7 ms·

Using the term "end to end" feel a little off to me in this solution since one of the "end"s is the search engine service. If encryption is just through TLS ho

Using the term "end to end" feel a little off to me in this solution since one of the "end"s is the search engine service. If encryption is just through TLS how is this different than just sending your normal https based searches through a VPN or TOR?

jdxcode 6y ago
I don’t understand either. It says private.sh can’t see your query but the “search provider” can, so that’s the other end. What the heck is a search provider though? EDIT: looks like it’s “gigablast”. I don’t understand why I just wouldn’t use that search engine directly?
- prophesi 6y ago
  It encrypts the query with the public key of the search provider (Gigablast) then sends it over to https://search.private.sh/v2/search https://search.private.sh/v2/search which then supposedly goes through a few proxies before finally hitting Gigablast, wherein the search query is decrypted by Gigablast's private key. The point is that Gigablast doesn't know details about the user (though I'm not sure why private.sh's servers can't just forward the IP), and private.sh doesn't know what search query was sent (which, if you're using the extension and disable auto-updates, you can verify that this is actually the case. The code is short and readable.)
- Nightshaxx 6y ago
  The whole idea of the product is it strips your IP address.
rasengan 6y ago
Thanks for taking a look, and that's a great question. The search is both end to end encrypted and private. In the sense of end to end, if you rely on TLS alone and send your query directly to the search engine, your IP will be attached to said query and thus your search and identity are coupled. In private.sh, it's both end to end and private: 1. We utilize client-side javascript encryption prior to routing a search thru a proxy. 2. The proxy cannot read the query, and simply forwards it to the search engine. 3. The search engine decrypts, performs the search, and encrypts the results which are sent back thru the proxy (who, again, cannot even read the results). 4. The results are decrypted client-side. Thus, your search query and identity are decoupled.
- deanclatworthy 6y ago
  If you're going to rely on any client-side javascript please use subresource integrity for all your assets.
  - speedgoose 6y ago
    If TLS is compromised, you cannot trust the subresource subresource integrity checksums. It's better than nothing but there is no good solution.
    - blueplanet200 6y ago
      Indeed, if TLS is compromised many security guarantees of the web break down.
    - bawolff 6y ago
      Which is why this whole exercise is a bunch of snake oil. You can't have better than TLS security when TLS is the weakest link.
      - blueplanet200 6y ago
        This is just plain false. This search engine is advertising anonymity. You don't get that when searching Google, which is encrypted with TLS...
    - rasengan 6y ago
      Our solution here is our extensions [1][2] which are hosted and served by google and mozilla (third parties). [1] https://chrome.google.com/webstore/detail/privatesh-private-search/fcehiiknopcbcdnpakbeipijiiceobnl https://chrome.google.com/webstore/detail/privatesh-private-... [2] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...
- lucb1e 6y ago
  That's very similar to what Tor does. And since both parts are under control of the same actor, it's not very different from, well, not doing it. But too often ideas are shot down because they're not "helpful enough" or something. I shouldn't be too critical! It's great to see someone working privacy in the search space beyond tech that is already there. Having tor-like anonymity without needing to use a special browser and slow network is definitely an advantage, perhaps we can iterate upon the design later (somehow introduce user-run proxies so that the search server really cannot know who sent the request? Somehow make the javascript reload only every once in a while, so you can't silently change it for everyone at once as an attacker? People monitoring the subresource integrity tags for unexpected changes? I don't know). I'll be curious to see where this takes us!
shuntress 6y ago
Under "How Does It Work?": Every single search request from our website and extension is encrypted locally on the client and proxied through our service, stripping away your public IP address ensuring that only the search provider is able to decrypt and see your query without any knowledge of who you are. This is vague. It seems like it just means: "we have a TLS certificate and will be a proxy between you and Google"
- threwawasy1228 6y ago
  That is what the authors stated means in practice, so your assessment is correct. This seems trivial, like I can just use an onion router for this.
  - rasengan 6y ago
    It's a bit different, since if you only use a TLS certificate, you'd still be able to see the query. That said, I agree, you could absolutely do the same with an onion router. This simply provides the benefit without having to do so.
    - threwawasy1228 6y ago
      I was being a bit harsh offhandedly. If I was making a full assessment of the product I would say that it has a market. You can't really do what I'm talking about with the tor onion router, because google blocks tons of tor traffic from accessing its services and wont even let you do a captcha cloudflare-style a lot of the time. As someone who uses tor everyday, you basically can't get any higher quality general purpose search than duckduckgo or searx to actually load over onion routing. If you position yourself in such a way that your results engine returns queries on par with those two (or preferably better) you will have a rock solid product in your hands.
      - rasengan 6y ago
        Thank you so much for the comments! I totally agree with you!

