9 ms·

End to End Encrypted, Private Search

130 points by rasengan 6y ago

nodex-alex 6y ago
Awesome if you want to return irrlevant searches with duplicate pages from sites that have no bearing to your search! Kudos :/
fitblipper 6y ago
Using the term "end to end" feel a little off to me in this solution since one of the "end"s is the search engine service. If encryption is just through TLS how is this different than just sending your normal https based searches through a VPN or TOR?
- jdxcode 6y ago
  I don’t understand either. It says private.sh can’t see your query but the “search provider” can, so that’s the other end. What the heck is a search provider though? EDIT: looks like it’s “gigablast”. I don’t understand why I just wouldn’t use that search engine directly?
  - prophesi 6y ago
    It encrypts the query with the public key of the search provider (Gigablast) then sends it over to https://search.private.sh/v2/search https://search.private.sh/v2/search which then supposedly goes through a few proxies before finally hitting Gigablast, wherein the search query is decrypted by Gigablast's private key. The point is that Gigablast doesn't know details about the user (though I'm not sure why private.sh's servers can't just forward the IP), and private.sh doesn't know what search query was sent (which, if you're using the extension and disable auto-updates, you can verify that this is actually the case. The code is short and readable.)
  - Nightshaxx 6y ago
    The whole idea of the product is it strips your IP address.
- rasengan 6y ago
  Thanks for taking a look, and that's a great question. The search is both end to end encrypted and private. In the sense of end to end, if you rely on TLS alone and send your query directly to the search engine, your IP will be attached to said query and thus your search and identity are coupled. In private.sh, it's both end to end and private: 1. We utilize client-side javascript encryption prior to routing a search thru a proxy. 2. The proxy cannot read the query, and simply forwards it to the search engine. 3. The search engine decrypts, performs the search, and encrypts the results which are sent back thru the proxy (who, again, cannot even read the results). 4. The results are decrypted client-side. Thus, your search query and identity are decoupled.
  - deanclatworthy 6y ago
    If you're going to rely on any client-side javascript please use subresource integrity for all your assets.
    - speedgoose 6y ago
      If TLS is compromised, you cannot trust the subresource subresource integrity checksums. It's better than nothing but there is no good solution.
      - blueplanet200 6y ago
        Indeed, if TLS is compromised many security guarantees of the web break down.
      - bawolff 6y ago
        Which is why this whole exercise is a bunch of snake oil. You can't have better than TLS security when TLS is the weakest link.
        blueplanet200 6y ago
        This is just plain false. This search engine is advertising anonymity. You don't get that when searching Google, which is encrypted with TLS...
- shuntress 6y ago
  Under "How Does It Work?": Every single search request from our website and extension is encrypted locally on the client and proxied through our service, stripping away your public IP address ensuring that only the search provider is able to decrypt and see your query without any knowledge of who you are. This is vague. It seems like it just means: "we have a TLS certificate and will be a proxy between you and Google"
  - threwawasy1228 6y ago
    That is what the authors stated means in practice, so your assessment is correct. This seems trivial, like I can just use an onion router for this.
    - rasengan 6y ago
      It's a bit different, since if you only use a TLS certificate, you'd still be able to see the query. That said, I agree, you could absolutely do the same with an onion router. This simply provides the benefit without having to do so.
      - threwawasy1228 6y ago
        I was being a bit harsh offhandedly. If I was making a full assessment of the product I would say that it has a market. You can't really do what I'm talking about with the tor onion router, because google blocks tons of tor traffic from accessing its services and wont even let you do a captcha cloudflare-style a lot of the time. As someone who uses tor everyday, you basically can't get any higher quality general purpose search than duckduckgo or searx to actually load over onion routing. If you position yourself in such a way that your results engine returns queries on par with those two (or preferably better) you will have a rock solid product in your hands.
