3 ms·

Search without Google Tracking You (My 'pseudo' Startup)

5 points by drm237 19y ago

There's been a lot in the news lately about search engine privacy, so I thought for a quick project it might be interesting to make a site that doesn't allow the search engines to track you. It's still alpha quality, but please take a look and give me some feedback. Thanks. http://www.flyvault.com/safesearch http://www.flyvault.com/safesearch

drm237 19y ago
It may be worth noting that the iframe you see when you search is not google, but google's results served from our site. Of course, if we just showed google in an iframe, it wouldn't do anything for privacy.
- amichail 19y ago
  Why is this legal? I thought Google no longer has a search api.
  - drm237 19y ago
    The thing is, we're not making money from it in any way (which is why I call it a pseudo' startup), and because of that fair use can apply. Also, think about google. They scrape the entire web and profit by serving that as content...
    - cedsav 19y ago
      Fair use certainly doesn't apply. You're using Google search technology (which btw, involves a bit more than 'scraping' the web) and stripping out the ads (their source of revenue). Expect a cease and desist letter soon.
      - paulgb 19y ago
        Fair use doesn't apply, but if you can get your hands on an old API key it will still work. I built something similar (here: http://www.paulbutler.org/archives/endless-google-search/ http://www.paulbutler.org/archives/endless-google-search/) and I just used an old Google API key, so I don't violate their TOS. It makes me wonder though, since you can't make any money with it, how do you plan to pay for hosting fees? Surely you eventually intend to profit, what will you do then?
        drm237 19y ago
        Correct me if I'm wrong, but isn't the API is limited to 1000 searches per day correct? No, I don't plan on profiting from this. This is a very low impact system and I don't mind footing the bill for the hosting costs as long as it's of value to the community.
        paulgb 19y ago
        I see, good work then. You're right, I forgot about the API limit.
- davidw 19y ago
  Isn't that against their terms of service or something? How's this different/better from some kind of anonymizing proxy like tor?
  - drm237 19y ago
    With things like tor, it can be a little slower, especially if you just want to do a single search. With this, we've added in the feature so you can add it to your Firefox/IE7 search box and then easily use it right from the browser. So it's the same idea, we're just focusing on this one feature for the good of the community. The other feature we have is endless scrolling, so if you search and can't find it in the first few results, you can just keep scrolling and we'll continue to populate it. That's something not many others have.
nickb 19y ago
Awesome! It's better, faster, nicer looking than Scroogle.org
bls 19y ago
Instead of giving our private information to Google to use for 18 months, we are giving it to you to use indefinitely? Where is your privacy policy? And, what is your hosting provider's policy? I found out recently that my hosting provider refused to make any guarantees; that means that I cannot make any guarantees either, since my hosting provider has full access to my server.
- drm237 19y ago
  A privacy policy is very high on my list of things to do, along with an explanation of how it works so that people can feel confident in their privacy. Right now, the only thing I record is a SHA1 has of everyone's IP address and a timestamp so that I can track how many unique people have used it. With the SHA1 hash, there's no (very difficult) way to trace that back to the user. I'm also talking to my host about the web server logs and how quickly those can be purged.
  - fadmmatt 19y ago
    I hope that's SHA1 plus a secret salt. Otherwise, I can just build a reverse map of SHA1'd ips. for ip = 0 to 2^32: unhash[SHA1(ip)] = ip.
    - drm237 19y ago
      Yes it is. But first you'd have to get all of the results from my database, which is cleared every 24 hours (this is not a challenge!).
  - jsjenkins168 19y ago
    Can you use a SHA-2 hash instead? Those variants are considerably more difficult to break. A problem I see with your service compared to an anonymizing proxy like Tor is that you are still a single point of failure(please correct me if I'm wrong though). If you were legally forced to turn over search records (as the govt was attempting with google a while back), then the requests could be traced directly back to the user. You mention clearing the database daily which is a good idea. But again if it was compromised and a snap shot could be taken, then a brute force crack of your SHA-1 hashes would be possible. Basically, everyone is trusting the security of your database. A misdirection service which telescopes the request through interconnected proxies will not have this single point of failure issue. Not criticizing your implementation, just making some observations. I think this is a great idea. Mainly your site is so easy for people to use, not needing to install a client application.
tomek 19y ago
It's a nice initiative. You have probably heard of Scroogle (http://www.scroogle.org/cgi-bin/scraper.htl http://www.scroogle.org/cgi-bin/scraper.htl). How different is your thing from their thing?
- drm237 19y ago
  They're very similar. The difference is that I like our interface better and we provide unlimited scrolling of the results. If people like the site and want to use it, I'm also planning on adding other search engines. For the most part, it's been an experiment on my part to have a public site that people use. I've built quite a few sites, but this is the first with AJAX and some other technologies, so it's been a learning project for me as well.
deleted 19y ago
[deleted]

