4 ms·
DuckDuckGo privacy: A search engine that doesn’t track its users
- mortehu 13y agoNote that DuckDuckGo doesn't use Diffie-Hellman for its key exchange, so if someone gets ahold of their private keys once, they can decrypt all previously captured traffic as well as all future traffic. It seems they use the same certificates for a year at a time.
- throwaway10001 13y agoYou miss the point: DDG offers just search and doesn't log much. Google for example has another 10 (?) or more data points to connect you with that search, logs as much as they can and they hold it for ages. On Google NSA has to just ask for it, not worry about decrypting it.
- mortehu 13y agoMy point is that you can't have privacy without security. As I mentioned in a past comment[1] you can opt out of having your search history stored, and delete what's currently stored by Google. 1. https://news.ycombinator.com/item?id=5842670 https://news.ycombinator.com/item?id=5842670
- nitrogen 13y agoDoes that actually delete all traces of the search history, or does it only delete a user's view of their "web history?" In other words, if a Google user is later involved in a court case, would a subpoena or a warrant be able to reveal their search history, even if they deleted their "web history"? It would be my expectation that Google still stores all of your search queries, even if you don't have web history enabled.
- mortehu 13y agoDue to techniques like garbage collection, debug logs and full backups, I think it's difficult for huge litigation targets to make blanket statements about deleting user data. edit: Redacted part of the comment to avoid quoting policy out of context.
- nitrogen 13y agoThat says nothing about search history, and "stored" could only refer to the "Web History" feature itself.
- deleted 13y ago[deleted]
- fwdbureau 13y agoIs it really deleted? Or are you simply opting out of having it displayed in your account's page? According to the FAQ, "If you remove items, they will be removed from the service and will not be used to improve your Google experience". Words are important. Your history is removed from the service, not the servers. It won't be used to improve your experience, but nothing says it won't be used for something else
- grey-area 13y agoWhat makes you think that stops google logging what you're doing? They explicitly reserve the right to continue to do so.
- isaacaggrey 13y ago> Note that DuckDuckGo doesn't use Diffie-Hellman for its key exchange, Source?
- mortehu 13y agoOpen https://duckduckgo.com/ https://duckduckgo.com/ in your web browser and click on the green padlock. Note that the certificate is from 2012, and that the key exchange method is RSA.
- js4all 13y agoI never heard about that's a problem. I checked several popular sites, Google, Amazon, Apple, Bank of America. They all use RSA. Do you have examples for secure site (under this aspect) and background info?
- mortehu 13y agoAre you sure? google.com uses ECDHE_RSA here. eta: You also asked for background info. It's been discussed on Hacker News recently: http://en.wikipedia.org/wiki/Perfect_forward_secrecy http://en.wikipedia.org/wiki/Perfect_forward_secrecy
- js4all 13y ago> Are you sure? google.com uses ECDHE_RSA here. You are right about google.com, the others still use RSA. Thanks for the background info. Maybe SSLLabs should take this into account when doing their tests. Until now they make no difference between DH and RSA.
- mortehu 13y agoI just noticed their HTTPS termination point is hosted on Amazon EC2, so the only thing required for extracting the private key or logging the data is a contact at Amazon. No reason to involve DuckDuckGo at all. Since Amazon EC2 hosts are virtual machines, you can just read the machine's RAM and disk from the physical machine it's running on. eta: I don't believe Amazon would agree to do that, or that there is a law allowing anyone to require them to do that.
- salimmadjd 13y agoHas anyone independently verified their claim? What better way to identify "people of interest" than to advertise a site that doesn't track you and then see which people use it and then track them. Talk about solving finding the needle in the hay, let people self-flag themselves.
- m-r-a-m 13y agoTheir main feature is privacy, so if news came out that they were actually tracking users, it would pretty much destroy the business. Given that, it would make @yegg really vulnerable to blackmail by employees.
- salimmadjd 13y agoAgain, I advertise I'm not sharing data and everyone buys up into it without verifying. I have asked friends at Facebook about sharing data with NSA, their response is FB is very transparent and someone would have seen it. So it's very possible they share data and their employees don't know. I hate to use this phrase, trust but verify
- parliament32 13y agoA search engine that claims it doesn't track its users.
- tomwilson 13y agoEvery time I've thought about using ddg instead of google, I last about on day because its not very good :(