9y ago

If they use Amazon servers, NSA can get data from Amazon without dealing with DDG at all.

ehsankia 9y ago

I don't get why Google is always singled out either. When was the last time Google leaked your data. As you said, very few actors can protect your data from the NSA, so the next best thing is to have it protected from hackers and leaks. Every other company out there keeps on getting hit left and right, but for their size, Google is only of the only company who has never messed up with user data, and you know they are probably one of the most targeted, especially by state actors such as china and russia.

notenas2neon 9y ago
>When was the last time Google leaked your data[?] According to the State of California Department of Justice [0], the last publicly acknowledged data breach from Google was March 9th, 2017. Before that it was August 10th, 2016, and before that March 29th, 2016. [0] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list
- scarhill 9y ago
  According to the notification letters on that site, those three incidents all involve Google employees' information being leaked by third parties, not Google leaking users' data. Here's a quote from one of them: "We recently learned that certain hotel reservations made for Google business travel were among the many reservations affected by a security incident impacting a third-party provider’s electronic reservation system that serves thousands of travel agencies and hotels. This did not affect Google’s systems. However, this incident impacted one of the travel providers used by Googlers, Carlson Wagonlit Travel (CWT)."
Stanish 9y ago
All signs point to their active cooperation, and indeed their overlap with, the intelligence sector.
yeukhon 9y ago
I'd say every single company sitting on billions of assets are on the target list. Facebook, Apple, Microsoft, Google, Amazon, Uber, everyone (although Microsoft is the least attacked here). But the illusion here is we only see the big guys, we rarely question the smaller guys, unless someone publishes a CVE or publish a disclosure. Many users are paranoid about ToS and how companies (esp the big guys) make money either by learning your behaviors (search preference, sites you visited) or selling your data to a partner (Foursquare, although they claim to only sell location data which are anonymous). We have a blind-trust with service providers. We let service providers to collect everything about ourselves, but internally they can decide whether to discard "sensitive data" early on or not during data processing (but web logs would have the trace). Has anyone every inspect the traffic, or reverse the API in <your wearable device> (e.g. Fitbit?) What about file sharing companies? Are they storing your data in a secure way and without reading what's in your file? What about sites that let you compare prices across multiple stores? What about medtech startups? What about when the company is acquired? Because the giants are more eye-catching, we don't see the smaller guys; but we are willing to give away sensitive and private data to the smaller guys because? If the argument is "well the big guys should have known better and have more resources to do the right thing", then I argue that by 2017 the new startups are doing the right things (not making the same well-known security flaws for example). I have doubt; I doubt many achieve 50% of what is on the imaginary checklist. The claim "we build MVP" is the equivalent of the big guys saying "we know what we are doing, don't worry." No, we don't know better. No, your MVP should be secure enough so users can trust you. I almost never try a newly launched service because I really don't want to be a lab rat. I am sorry if that sounds cynical, but I don't trust myself doing everything right. If you let me choose between a new file sharing startup vs others, I'd go with either Dropbox, Google Drive or OneDrive (FWIW, Google is replacing Drive with a new service). Why? Because if the big guy is compromised, well, shit, thousands or millions will be affected. The least cynical version is, well, they are too big to do stupid things (of course not true in reality). Our biases create illusions.

bsder 9y ago

I care about "random idiot at NSA sitting in front of a computer being able to make my life miserable". I don't care about "NSA has decided to invest $10 million to make me personally miserable." At that point, they will simply fabricate the evidence they need. If someone at the NSA wants to come after me, I simply want someone to actually have to sign a piece of paper--cut a check, file a warrant, send a human being, etc.--rather than just write a script in Python. If someone in a bureaucracy has to sign their name and take responsibility, I'm fairly safe. Simply the possibility that something might cause political fallout will stop 99.9% of all such actions.