5 points by drm237 19y ago

drm237 19y ago

It may be worth noting that the iframe you see when you search is not google, but google's results served from our site. Of course, if we just showed google in an iframe, it wouldn't do anything for privacy.

amichail 19y ago
Why is this legal? I thought Google no longer has a search api.
- drm237 19y ago
  The thing is, we're not making money from it in any way (which is why I call it a pseudo' startup), and because of that fair use can apply. Also, think about google. They scrape the entire web and profit by serving that as content...
  - cedsav 19y ago
    Fair use certainly doesn't apply. You're using Google search technology (which btw, involves a bit more than 'scraping' the web) and stripping out the ads (their source of revenue). Expect a cease and desist letter soon.
    - paulgb 19y ago
      Fair use doesn't apply, but if you can get your hands on an old API key it will still work. I built something similar (here: http://www.paulbutler.org/archives/endless-google-search/ http://www.paulbutler.org/archives/endless-google-search/) and I just used an old Google API key, so I don't violate their TOS. It makes me wonder though, since you can't make any money with it, how do you plan to pay for hosting fees? Surely you eventually intend to profit, what will you do then?
      - drm237 19y ago
        Correct me if I'm wrong, but isn't the API is limited to 1000 searches per day correct? No, I don't plan on profiting from this. This is a very low impact system and I don't mind footing the bill for the hosting costs as long as it's of value to the community.
        paulgb 19y ago
        I see, good work then. You're right, I forgot about the API limit.
davidw 19y ago
Isn't that against their terms of service or something? How's this different/better from some kind of anonymizing proxy like tor?
- drm237 19y ago
  With things like tor, it can be a little slower, especially if you just want to do a single search. With this, we've added in the feature so you can add it to your Firefox/IE7 search box and then easily use it right from the browser. So it's the same idea, we're just focusing on this one feature for the good of the community. The other feature we have is endless scrolling, so if you search and can't find it in the first few results, you can just keep scrolling and we'll continue to populate it. That's something not many others have.

nickb 19y ago

Awesome! It's better, faster, nicer looking than Scroogle.org

bls 19y ago

Instead of giving our private information to Google to use for 18 months, we are giving it to you to use indefinitely? Where is your privacy policy? And, what is your hosting provider's policy? I found out recently that my hosting provider refused to make any guarantees; that means that I cannot make any guarantees either, since my hosting provider has full access to my server.

drm237 19y ago
A privacy policy is very high on my list of things to do, along with an explanation of how it works so that people can feel confident in their privacy. Right now, the only thing I record is a SHA1 has of everyone's IP address and a timestamp so that I can track how many unique people have used it. With the SHA1 hash, there's no (very difficult) way to trace that back to the user. I'm also talking to my host about the web server logs and how quickly those can be purged.
- fadmmatt 19y ago
  I hope that's SHA1 plus a secret salt. Otherwise, I can just build a reverse map of SHA1'd ips. for ip = 0 to 2^32: unhash[SHA1(ip)] = ip.
  - drm237 19y ago
    Yes it is. But first you'd have to get all of the results from my database, which is cleared every 24 hours (this is not a challenge!).
- jsjenkins168 19y ago
  Can you use a SHA-2 hash instead? Those variants are considerably more difficult to break. A problem I see with your service compared to an anonymizing proxy like Tor is that you are still a single point of failure(please correct me if I'm wrong though). If you were legally forced to turn over search records (as the govt was attempting with google a while back), then the requests could be traced directly back to the user. You mention clearing the database daily which is a good idea. But again if it was compromised and a snap shot could be taken, then a brute force crack of your SHA-1 hashes would be possible. Basically, everyone is trusting the security of your database. A misdirection service which telescopes the request through interconnected proxies will not have this single point of failure issue. Not criticizing your implementation, just making some observations. I think this is a great idea. Mainly your site is so easy for people to use, not needing to install a client application.

tomek 19y ago

It's a nice initiative. You have probably heard of Scroogle (http://www.scroogle.org/cgi-bin/scraper.htl http://www.scroogle.org/cgi-bin/scraper.htl). How different is your thing from their thing?

drm237 19y ago
They're very similar. The difference is that I like our interface better and we provide unlimited scrolling of the results. If people like the site and want to use it, I'm also planning on adding other search engines. For the most part, it's been an experiment on my part to have a public site that people use. I've built quite a few sites, but this is the first with AJAX and some other technologies, so it's been a learning project for me as well.

deleted 19y ago

[deleted]