3 ms·
I like the blog post, but I think that it is somewhat unfair against DDG since the argument works against any internet company. The argument rests essentially o
by yk 13y ago
I like the blog post, but I think that it is somewhat unfair against DDG since the argument works against any internet company. The argument rests essentially on two points:
1. Client/Server architecture has a single point of failure, namely the server. ( Or the network equipment directly upstream of the server.) So that whatever nasty surprise is embedded directly at the server, or in the jurisdiction the server is in, affects whoever is using the server.
2. We do not have a treat model for the NSA, they are somewhere between a usual state level attacker and Cthulhu. We do not really know, what the NSA can or can not do, can they crack the discrete log or factor large numbers? Or do they 'just' have a assorted 0day collection? Is it realistic that they can coerce anyone into revealing public keys? And if they can actually break TLS, can they also break all TLS or does this require some not insubstantial effort on their part?
So both of these are real problems and the combination is potentially undermining the trust into the entire internet. But it is not really about DDG.
- nmcfarl 13y ago"We do not have a threat model for the NSA, they are somewhere between a usual state level attacker and Cthulhu" just about made my day! Awesome description.
- MarkHarmon 13y ago"... it is somewhat unfair against DDG since the argument works against any internet company" What other search engines are being suggested for use as a safer alternative to the major search engines? Did any of those companies respond by affirming their ability to protect your privacy in a way that is not technically possible? The author's point is that you can't dodge the NSA's scrutiny, and if you think you can then you are either lying or uneducated about the NSA's capabilities. UPDATE: What I'm trying to say is that the article doesn't really work when directed at Google or Yahoo because we already know that our privacy is compromised there.
- Amarok 13y agoWhat about startpage? I know they're still dependent on google, but in terms of privacy they seem to be at the same level as DDG. At least they're smaller than DDG, so it's less likely that the NSA will bother with them
- MarkHarmon 13y agoWe need a definitive answer on whether PFS is truly perfect. If ssl->vpn->https->anon-dns->tor->tls2->no-logging-search is safe then our searches for weird porn might be private.
- rfctr 13y agoThe post is not against DDG. It is against the unreasonable expectations for privacy when using DDG.