5 ms·
Could you elaborate? I didn't find anything in the change log that made this obvious to me.
by elaus 3y ago
Could you elaborate? I didn't find anything in the change log that made this obvious to me.
- hackideiomat 3y agoHa, exactly! They rarely fix bugs. E.g., XSS / HTML injection in summarizer or discuss document. Or their broken CSP which allows injecting forms to e.g., change settings. They haven't fixed many reported issues in a while, and just to prove I'm not lying: https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fchangelog%3F"><h1>lol https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fcha...
- deleted 3y ago[deleted]
- tmikaeld 3y agoWhile it doesn't look good, it doesn't inject or execute scripts. Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
- hackideiomat 3y agoOh yes because of the CSP. The CSP that allows forms that can change your settings... you could easily use the above bug to get some impact with an additional click on a form's submit button. Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security. It's not the only place you can inject HTML and not every page has a CSP...
- tmikaeld 3y agoI don't get why they allow injection of irrelevant url parameters in the first place, it's the first rule of any input - remove what's not used and sanitize what is.
- WhyNotHugo 3y agoRegarding privacy: an obvious point is that you need to log in to use the search engine, so each search is tied to a unique user. Given that payment is involved, each user can be tied to a real-world identity.
- rcMgD2BwE72F 3y ago>so each search is tied to a unique user Is it? They say searches aren't tied to account: https://help.kagi.com/kagi/privacy/privacy-protection.html#email-address-collection https://help.kagi.com/kagi/privacy/privacy-protection.html#e...
- WhyNotHugo 3y agoThe link says that they do not _log_ the searches tied to accounts, but they do receive enough information to cross reference this data.