6 ms·

Trying to use Kagi with other browsers lays bare the depth of collusion between browser makers and search providers. Getting out from under all that makes Kagi

Trying to use Kagi with other browsers lays bare the depth of collusion between browser makers and search providers. Getting out from under all that makes Kagi a whole lot more seamless and useful. It’s ironic that it is its own tight collusion, with the difference that you can use Orion just as well with any other search providers as with Kagi. So yeah, it seems like a departure from search, until you consider that for the features that make Kagi a worthwhile search product (privacy, neutrality, etc), “you can’t get there from here” with the other browsers.

lurk2 2y ago
> (privacy, neutrality, etc) It's proprietary. There's no way of knowing that it's private.
- saagarjha 2y ago
  If only we had a field of computer science dedicated to analyzing the security properties of black boxes…
  - kerkeslager 2y ago
    I'm curious how you think this can be analyzed effectively. Yes, I'm aware of bytecode analysis, but that's a slow difficult process, and for browsers, the release cycle is short enough that by the time you're done analyzing the current version, a new version is out, and it's significantly harder and less useful to diff a binary, so you end up having to basically start the analysis over for the new version. Unless there's something going on here that I don't know of, that's simply not a viable means of keeping track of browser security.
    - saagarjha 2y ago
      Evaluating browser security is hard. Checking privacy guarantees is easy: you can just look at the traffic it generates. Vlad has a pretty simple and quite strong policy that Kagi doesn’t phone home unless you agree to it. If you find it does otherwise (should be pretty easy to monitor) you should take it up with him.
      - kerkeslager 2y ago
        This is completely wrong. Malicious software has a long history of detecting monitoring so it can avoid detection. A closed-source browser with backdoors can detect Wireshark, Little Snitch, or whatever you're using to detect outgoing connections, and not connect while those programs are running. The problem is even more insidious when you're making regular expected connections to a site that the browser creator controls. Many (most?) Orion users are already connecting to Kagi on a regular basis, so they can simply wait until the user logs in to Kagi and smuggle out the data they've collected along with the login request. In the most extreme case, the browser can not exfiltrate any data at all unless triggered to do so. In this case, the attacker targets specific victims to exfiltrate data from, but avoids exfiltrating from any security researchers or knowledgeable users who might be running software to detect the exfiltration. In short, the goal here is for those of us with more knowledge to be able to verify the software for every user, because not everyone is capable of monitoring their outgoing traffic effectively, and it's far too easy for backdoored software to simply not phone home when it's being monitored.
        saagarjha 2y ago
        This is true of open source software too. At some point you have to trust that the software you run is not designed to act like malware, because if it is actually backdoored your life is going to be miserable regardless.
        kerkeslager 2y ago
        Huh? It's not true of open source software at all. With open source software, you can read the source and verify that it doesn't have backdoors. With reproducible builds, you can verify that distributed binaries are the result of building the source code you've verified. Honestly, if you couldn't figure out that this was going to be my response, you simply don't have the knowledge to be commenting on this topic. I didn't come up with anything I've said here myself, it's pretty basic, widely agreed-upon understanding of why open source is generally more secure. The only people who actually know the topic who "disagree" on this generally have a vested interest in some closed-source software they want to be seen as secure.
chias 2y ago
This is something I don't understand. Kagi has been my only search engine since they dropped the price to $10/mo. I've only ever used Kagi with Firefox, and I use it on Linux, Windows, and Mac. I just add it to my search engines and set it as default, which takes about 15 seconds. Everything seems to just work seamlessly. Searching in private windows works without any configuration or token juggling. I have never tried the Orion browser or the extension because I don't understand the problem that they allegedly solve.
- malnourish 2y ago
  I use Kagi at work in Firefox and Edge with no issues. I use it at home with Firefox and Chrome (Windows 10) and Iceraven on Android. No issues.
  - deleted 2y ago
    [deleted]
  - SSLy 2y ago
    Yet the list of search engines in iOS Safari is locked and I can't add my own.
    - belmont_sup 2y ago
      I had to install the Kagi for Safari app on iOS. This lets me install the extension and switch it to on my phone.
      - SSLy 2y ago
        that extension intercepts the queries. Kagi couldn't make it any other way. And I don't mean this as a grievance against Kagi, but agains APPL's policies.
- treesknees 2y ago
  To set it as your default search engine on iOS, you need to first install a separate Kagi Search app from the App Store, enable the extension, and then dig through some fairly obscure Safari settings so that the Kagi app can run with enough permissions to intercept/redirect search URLs for other search engines. So now when I search in Safari, the browser says “DuckDuckGo Search” but when I hit return Kagi jumps in. I also had to turn off search suggestions because those (as far as I know) would still come from DDG.
deleted 2y ago
[deleted]
lxgr 2y ago
> Trying to use Kagi with other browsers lays bare the depth of collusion between browser makers and search providers. Absolutely. Safari not offering any way to add Kagi without weird hacks or extensions is absurd. I get the case for search engines paying browser vendors a cut for being the default, but still getting paid after the user has overridden that selection is already somewhat dubious, and not allowing the user to fully provide their own query URL at all should be illegal.
handsclean 2y ago
It’s Safari you’re talking about. All other browsers, even Chrome, support arbitrary default search engines, while Safari doesn’t even support them via extension, requiring ugly redirect hacks. Privacy Pass is similar, with all browsers letting you implement it as an extension, except Safari. The problem is entirely and only Safari.

