3 ms·

> How do you save a search in a non-personally identifiable way? Save a sha256 hash of every search for 24 hours. If you see the same hash from >10 distinct IP

> How do you save a search in a non-personally identifiable way? Save a sha256 hash of every search for 24 hours. If you see the same hash from >10 distinct IP addresses in a 24 hour period, save the search terms. That's just off the top of my head, I have no reason to think they're doing it exactly like that. The point is that you're claiming that we shouldn't trust DuckDuckGo because you can't think of a way that they could securely and privately do what they do -- but that's just your intuitions, for whatever they may be worth. I also don't really buy the worries you have with the last two questions, e.g.: > How do you verify that DuckDuckGo does not secretly cooperate with more powerful coercive actors? How would you verify that for any centralized service, open source or not? I think your security concerns go a bit beyond what most people interested in critiquing / improving DDG can reasonably expect to achieve.

pb7 6y ago
>How would you verify that for any centralized service, open source or not? Other centralized (search) services don't have their entire existence depending on this one factor. What is DDG if not alleged privacy? Just use Bing directly.
- bscphil 6y ago
  I don't understand that argument at all. What's the threat model? I think it's entirely reasonable to be in the following posture: I want as much privacy for my web searches as I can reasonably achieve without having to run a search engine myself. I'm willing to trust that search providers are not saving personally identifiable information or passively turning over search data to law enforcement if they claim that they are not in their terms of service. That's pretty much the use case for DDG. With Bing you know they are violating your privacy. With DDG you have a promise in writing that they are not. It's hard to see how that's not strictly better than what you get from Bing if privacy is among your core desiderata.
  - pb7 6y ago
    I think we're on the same page. I was saying that if it were to be discovered that DDG lacks privacy then there would be no reason to use it over Bing since that is its raison d'etre. >I'm willing to trust that search providers are not saving personally identifiable information or passively turning over search data to law enforcement if they claim that they are not in their terms of service. Do other search companies disclose that they share data with the FBI, NSA, etc in their ToS? Genuinely don't know.
pfarrell 6y ago
> How would you verify that for any centralized service, open source or not? I think, technically, some sort of honeypot verification could prove a compromise (i.e. if information that has very little chance of existing naturally in two systems, say a string a guids). But... I agree with your point. I don't think this is actually feasible or realistic, just technically possible.

pb7 6y ago

>How would you verify that for any centralized service, open source or not? Other centralized (search) services don't have their entire existence depending on this one factor. What is DDG if not alleged privacy? Just use Bing directly.

bscphil 6y ago
I don't understand that argument at all. What's the threat model? I think it's entirely reasonable to be in the following posture: I want as much privacy for my web searches as I can reasonably achieve without having to run a search engine myself. I'm willing to trust that search providers are not saving personally identifiable information or passively turning over search data to law enforcement if they claim that they are not in their terms of service. That's pretty much the use case for DDG. With Bing you know they are violating your privacy. With DDG you have a promise in writing that they are not. It's hard to see how that's not strictly better than what you get from Bing if privacy is among your core desiderata.
- pb7 6y ago
  I think we're on the same page. I was saying that if it were to be discovered that DDG lacks privacy then there would be no reason to use it over Bing since that is its raison d'etre. >I'm willing to trust that search providers are not saving personally identifiable information or passively turning over search data to law enforcement if they claim that they are not in their terms of service. Do other search companies disclose that they share data with the FBI, NSA, etc in their ToS? Genuinely don't know.

pfarrell 6y ago

> How would you verify that for any centralized service, open source or not? I think, technically, some sort of honeypot verification could prove a compromise (i.e. if information that has very little chance of existing naturally in two systems, say a string a guids). But... I agree with your point. I don't think this is actually feasible or realistic, just technically possible.