PRISM fears give private search engine DuckDuckGo its best week ever

http://venturebeat.com/2013/06/13/prism-fears-give-private-search-engine-duckduckgo-its-best-week-ever/

by tchalla • 13 years ago

459 206 13 years ago

rednukleus• 13 years ago

Glad to see them succeeding, but personally the privacy of my web searches doesn't bother me - as long as they aren't being passed along with personally identifying information. I'm far more worried about emails, messaging, video, storage etc.

Can someone explain to me (or point me in the direction of something that explains) what Google and Bing store in terms of tracking when you are not logged in?

Obviously you can use VPNs or TOR to be really safe, but do you need to go that far if you want an untracked search on Google and Bing?

bcoates2• 13 years ago

They have access to IP+time, your search query, and cookies for correlation to other requests. It's valuable information and Google openly documents that they are keeping and using it, along with anything else you leak to them: http://www.google.com/policies/privacy/

IP+time is enough to get your personal identity information from your ISP (physical location of the endpoint, billing information), I have no idea if Google's relationship with ISPs is good enough to buy that or if it's only available to cops.

jmillikin• 13 years ago

  > They have access to IP+time, your search query, and
  > cookies for correlation to other requests. It's
  > valuable information

Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless.

  > IP+time is enough to get your personal identity
  > information from your ISP (physical location of the
  > endpoint, billing information), I have no idea if
  > Google's relationship with ISPs is good enough to
  > buy that or if it's only available to cops.

Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification.

I hope that ISPs do not release personal identity or billing data to arbitrary third parties. I know my ISP (sonic.net) claims they don't[1], and even privacy-insensitive companies such as AT&T have privacy policies that would forbid them from selling personal data[2].

Even if it were possible for random companies to obtain personal data from an ISP, I doubt that Google would have any interest in participating.

[1] https://wiki.sonic.net/wiki/Category:Policies#Privacy

[2] http://www.att.com/gen/privacy-policy?pid=2506

btian• 13 years ago

Based on the leaked PRISM presentation, they could send your search log to NSA, and NSA can identify you based on your IP address that your ISP provides.

infinity2• 13 years ago

The IP address from which you send your request to a search engines website may be regarded as a personally identifying information. In case that this information becomes publicly available the connection between your search terms and your IP address will be visible. In fact, this has happend in the past and there was a searchable database with the leaked information online where you could look up search terms.

I don't know what data Google and Bing are collecting, but here is one quote from the wikipedia entry on internet privacy concerning the AOL search engine:

A search engine takes all of its users and assigns each one a specific ID number. Those in control of the database often keep records of where on the Internet each member has traveled to. AOL’s system is one example. AOL has a database 21 million members deep, each with their own specific ID number. The way that AOLSearch is set up, however, allows for AOL to keep records of all the websites visited by any given member. Even though the true identity of the user isn’t known, a full profile of a member can be made just by using the information stored by AOLSearch. By keeping records of what people query through AOLSearch, the company is able to learn a great deal about them without knowing their names.

Source: http://en.wikipedia.org/wiki/Internet_privacy

elorant2• 13 years ago

TOR is not that safe. If the exit node is compromised you’re f*cked for good.

As for Google the thing is that they’re also an advertising network so basically they track you all around the web.

icebraining7• 13 years ago

If the exit node is compromised you’re fcked for good.*

It's not that simple, otherwise there wouldn't be any value in using an Onion architecture. Assuming you're using HTTPS, which every decent search engine supports, they either also need to create a fake but acceptable certificate for the domain, or to also control entry nodes and match the entering requests with the exit ones.

The NSA might be able to do it, but it's not just a matter of controlling an exit node.

betterunix5• 13 years ago

"TOR is not that safe. If the exit node is compromised you’re f*cked for good."

Not if you are using TLS, which you should be using regardless of Tor.

