4 ms·

They also “do not log searches or in any way tie them to an account”. So you essentially have to make the same leap of faith as you would with a commercial VPN

They also “do not log searches or in any way tie them to an account”. So you essentially have to make the same leap of faith as you would with a commercial VPN.

beej71 3y ago
Or with DDG.
juunpp 3y ago
The VPN doesn't know what I search for, it "only" knows what host I connect to and all the associated metadata.
- wutwutwat 3y ago
  Unless they MITM you and whatever app you’re using doesn’t do cert pinning, or they don’t have a legit root cert that they can sign completely valid certs with
  - hnben 3y ago
    > Unless they MITM you how high would you estimate the odds of this actually happening for lets say mullvad?
    - wutwutwat 3y ago
      How would I know? There’s always a VPN new kid on the block everyone shills for. Used to be that ProtonVPN was our savior now it’s nobody even knows it exists. Point is unless you control every hop in the chain you can’t know it’s safe
  - juunpp 3y ago
    To MITM me they'd need the intermediate or root certs of whatever I am connecting to? I don't see how even pinning the cert would help if the chain is invalid to begin with.
    - wutwutwat 3y ago
      Yes sorry there was a typo in my earlier comment, but that’s what I was saying. If they have a stolen root cert, or are given one, they could produce 100% valid certs and youd never be able to tell they were doing it. I find it hard to believe the root certs of the internet have been kept safe all these years from the intelligence branches of these governments that are at cyber war all the time. I wouldn’t be surprised to one day learn root certificates were willingly given to intelligence branches for “national security” or whatever
Lazare 3y ago
Yes, although if you think about it a bit: With a VPN you're hoping there's no logs at all, and it's pretty easy for a VPN vendor - entirely by accident - to keep some logs around. And then a search warrant lands, they look around, find the logs, and the promise is broken. And it's entirely possible for that to happen by accident. So if I pay for a commercial VPN that claims they don't keep logs, I'm gambling on their honesty and competency. With a search engine you're hoping they don't bias search results to favour advertisers, sell your search results to advertisers, etc. And that's not something you can really do by accident. If Kagi is being honest, then they're not accepting money to modify search results, nor are they logging my searches, or building up a profile of my searches, or modifying seearch results based on that profile, etc. Even if it turned out Kagi goofed and really were logging all my searches and tying them to my payment account (maybe, eg, for perfectly innnocent reasons, like solving a bug), that doesn't actually change their value proposition to me all. They're either super evil and lying about everything they're doing, or they're fine, even if it turns out they're cutting a couple of corners. Kagi is putting themselves in a position which is inherently easier to trust than a VPN vendor (or early Google), due to the nature of the business model.
- reilly3000 3y ago
  What if your searches are about something illegal? Wouldn’t Kagi have to comply with a search warrant? Pun weakly intended.
  - pleb_nz 3y ago
    Don't use Kagi for this instances if you're that way inclined
  - JumpCrisscross 3y ago
    > Wouldn’t Kagi have to comply with a search warrant? You can't find what isn't there. And there is not logging requirement in America. So put simply, no. If you searched for something sinister, and the U.S. government inquired, Kargi would--if they aren't lying--pose no risk to you. If your concern goes beyond that, you're beyond bilateral trust. The concept of a search engine is beyond you.
gdsdfe 3y ago
You have to make multiple leaps of faith at some point nowadays unless you're rebuilding all of the internet

They also “do not log searches or in any way tie them to an account”. So you essentially have to make the same leap of faith as you would with a commercial VPN.

beej71 3y ago

Or with DDG.

juunpp 3y ago

The VPN doesn't know what I search for, it "only" knows what host I connect to and all the associated metadata.

wutwutwat 3y ago
Unless they MITM you and whatever app you’re using doesn’t do cert pinning, or they don’t have a legit root cert that they can sign completely valid certs with
- hnben 3y ago
  > Unless they MITM you how high would you estimate the odds of this actually happening for lets say mullvad?
  - wutwutwat 3y ago
    How would I know? There’s always a VPN new kid on the block everyone shills for. Used to be that ProtonVPN was our savior now it’s nobody even knows it exists. Point is unless you control every hop in the chain you can’t know it’s safe
- juunpp 3y ago
  To MITM me they'd need the intermediate or root certs of whatever I am connecting to? I don't see how even pinning the cert would help if the chain is invalid to begin with.
  - wutwutwat 3y ago
    Yes sorry there was a typo in my earlier comment, but that’s what I was saying. If they have a stolen root cert, or are given one, they could produce 100% valid certs and youd never be able to tell they were doing it. I find it hard to believe the root certs of the internet have been kept safe all these years from the intelligence branches of these governments that are at cyber war all the time. I wouldn’t be surprised to one day learn root certificates were willingly given to intelligence branches for “national security” or whatever

Lazare 3y ago

Yes, although if you think about it a bit: With a VPN you're hoping there's no logs at all, and it's pretty easy for a VPN vendor - entirely by accident - to keep some logs around. And then a search warrant lands, they look around, find the logs, and the promise is broken. And it's entirely possible for that to happen by accident. So if I pay for a commercial VPN that claims they don't keep logs, I'm gambling on their honesty and competency. With a search engine you're hoping they don't bias search results to favour advertisers, sell your search results to advertisers, etc. And that's not something you can really do by accident. If Kagi is being honest, then they're not accepting money to modify search results, nor are they logging my searches, or building up a profile of my searches, or modifying seearch results based on that profile, etc. Even if it turned out Kagi goofed and really were logging all my searches and tying them to my payment account (maybe, eg, for perfectly innnocent reasons, like solving a bug), that doesn't actually change their value proposition to me all. They're either super evil and lying about everything they're doing, or they're fine, even if it turns out they're cutting a couple of corners. Kagi is putting themselves in a position which is inherently easier to trust than a VPN vendor (or early Google), due to the nature of the business model.

reilly3000 3y ago
What if your searches are about something illegal? Wouldn’t Kagi have to comply with a search warrant? Pun weakly intended.
- pleb_nz 3y ago
  Don't use Kagi for this instances if you're that way inclined
- JumpCrisscross 3y ago
  > Wouldn’t Kagi have to comply with a search warrant? You can't find what isn't there. And there is not logging requirement in America. So put simply, no. If you searched for something sinister, and the U.S. government inquired, Kargi would--if they aren't lying--pose no risk to you. If your concern goes beyond that, you're beyond bilateral trust. The concept of a search engine is beyond you.

gdsdfe 3y ago

You have to make multiple leaps of faith at some point nowadays unless you're rebuilding all of the internet