        rasengan 6y ago
        Thank you so much for the comments! I totally agree with you!
bravoetch 6y ago
Searched on Coinbase in USA news results. Didn't get anything directly about the upcoming IPO, and many non-english results were included. I like the concept, but the results are not useable.
- rasengan 6y ago
  This is good feedback and a good test. That should have absolutely returned something of relevance, so I agree with you here. The search provider is constantly working to improve its search results, and I believe that feedback like this is of great importance to catabolize this. Thanks again for the feedback, it's well noted.
pbronez 6y ago
This appears to be a zero-knowledge proxy for web search. It's not clear what search engine they're proxying to, but I wasn't super impressed with the result quality off the bat. I searched for "Brave search engine acquisition" and got a link to the TechCrunch home page with a relevant snippet, but the actual link didn't take me to the relevant article. It's hard to see what value this adds over something like Duck Duck Go. Yes, it means the search provider can't see your IP... but there are other ways to do that, and you're trusting private.sh with your query and IP anyway.
- rasengan 6y ago
  > and you're trusting private.sh with your query and IP anyway. If you take a look at the javascript, the query is absolutely encrypted before private.sh can see it. In other words, private.sh cannot see it. Instead, what private.sh provides is a decoupling of your identity from your search query. Private.sh can see your IP, but cannot see your search query. The search engine can see your search query, but cannot see your IP. Hope this helps clarify and thanks for the input! The search provider is constantly improving search results -- we'll be seeing significantly improved results over time!
  - oarsinsync 6y ago
    > If you take a look at the javascript How do I automatically validate that the JS hasn't changed between visits on my mobile? (This is the problem with zero-knowledge-via-JS-delivery platforms that I've been unable to solve to date)
    - mikepurvis 6y ago
      I believe the current direction is to piggy-back off of subresource integrity: https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/ As written, it's more about a page validating the asset from a CDN, but it wouldn't be hard to also have a browser extension which pops up an SSL-like badge when all script resources on a page are marked as trusted by some validating third party.
deanclatworthy 6y ago
Who is the search provider? I tried looking on the site, didn't find any mention of it, and the language used in the comments here seems somewhat evasive. Edit: okay this is an initiative by PrivateInternetAccess and they are using https://www.gigablast.com/ https://www.gigablast.com/ as the search provider
- rasengan 6y ago
  It's an initiative by Imperial Family Companies [1] which uses GigaBlast as the provider. [1] https://imperialfamily.com/ https://imperialfamily.com/
rosstex 6y ago
Any reason they don't just use Google as the search provider? Then suddenly they've got a business
- cocoafleck 6y ago
  Startpage is similar to what you are describing. (Supposedly private, and backed by Google search.)
pkulak 6y ago
Thought this was some new kind of homomorphic encryption and got pretty excited for a bit.
simplecto 6y ago
Wow, search engines are having a busy day. First Brave and this one is on the front page. I said it about Brave's purcahse of the defunct Clickz, and I will say it here: Privacy is a feature, not a platform. -- Building a business on this feature is not enough. It actually has to be better. Competing with Google's 20+ year and 500 billion dollar head-start on broad search seem foolish unless you are willing to buy up the talent and resources to go head-to-head. I'm not here to poo-poo effort, but I do think there is a better way. One based on niches and human curation. We can get around the problem of head-to-head competition with general search by focusing on better facets and data sets curated by subject matter experts. At least, that is one hypothesis.
- rasengan 6y ago
  You may be on to something here. In the past, most search engines started from DMOZ (now defunct) which was a simple, curated, directory.
  - simplecto 6y ago