Estragon• 13 years ago

What threat are you referring to here? Takeovers through the browser via HTML injected by the exit node?

rasterizer• 13 years ago

At least you can't blame them for missing a PR opportunity: https://plus.google.com/+JeffJarvis/posts/5X7nHcjijsC

dgesang• 13 years ago

Here is a non-US-based alternative: https://startpage.com

umsm3• 13 years ago

Just because they say they don't collect your info, it doesn't mean that google doesn't get it.

Look at the source of a search page and you'll notice that they include scripts directly from google.com...

icebraining7• 13 years ago

Hum, neither NoScript nor a search in their source reveals such scripts. Can you point me to them?

babby• 13 years ago

Google assuredly gets info, just not from the user. There aren't any google requests from Firebug's net tab, either, so perhaps you are mistaken.

jpdoctor3• 13 years ago

Why would anyone believe that DuckDuckGo isn't already penetrated?

jafaku2• 13 years ago

Because look at the logo and the design, that duck is cool! And it says it's private! /s

oneye2• 13 years ago

Or because their entire business differentiation from the beginning has been privacy.

This does not mean that it is not compromised, of course. But its why people would believe it isn't compromised. And its a much better reason than your sarcastic imitation.

hkmurakami3• 13 years ago

If ducks were the secret to being cool, Aflac would be cool by now ;)

https://en.wikipedia.org/wiki/Aflac

darkstar999• 13 years ago

Have a look-see at this section of their Privacy Policy.

https://duckduckgo.com/privacy#s2

Of course, they could be completely full of shit or unknowingly compromised.

My concern is this: even though they don't _collect_ information, they could still forward it on to authorities and not violate this policy.

However, they have a freaking TOR node, so it's almost a moot point.

marshray5• 13 years ago

Why would anyone believe his own computer isn't already penetrated?

elorant2• 13 years ago

Why bother infiltrating PCs when you can monitor the traffic?

betterunix5• 13 years ago

"Why would anyone believe DDG isn't already penetrated?" should be read as, "Why would anyone believe that DDG isn't already penetrated and that their own computers are not already penetrated?" Your trust chain has to start somewhere.

kostya-kow2• 13 years ago

Because I am running GNU/Linux.

riquito• 13 years ago

It's a fair question, I'm ashamed by the snarky answers.

If Google can't oppose the NSA in installing backdoors (by the way, this has to be demonstrated), DuckDuckGo can't oppose them neither.

Best luck to the team of DuckDuckGo, it's a nice project.

lurkinggrue5• 13 years ago

They probably didn't install back doors and are just pulling in the data from the internet backbone.

Tapping off the fiber.

missing_cipher• 13 years ago

Really. If understood correctly, the NSA had direct lines to the fiber. It doesn't matter what search engine you use.

VladRussian22• 13 years ago

the issue is with HTTPS. To read that traffic NSA collects private keys from limited number of [big] companies as collecting them from all companies would be a very public affair. Thus from NSA's price/performance point of view smaller enterprises may be still be off the hook (for now).

ig1• 13 years ago

Because it's too small for them to care about.

fmendez• 13 years ago

Exactly, I think what we might be needing is a non-US (perhaps Iceland or NZ) based alternative. The moment, duckduckgo becomes relevant enough (i.e significant traffic) then is game over IMO.

bigiain8• 13 years ago

Ask Kim Dotcom about how well NZ's liberal laws worked out in practice when the US copyright police showed up asking the local cops to wildly overstep their legal authority…

I mean _seriously?_ Helicopters, silenced assault rifles, security dogs, and 72 cops - sent in against someone accused of _copyright infringement?_ And then a Hollywood showreel of the raid gets produced and publicised?

I _like_ New Zealand, they talk the talk, but when it comes to walking the walk - they're lead around by the nose to do whatever the US wants.

dmix• 13 years ago

Chrome integration possible?

kall• 13 years ago

you can integrate any search engine into chrome by right clicking in the search field and picking "Add as Search Engine".