jdxcode 6y ago

I don’t understand either. It says private.sh can’t see your query but the “search provider” can, so that’s the other end. What the heck is a search provider though? EDIT: looks like it’s “gigablast”. I don’t understand why I just wouldn’t use that search engine directly?

prophesi 6y ago
It encrypts the query with the public key of the search provider (Gigablast) then sends it over to https://search.private.sh/v2/search https://search.private.sh/v2/search which then supposedly goes through a few proxies before finally hitting Gigablast, wherein the search query is decrypted by Gigablast's private key. The point is that Gigablast doesn't know details about the user (though I'm not sure why private.sh's servers can't just forward the IP), and private.sh doesn't know what search query was sent (which, if you're using the extension and disable auto-updates, you can verify that this is actually the case. The code is short and readable.)
Nightshaxx 6y ago
The whole idea of the product is it strips your IP address.

rasengan 6y ago

Thanks for taking a look, and that's a great question. The search is both end to end encrypted and private. In the sense of end to end, if you rely on TLS alone and send your query directly to the search engine, your IP will be attached to said query and thus your search and identity are coupled. In private.sh, it's both end to end and private: 1. We utilize client-side javascript encryption prior to routing a search thru a proxy. 2. The proxy cannot read the query, and simply forwards it to the search engine. 3. The search engine decrypts, performs the search, and encrypts the results which are sent back thru the proxy (who, again, cannot even read the results). 4. The results are decrypted client-side. Thus, your search query and identity are decoupled.

deanclatworthy 6y ago
If you're going to rely on any client-side javascript please use subresource integrity for all your assets.
- speedgoose 6y ago
  If TLS is compromised, you cannot trust the subresource subresource integrity checksums. It's better than nothing but there is no good solution.
  - blueplanet200 6y ago
    Indeed, if TLS is compromised many security guarantees of the web break down.
  - bawolff 6y ago
    Which is why this whole exercise is a bunch of snake oil. You can't have better than TLS security when TLS is the weakest link.
    - blueplanet200 6y ago
      This is just plain false. This search engine is advertising anonymity. You don't get that when searching Google, which is encrypted with TLS...
  - rasengan 6y ago
    Our solution here is our extensions [1][2] which are hosted and served by google and mozilla (third parties). [1] https://chrome.google.com/webstore/detail/privatesh-private-search/fcehiiknopcbcdnpakbeipijiiceobnl https://chrome.google.com/webstore/detail/privatesh-private-... [2] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...
lucb1e 6y ago
That's very similar to what Tor does. And since both parts are under control of the same actor, it's not very different from, well, not doing it. But too often ideas are shot down because they're not "helpful enough" or something. I shouldn't be too critical! It's great to see someone working privacy in the search space beyond tech that is already there. Having tor-like anonymity without needing to use a special browser and slow network is definitely an advantage, perhaps we can iterate upon the design later (somehow introduce user-run proxies so that the search server really cannot know who sent the request? Somehow make the javascript reload only every once in a while, so you can't silently change it for everyone at once as an attacker? People monitoring the subresource integrity tags for unexpected changes? I don't know). I'll be curious to see where this takes us!

shuntress 6y ago

Under "How Does It Work?": Every single search request from our website and extension is encrypted locally on the client and proxied through our service, stripping away your public IP address ensuring that only the search provider is able to decrypt and see your query without any knowledge of who you are. This is vague. It seems like it just means: "we have a TLS certificate and will be a proxy between you and Google"

threwawasy1228 6y ago
That is what the authors stated means in practice, so your assessment is correct. This seems trivial, like I can just use an onion router for this.
- rasengan 6y ago
  It's a bit different, since if you only use a TLS certificate, you'd still be able to see the query. That said, I agree, you could absolutely do the same with an onion router. This simply provides the benefit without having to do so.
  - threwawasy1228 6y ago
    I was being a bit harsh offhandedly. If I was making a full assessment of the product I would say that it has a market. You can't really do what I'm talking about with the tor onion router, because google blocks tons of tor traffic from accessing its services and wont even let you do a captcha cloudflare-style a lot of the time. As someone who uses tor everyday, you basically can't get any higher quality general purpose search than duckduckgo or searx to actually load over onion routing. If you position yourself in such a way that your results engine returns queries on par with those two (or preferably better) you will have a rock solid product in your hands.
    - rasengan 6y ago
      Thank you so much for the comments! I totally agree with you!