    I'm very serious about this space. Please reach out if anyone wants to connect and chat. Links in Profile!
- gbmatt 6y ago
  if the doj, etc. breaks google's stranglehold on search ads up into 2 or more independent search ad companies, then other non-big-tech search engines might have a chance at bidding for some of the 'default' provider lists for cell phones, browsers, etc. but as it is right now, google does not allow their search ads to be displayed on other search engines' search results. sucks!
- codezero 6y ago
  I did a lot of work on the community at Quora and my low-effort hot take is that subject matter experts don't get paid enough to do that kind of work, so you get grad students or hobbyists who put in effort while they are unemployed, but fizzle off when not, and they boil away leaving only the obsessive folks with an axe to grind. That's a problem to solve as well, but I think it could be solved if those subject matter experts were part of your business model and they were paid in some meaningful way.
kar5pt 6y ago
Am I missing something about duckduckgo? I was under the impression it already serves the function of providing privacy-focused search. Is it not as private as I thought it was?
- gbmatt 6y ago
  when you do a query on ddg they have access to your IP address AND your query. so you have to trust ddg quite a bit, and trust the people that work there. But if you use private.sh, no single entity has access to BOTH your query and your IP address. so it just provides more privacy than ddg.
  - bawolff 6y ago
    That's marketing bullshit. Private.sh has no more garuntees than ddg
    - rasengan 6y ago
      DDG is a great search engine. I trust they do not log and maintain privacy. One entity needs to be trusted. That being said, with the private.sh offering, it requires two entities to collude to identify users. Thus, it does provide more guarantees than DDG.
      - bawolff 6y ago
        Private.sh can identify users without any help because it controlls the encryption code. You only need 2 entities to collude if private.sh is acting honestly. If they are colluding you have already assumed they are not acting honestly.
        rasengan 6y ago
        If you use the Firefox and Chrome extension [1] you do not need to trust that the encryption code is broken. [1] https://private.sh/extension.html https://private.sh/extension.html
deleted 6y ago
[deleted]
hjek 6y ago
This requires non-free JavaScript[0] to even post a search query, doesn't it? The FF add-on[1] specifies "Custom License" without specifying which one. [0] https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html [1] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...
drivebycomment 6y ago
As https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/, anonymity is always a double-edged sword and this will get taken advantage of by abusers. So we'll have to see if this can survive when abusers start taking advantage of it. This is a difficult problem...
- bawolff 6y ago
  Its a read-only search box. What exactly do you think the trouble will be?
Imnimo 6y ago
I tried a query I searched for yesterday at work: "opengl python glclipplane". Google gives me the documentation page, two example pages (which are near duplicates), and then some relevant Stackoverflow questions. Private.sh gives me the website homepage for OpenGL, some totally irrelevant links into the PyOpenGL documentation (other modules, etc., not the one I searched for), and the Wikipedia page for OpenGL. It's cool that it's private, but I could pipe my searches to /dev/null and that'd be pretty private too. If I can't get a useable result, who cares?
- gbmatt 6y ago
  gigablast coder here. i noticed if you search for 'pyopengl glclipplane' it gets it. ('python' does not occur anywhere on the page!) i think this is a synonym issue. 'opengl python' should be synonymous with 'pyopengl'. i think google gets this because they have billions of queries from which to derive synonyms. i'll be adding more synonyms to gigablast over time and hope to close this synonym gap. that being said, i think 90% of the bad search results come from the index being too small (straight up lacking the best web page), or not having good enough synonyms.
  - Imnimo 6y ago
    While that's a reasonable explanation, the top result from private.sh (the opengl.org homepage) also does not include "python" anywhere on the page. I would expect the top result to at least be something relevant to glclipplane. I think this is both an issue of retrieval but also of ranking - the opengl homepage is a very generic result which is unlikely to have much salience to a query with other specific search terms.
