4 ms·

You can use the private.sh extension [1][2] to ensure that private.sh isn't doing anything fishy. The public key of Gigablast is hardcoded in and the assets ar

You can use the private.sh extension [1][2] to ensure that private.sh isn't doing anything fishy. The public key of Gigablast is hardcoded in and the assets are served by a third party. [1] https://chrome.google.com/webstore/detail/privatesh-private-search/fcehiiknopcbcdnpakbeipijiiceobnl https://chrome.google.com/webstore/detail/privatesh-private-... [2] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...

jedberg 6y ago
I still have to trust that Private.sh isn't working with Gigablast to de-anonimize the request.
- rasengan 6y ago
  That's true. This is the same as Tor in the sense that if multiple parties collude, you can be de-anonymized.
  - e12e 6y ago
    It's different from TOR in that only two parties need to collude, though.
codezero 6y ago
Not that you need to, but you could also protect your client-side JavaScript with some tight CSP rules as well as a nonce that you publish and keep verified as changes are made. This won't affect normal users, but technical people who care can check.
- rasengan 6y ago
  That's a good suggestion. Thank you!