Then you can go to Settings and make it your default.

mmmelissa• 13 years ago

this is a joke... right?

suyash4• 13 years ago

haha..I hope so..you need to use Firefox and not even Safari to be totally safe..even better Private Window browsing mode in Firefox.

oinksoft2• 13 years ago

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation. Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

jsingleton• 13 years ago

I really like the how the goodies have improved (or at least the discoverability). There's some really useful / geeky stuff in there.

https://duckduckgo.com/goodies#Science

https://duckduckgo.com/?q=how+much+magnesium+is+in+43+cubic+...

hkmurakami3• 13 years ago

I second the observation that the results have improved considerably over the last year. There are still holes where I have to resort to using the !g option and use google (non-English searches would be the most prominent example) but I've set all my default search options to DDG and haven't regretted it!

jpdoctor3• 13 years ago

Also, DDG's results compared to a year ago are night-and-day.

Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array

First hit on google is the stackexchange answer with .include? (which I was spacing-out on)

DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.

drakaal• 13 years ago

http://www.samuru.com is better for concise answers.

tracker1• 13 years ago

For programming questions, I almost always append site:stackoverflow.com to my search term... generally the anser is on SO, but I prefer the search engine's results over SO's search... on DDG and Google.

boomzilla• 13 years ago

This is most likely that Google has more user behavior data than DDG. If enough people use DDG and click on the StackExchange link for that query (or similar queries), DDG will be able to get that to the top.

On the other hand, did DDG just use Bing API, and only Blekko crawls the web? Or do I get my search engines mixed up?

oinksoft2• 13 years ago

This impression must partially be due to how you write your queries, and the quality of the natural language parsing in DDG/Bing (your query leaning heavily on that). I searched "ruby element in array", Rails not being a programming language, and I get the Ruby Array docs with the first result (which is what I would want) and the StackOverflow result for the third. On Google, the StackOverflow item is first and the Array docs are third for the same query.

In this case you and I think that our respective search engines are providing the better result.

skue• 13 years ago

Don't forget about DDG's great bang shortcuts.

If you ever find yourself wanting to fall back on Google's results, just throw !sp at the front of a DDG search for StartPage's proxied Google service (or !g if you absolutely must go to Google). DDG has many, many shortcuts for directly searching StackOverflow, GitHub, Amazon, Wikipedia, etc.

klibertp• 13 years ago

That was discussed here some time ago and many people suggested explicitly omitting SO and StackExchange sites when learning new languages/technologies. The argument was that while the answers on SO generally get the job done, they rarely provide the context, depth and coverage the docs give. I happen to agree - I only hit SO when I don't know what exactly I need to search the docs for. It's absolutely great for this. For serious learning not so much.

swombat• 13 years ago

I've done the same. Also switched to Firefox with full Adblock and tracking bugs blocking.

It's not much, but at least I'm no longer leaving a huge slimy trail behind me online.

ra• 13 years ago

I'm using Ghostery on Chrome. Seem to do the job.

meowface3• 13 years ago

You still very well may be leaving a trail behind; it's just likely that such a trail won't be correlated among multiple different domains you visit (from ad tracking bugs of a single company embedded into multiple websites you browse).

dhimes• 13 years ago

And they are always there in your im client

http://ddg.gg

quesera• 13 years ago

Plaintext, though. I wish DDG over XMPP would do OTR.

jshen• 13 years ago

I'm all for using DDG on principle, but google search results are still far superior.

humanspecies3• 13 years ago

That makes two of us. While lots of people say "well Google won't miss you", I think we still have the duty to do what's right.

The USA was founded as the most free, exemplary democracy in history and what we saw in this scandal is precisely the opposite of what this Nation earned so Google could exist. Then Google betrayed us all and was in bed with the government in the most sinister way possible since 2009.

Honestly? I'd rather give someone else a chance. Then if DuckDuckGo spies on us in the future, I'll switch again.

cLeEOGPw• 13 years ago

I started using DDG few days ago and I am not disappointed so far.

wnevets2• 13 years ago

if the NSA is intercepting the communications, why would switching sites matter?

marshray5• 13 years ago

1. The NSA isn't the only threat to privacy on the net.

2. DDG is SSL, so there's some hope that the traffic is not visible to a passive observer, even the NSA.

wnevets2• 13 years ago

Google is also SSL. There was a post on here a day or two ago with the theory that PRISM is really about intercepting and cracking SSL certs

aacook2• 13 years ago

This is great news for DuckDuckGo and I'm all for it, however, DuckDuckGo isn't completely private right? From what I see, DuckDuckGo obtains much of its data from 3rd parties, such as Bing/Microsoft and Yahoo. http://help.duckduckgo.com/customer/portal/articles/216399-s...