Hitton 6y ago
So instead of: I trust DDG not to track me. it's: I trust Private.sh to not give Gigablast my IP to track me.
- rasengan 6y ago
  Yes. A comparison would be single-key versus multi-key authentication.
upofadown 6y ago
I found the "How it works" section somewhat confusing. I don't know what is meant by "your search term is encrypted using the Search Provider’s public key". Does this mean that the search provider has some simple encryption interface other than TLS?
- rasengan 6y ago
  Great question. If you review the javascript, NaCl is used to encrypted the search query before giving it to private.sh. Thus, private.sh is unable to decrypt your search. The search provider uses NaCl to decrypt the search query and then encrypts the results before passing it back. The results are then only able to be decrypted by the browser, client side.
upofadown 6y ago
This seems like an odd use of the term "end to end encrypted". This seems to be primarily some sort of proxy scheme. If this is considered "end to end encryption" then why do we not consider any use of a proxy "end to end encryption"? Normally that term is used in messaging between two people to identify a system that puts the identity management and the control of the cryptographic keys under the exclusive control of those users. That is certainly not true in this case.
- rasengan 6y ago
  This is absolutely end to end encrypted. A proxy can only strip the IP. The NaCl client side encryption deployed on private.sh is what makes this end to end. The client encrypts the search query with the public key of gigablast. The proxy proxies the encrypted payload to gigablast. Gigablast decrypts the payload, performs the search and encrypts the results with the client's public key which is included in the encrypted payload. Then, Gigablast passes the encrypted results payload back through the proxy to the end user who is able to decrypt the payload and display the results. In conclusion, the proxy (private.sh) knows your IP, but not your search query. The search provider (gigablast) knows your search query but not your IP. Hope this is clear!
  - spullara 6y ago
    End-to-end encrypted means that Gigablast wouldn't see the search query or the results only the service and the searcher would see them. For example, Signal is end-to-end encrypted. Signal servers do not see your messages. Edit: this was addressed in the comments. The end-to-end is between the client and Gigablast. Private.sh is the Signal server and it cannot see the request or response.
    - rasengan 6y ago
      End to end encrypted means this here: [Client] ---> [Private.sh] ---> [Gigablast] In the above diagram, [Private.sh] cannot see the search query. Thus, it's end to end encrypted. Private.sh is the "signal server" in this case. It works because the actual client, in this case, is the javascript running client-side on the web browser. Your browser encrypts the query, clientside, before sending it to private.sh. All private.sh does is strips the IP away before sending it to gigablast. Hope this is more clear!
jedberg 6y ago
How do I know Gigablast (the search provider) and Private.sh (the proxy provider) aren't colluding to de-anonymize the request?
- rasengan 6y ago
  It's not a trustless solution, but one that requires multiple parties to collude to break trust as opposed to in most search engines cases, just one. In other words, if "Search Engine Company" wants to deanonymize and link your search with your query, they can. If Private.sh or Gigablast want to, the two separate entities will have to collude. This isn't zero-trust, but it's absolutely 'lesser trust' than the current offerings outside of Private.sh.
  - jedberg 6y ago
    > This isn't zero-trust, but it's absolutely 'lesser trust' than the current offerings outside of Private.sh. In what way? How do I know the two owners of the companies aren't the same person? Heck, how do I know that Private.sh isn't just a Google spinoff? There's absolutely nothing that guarantees that Private.sh and Gigablast aren't the same person or the same company. I'd say it's the same level of trust as DDG or Google.
crosser 6y ago
private.sh is not saying if the client's key pair is rotated, and if so, how often. If it is not rotated, search provider can correlate requests coming from the same user and learn a lot about them.