lurk2 2y ago

> (privacy, neutrality, etc) It's proprietary. There's no way of knowing that it's private.

saagarjha 2y ago
If only we had a field of computer science dedicated to analyzing the security properties of black boxes…
- kerkeslager 2y ago
  I'm curious how you think this can be analyzed effectively. Yes, I'm aware of bytecode analysis, but that's a slow difficult process, and for browsers, the release cycle is short enough that by the time you're done analyzing the current version, a new version is out, and it's significantly harder and less useful to diff a binary, so you end up having to basically start the analysis over for the new version. Unless there's something going on here that I don't know of, that's simply not a viable means of keeping track of browser security.
  - saagarjha 2y ago
    Evaluating browser security is hard. Checking privacy guarantees is easy: you can just look at the traffic it generates. Vlad has a pretty simple and quite strong policy that Kagi doesn’t phone home unless you agree to it. If you find it does otherwise (should be pretty easy to monitor) you should take it up with him.
    - kerkeslager 2y ago
      This is completely wrong. Malicious software has a long history of detecting monitoring so it can avoid detection. A closed-source browser with backdoors can detect Wireshark, Little Snitch, or whatever you're using to detect outgoing connections, and not connect while those programs are running. The problem is even more insidious when you're making regular expected connections to a site that the browser creator controls. Many (most?) Orion users are already connecting to Kagi on a regular basis, so they can simply wait until the user logs in to Kagi and smuggle out the data they've collected along with the login request. In the most extreme case, the browser can not exfiltrate any data at all unless triggered to do so. In this case, the attacker targets specific victims to exfiltrate data from, but avoids exfiltrating from any security researchers or knowledgeable users who might be running software to detect the exfiltration. In short, the goal here is for those of us with more knowledge to be able to verify the software for every user, because not everyone is capable of monitoring their outgoing traffic effectively, and it's far too easy for backdoored software to simply not phone home when it's being monitored.
      - saagarjha 2y ago
        This is true of open source software too. At some point you have to trust that the software you run is not designed to act like malware, because if it is actually backdoored your life is going to be miserable regardless.
        kerkeslager 2y ago
        Huh? It's not true of open source software at all. With open source software, you can read the source and verify that it doesn't have backdoors. With reproducible builds, you can verify that distributed binaries are the result of building the source code you've verified. Honestly, if you couldn't figure out that this was going to be my response, you simply don't have the knowledge to be commenting on this topic. I didn't come up with anything I've said here myself, it's pretty basic, widely agreed-upon understanding of why open source is generally more secure. The only people who actually know the topic who "disagree" on this generally have a vested interest in some closed-source software they want to be seen as secure.

chias 2y ago

This is something I don't understand. Kagi has been my only search engine since they dropped the price to $10/mo. I've only ever used Kagi with Firefox, and I use it on Linux, Windows, and Mac. I just add it to my search engines and set it as default, which takes about 15 seconds. Everything seems to just work seamlessly. Searching in private windows works without any configuration or token juggling. I have never tried the Orion browser or the extension because I don't understand the problem that they allegedly solve.

malnourish 2y ago
I use Kagi at work in Firefox and Edge with no issues. I use it at home with Firefox and Chrome (Windows 10) and Iceraven on Android. No issues.
- deleted 2y ago
  [deleted]
- SSLy 2y ago
  Yet the list of search engines in iOS Safari is locked and I can't add my own.
  - belmont_sup 2y ago
    I had to install the Kagi for Safari app on iOS. This lets me install the extension and switch it to on my phone.
    - SSLy 2y ago
      that extension intercepts the queries. Kagi couldn't make it any other way. And I don't mean this as a grievance against Kagi, but agains APPL's policies.
treesknees 2y ago
To set it as your default search engine on iOS, you need to first install a separate Kagi Search app from the App Store, enable the extension, and then dig through some fairly obscure Safari settings so that the Kagi app can run with enough permissions to intercept/redirect search URLs for other search engines. So now when I search in Safari, the browser says “DuckDuckGo Search” but when I hit return Kagi jumps in. I also had to turn off search suggestions because those (as far as I know) would still come from DDG.

deleted 2y ago

[deleted]

lxgr 2y ago

> Trying to use Kagi with other browsers lays bare the depth of collusion between browser makers and search providers. Absolutely. Safari not offering any way to add Kagi without weird hacks or extensions is absurd. I get the case for search engines paying browser vendors a cut for being the default, but still getting paid after the user has overridden that selection is already somewhat dubious, and not allowing the user to fully provide their own query URL at all should be illegal.

handsclean 2y ago

It’s Safari you’re talking about. All other browsers, even Chrome, support arbitrary default search engines, while Safari doesn’t even support them via extension, requiring ugly redirect hacks. Privacy Pass is similar, with all browsers letting you implement it as an extension, except Safari. The problem is entirely and only Safari.