130 points by rasengan 6y ago

Awesome if you want to return irrlevant searches with duplicate pages from sites that have no bearing to your search! Kudos :/

fitblipper 6y ago

Using the term "end to end" feel a little off to me in this solution since one of the "end"s is the search engine service. If encryption is just through TLS how is this different than just sending your normal https based searches through a VPN or TOR?

jdxcode 6y ago
I don’t understand either. It says private.sh can’t see your query but the “search provider” can, so that’s the other end. What the heck is a search provider though? EDIT: looks like it’s “gigablast”. I don’t understand why I just wouldn’t use that search engine directly?
- prophesi 6y ago
  It encrypts the query with the public key of the search provider (Gigablast) then sends it over to https://search.private.sh/v2/search https://search.private.sh/v2/search which then supposedly goes through a few proxies before finally hitting Gigablast, wherein the search query is decrypted by Gigablast's private key. The point is that Gigablast doesn't know details about the user (though I'm not sure why private.sh's servers can't just forward the IP), and private.sh doesn't know what search query was sent (which, if you're using the extension and disable auto-updates, you can verify that this is actually the case. The code is short and readable.)
- Nightshaxx 6y ago
  The whole idea of the product is it strips your IP address.
rasengan 6y ago
Thanks for taking a look, and that's a great question. The search is both end to end encrypted and private. In the sense of end to end, if you rely on TLS alone and send your query directly to the search engine, your IP will be attached to said query and thus your search and identity are coupled. In private.sh, it's both end to end and private: 1. We utilize client-side javascript encryption prior to routing a search thru a proxy. 2. The proxy cannot read the query, and simply forwards it to the search engine. 3. The search engine decrypts, performs the search, and encrypts the results which are sent back thru the proxy (who, again, cannot even read the results). 4. The results are decrypted client-side. Thus, your search query and identity are decoupled.
- deanclatworthy 6y ago
  If you're going to rely on any client-side javascript please use subresource integrity for all your assets.
  - speedgoose 6y ago
    If TLS is compromised, you cannot trust the subresource subresource integrity checksums. It's better than nothing but there is no good solution.
    - blueplanet200 6y ago
      Indeed, if TLS is compromised many security guarantees of the web break down.
    - bawolff 6y ago
      Which is why this whole exercise is a bunch of snake oil. You can't have better than TLS security when TLS is the weakest link.
      - blueplanet200 6y ago
        This is just plain false. This search engine is advertising anonymity. You don't get that when searching Google, which is encrypted with TLS...
shuntress 6y ago
Under "How Does It Work?": Every single search request from our website and extension is encrypted locally on the client and proxied through our service, stripping away your public IP address ensuring that only the search provider is able to decrypt and see your query without any knowledge of who you are. This is vague. It seems like it just means: "we have a TLS certificate and will be a proxy between you and Google"
- threwawasy1228 6y ago
  That is what the authors stated means in practice, so your assessment is correct. This seems trivial, like I can just use an onion router for this.
  - rasengan 6y ago
    It's a bit different, since if you only use a TLS certificate, you'd still be able to see the query. That said, I agree, you could absolutely do the same with an onion router. This simply provides the benefit without having to do so.
    - threwawasy1228 6y ago
      I was being a bit harsh offhandedly. If I was making a full assessment of the product I would say that it has a market. You can't really do what I'm talking about with the tor onion router, because google blocks tons of tor traffic from accessing its services and wont even let you do a captcha cloudflare-style a lot of the time. As someone who uses tor everyday, you basically can't get any higher quality general purpose search than duckduckgo or searx to actually load over onion routing. If you position yourself in such a way that your results engine returns queries on par with those two (or preferably better) you will have a rock solid product in your hands.
      - rasengan 6y ago
        Thank you so much for the comments! I totally agree with you!

bravoetch 6y ago

Searched on Coinbase in USA news results. Didn't get anything directly about the upcoming IPO, and many non-english results were included. I like the concept, but the results are not useable.

rasengan 6y ago
This is good feedback and a good test. That should have absolutely returned something of relevance, so I agree with you here. The search provider is constantly working to improve its search results, and I believe that feedback like this is of great importance to catabolize this. Thanks again for the feedback, it's well noted.

pbronez 6y ago

This appears to be a zero-knowledge proxy for web search. It's not clear what search engine they're proxying to, but I wasn't super impressed with the result quality off the bat. I searched for "Brave search engine acquisition" and got a link to the TechCrunch home page with a relevant snippet, but the actual link didn't take me to the relevant article. It's hard to see what value this adds over something like Duck Duck Go. Yes, it means the search provider can't see your IP... but there are other ways to do that, and you're trusting private.sh with your query and IP anyway.

rasengan 6y ago
> and you're trusting private.sh with your query and IP anyway. If you take a look at the javascript, the query is absolutely encrypted before private.sh can see it. In other words, private.sh cannot see it. Instead, what private.sh provides is a decoupling of your identity from your search query. Private.sh can see your IP, but cannot see your search query. The search engine can see your search query, but cannot see your IP. Hope this helps clarify and thanks for the input! The search provider is constantly improving search results -- we'll be seeing significantly improved results over time!
- oarsinsync 6y ago
  > If you take a look at the javascript How do I automatically validate that the JS hasn't changed between visits on my mobile? (This is the problem with zero-knowledge-via-JS-delivery platforms that I've been unable to solve to date)
  - mikepurvis 6y ago
    I believe the current direction is to piggy-back off of subresource integrity: https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/ As written, it's more about a page validating the asset from a CDN, but it wouldn't be hard to also have a browser extension which pops up an SSL-like badge when all script resources on a page are marked as trusted by some validating third party.

deanclatworthy 6y ago

Who is the search provider? I tried looking on the site, didn't find any mention of it, and the language used in the comments here seems somewhat evasive. Edit: okay this is an initiative by PrivateInternetAccess and they are using https://www.gigablast.com/ https://www.gigablast.com/ as the search provider

rasengan 6y ago
It's an initiative by Imperial Family Companies [1] which uses GigaBlast as the provider. [1] https://imperialfamily.com/ https://imperialfamily.com/

rosstex 6y ago

Any reason they don't just use Google as the search provider? Then suddenly they've got a business

cocoafleck 6y ago
Startpage is similar to what you are describing. (Supposedly private, and backed by Google search.)

pkulak 6y ago

Thought this was some new kind of homomorphic encryption and got pretty excited for a bit.

simplecto 6y ago

Wow, search engines are having a busy day. First Brave and this one is on the front page. I said it about Brave's purcahse of the defunct Clickz, and I will say it here: Privacy is a feature, not a platform. -- Building a business on this feature is not enough. It actually has to be better. Competing with Google's 20+ year and 500 billion dollar head-start on broad search seem foolish unless you are willing to buy up the talent and resources to go head-to-head. I'm not here to poo-poo effort, but I do think there is a better way. One based on niches and human curation. We can get around the problem of head-to-head competition with general search by focusing on better facets and data sets curated by subject matter experts. At least, that is one hypothesis.

rasengan 6y ago
You may be on to something here. In the past, most search engines started from DMOZ (now defunct) which was a simple, curated, directory.
- simplecto 6y ago
  I'm very serious about this space. Please reach out if anyone wants to connect and chat. Links in Profile!
gbmatt 6y ago
if the doj, etc. breaks google's stranglehold on search ads up into 2 or more independent search ad companies, then other non-big-tech search engines might have a chance at bidding for some of the 'default' provider lists for cell phones, browsers, etc. but as it is right now, google does not allow their search ads to be displayed on other search engines' search results. sucks!
codezero 6y ago
I did a lot of work on the community at Quora and my low-effort hot take is that subject matter experts don't get paid enough to do that kind of work, so you get grad students or hobbyists who put in effort while they are unemployed, but fizzle off when not, and they boil away leaving only the obsessive folks with an axe to grind. That's a problem to solve as well, but I think it could be solved if those subject matter experts were part of your business model and they were paid in some meaningful way.

kar5pt 6y ago

Am I missing something about duckduckgo? I was under the impression it already serves the function of providing privacy-focused search. Is it not as private as I thought it was?

gbmatt 6y ago
when you do a query on ddg they have access to your IP address AND your query. so you have to trust ddg quite a bit, and trust the people that work there. But if you use private.sh, no single entity has access to BOTH your query and your IP address. so it just provides more privacy than ddg.
- bawolff 6y ago
  That's marketing bullshit. Private.sh has no more garuntees than ddg
  - rasengan 6y ago
    DDG is a great search engine. I trust they do not log and maintain privacy. One entity needs to be trusted. That being said, with the private.sh offering, it requires two entities to collude to identify users. Thus, it does provide more guarantees than DDG.
    - bawolff 6y ago
      Private.sh can identify users without any help because it controlls the encryption code. You only need 2 entities to collude if private.sh is acting honestly. If they are colluding you have already assumed they are not acting honestly.
      - rasengan 6y ago
        If you use the Firefox and Chrome extension [1] you do not need to trust that the encryption code is broken. [1] https://private.sh/extension.html https://private.sh/extension.html

deleted 6y ago

[deleted]

hjek 6y ago

This requires non-free JavaScript[0] to even post a search query, doesn't it? The FF add-on[1] specifies "Custom License" without specifying which one. [0] https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html [1] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...

drivebycomment 6y ago

As https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/, anonymity is always a double-edged sword and this will get taken advantage of by abusers. So we'll have to see if this can survive when abusers start taking advantage of it. This is a difficult problem...

bawolff 6y ago
Its a read-only search box. What exactly do you think the trouble will be?

Imnimo 6y ago

I tried a query I searched for yesterday at work: "opengl python glclipplane". Google gives me the documentation page, two example pages (which are near duplicates), and then some relevant Stackoverflow questions. Private.sh gives me the website homepage for OpenGL, some totally irrelevant links into the PyOpenGL documentation (other modules, etc., not the one I searched for), and the Wikipedia page for OpenGL. It's cool that it's private, but I could pipe my searches to /dev/null and that'd be pretty private too. If I can't get a useable result, who cares?

gbmatt 6y ago
gigablast coder here. i noticed if you search for 'pyopengl glclipplane' it gets it. ('python' does not occur anywhere on the page!) i think this is a synonym issue. 'opengl python' should be synonymous with 'pyopengl'. i think google gets this because they have billions of queries from which to derive synonyms. i'll be adding more synonyms to gigablast over time and hope to close this synonym gap. that being said, i think 90% of the bad search results come from the index being too small (straight up lacking the best web page), or not having good enough synonyms.
- Imnimo 6y ago
  While that's a reasonable explanation, the top result from private.sh (the opengl.org homepage) also does not include "python" anywhere on the page. I would expect the top result to at least be something relevant to glclipplane. I think this is both an issue of retrieval but also of ranking - the opengl homepage is a very generic result which is unlikely to have much salience to a query with other specific search terms.

Hitton 6y ago

So instead of: I trust DDG not to track me. it's: I trust Private.sh to not give Gigablast my IP to track me.

rasengan 6y ago
Yes. A comparison would be single-key versus multi-key authentication.

upofadown 6y ago

I found the "How it works" section somewhat confusing. I don't know what is meant by "your search term is encrypted using the Search Provider’s public key". Does this mean that the search provider has some simple encryption interface other than TLS?

rasengan 6y ago
Great question. If you review the javascript, NaCl is used to encrypted the search query before giving it to private.sh. Thus, private.sh is unable to decrypt your search. The search provider uses NaCl to decrypt the search query and then encrypts the results before passing it back. The results are then only able to be decrypted by the browser, client side.

upofadown 6y ago

This seems like an odd use of the term "end to end encrypted". This seems to be primarily some sort of proxy scheme. If this is considered "end to end encryption" then why do we not consider any use of a proxy "end to end encryption"? Normally that term is used in messaging between two people to identify a system that puts the identity management and the control of the cryptographic keys under the exclusive control of those users. That is certainly not true in this case.

rasengan 6y ago
This is absolutely end to end encrypted. A proxy can only strip the IP. The NaCl client side encryption deployed on private.sh is what makes this end to end. The client encrypts the search query with the public key of gigablast. The proxy proxies the encrypted payload to gigablast. Gigablast decrypts the payload, performs the search and encrypts the results with the client's public key which is included in the encrypted payload. Then, Gigablast passes the encrypted results payload back through the proxy to the end user who is able to decrypt the payload and display the results. In conclusion, the proxy (private.sh) knows your IP, but not your search query. The search provider (gigablast) knows your search query but not your IP. Hope this is clear!
- spullara 6y ago
  End-to-end encrypted means that Gigablast wouldn't see the search query or the results only the service and the searcher would see them. For example, Signal is end-to-end encrypted. Signal servers do not see your messages. Edit: this was addressed in the comments. The end-to-end is between the client and Gigablast. Private.sh is the Signal server and it cannot see the request or response.
  - rasengan 6y ago
    End to end encrypted means this here: [Client] ---> [Private.sh] ---> [Gigablast] In the above diagram, [Private.sh] cannot see the search query. Thus, it's end to end encrypted. Private.sh is the "signal server" in this case. It works because the actual client, in this case, is the javascript running client-side on the web browser. Your browser encrypts the query, clientside, before sending it to private.sh. All private.sh does is strips the IP away before sending it to gigablast. Hope this is more clear!

jedberg 6y ago

How do I know Gigablast (the search provider) and Private.sh (the proxy provider) aren't colluding to de-anonymize the request?

rasengan 6y ago
It's not a trustless solution, but one that requires multiple parties to collude to break trust as opposed to in most search engines cases, just one. In other words, if "Search Engine Company" wants to deanonymize and link your search with your query, they can. If Private.sh or Gigablast want to, the two separate entities will have to collude. This isn't zero-trust, but it's absolutely 'lesser trust' than the current offerings outside of Private.sh.
- jedberg 6y ago
  > This isn't zero-trust, but it's absolutely 'lesser trust' than the current offerings outside of Private.sh. In what way? How do I know the two owners of the companies aren't the same person? Heck, how do I know that Private.sh isn't just a Google spinoff? There's absolutely nothing that guarantees that Private.sh and Gigablast aren't the same person or the same company. I'd say it's the same level of trust as DDG or Google.

crosser 6y ago

private.sh is not saying if the client's key pair is rotated, and if so, how often. If it is not rotated, search provider can correlate requests coming from the same user and learn a lot about them.