"While our indexes are getting bigger, we do not expect to be wholly independent from third-parties. Bing and Google each spend hundreds of millions of dollars a year crawling and indexing the deep Web. It costs so much that even big companies like Yahoo and Ask are giving up general crawling and indexing. Therefore, it seems silly to compete on crawling and, besides, we do not have the money to do so. Instead, we've focused on building a better search engine by concentrating on what we think are long-term value-adds -- having way more instant answers, way less spam, real privacy and a better overall search experience."

jaryd2• 13 years ago

While we do use 3rd parties to fulfill some of our organic results we always make those calls from our machines. We never pass along IP addresses. This means that while our other sources might see your queries, they are not tied with PII (personally identifiable information).

aacook2• 13 years ago

I misunderstood. Excellent.

Skalman• 13 years ago

I think you're not quite understanding how it works. They retrieve the data from e.g. Bing behind the scenes and the 3rd parties have no way to connect a query to an individual user.

That said, maybe there'd be an issue if you enter personally identifiable information as a query. But who does that?

lurkinggrue5• 13 years ago

Not that this is going to help. The NSA is probably tapping the fiber at the ISP's backbone in front of Google.

Why do you think it is called PRISM? It's probably named for the way they are splitting the fiber and recording everything.

zachrose• 13 years ago

Or it could be an API for issuing FISA warrants and collecting the requested data.

(The NSA may very well be doing both.)

lurkinggrue5• 13 years ago

They are probably doing both.

adamtj• 13 years ago

In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of "https://duckduckgo.com", it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.

jackpirate2• 13 years ago

Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL

As long as the SSL cert isn't compromised, I don't see how this is possible.

magicalist• 13 years ago

HSTS allows a site to indicate that in the future it should always be loaded over a secure connection, so you only have an interceptable connection the very first time you visit that site. Both Firefox and Chrome allow sites to add themselves to a list to "preload" HSTS enforcement, so even that initial connection which is man-in-the-middle-able doesn't happen.

I don't see them in the current lists, so DDG should contact Mozilla and Google to get added to their preloaded HSTS lists[1][2] so all connections will automatically happen only over HTTPS.

[1] http://dev.chromium.org/sts

[2] https://blog.mozilla.org/security/2012/11/01/preloading-hsts...

leoc5• 13 years ago

It could also be named PRISM as a form of misdirection, to make people think that the codename referred to upstream-collection operations. (It's beyond doubt that upstream collection is still ongoing too, though.) Or it could be that spy organisations just like optical metaphors. FWIW the You Should Use Both slide seems to use PRISM to refer specifically to the "direct collection" and not the upstream collection capability.

codereflection• 13 years ago

I've been using DDG for nearly a year now, and have rarely turned back to Google. I only do so when I really cannot find what I'm looking for on DDG, and I try to tell DDG about the bad results (which I've actually seen get fixed). Getting bad results happens infrequently though, so the benefit of using DDG really outweighs the occasional inconvenience.

suyash4• 13 years ago

And as far as browser is concerned, I would recommend go with Firefox vs Google or Safari. Mozilla is a non profit and I feel I can trust it the most.

hkmurakami3• 13 years ago

I take it you mean Firefox over Chrome or Safari?

(I agree. The only thing I use Chrome for is Facebook)

suyash4• 13 years ago

even better prefer to use Private Window in Firefox. Chrome is only good for it's debugger so I rather prefer Canary.

kostya-kow2• 13 years ago

The only safe thing to do would be to compile Firefox or Chromium yourself.

suyash4• 13 years ago

Well the safest of all would be to write your own highly secure browser and use TOR.

pschastain• 13 years ago

DDG is has been my primary search engine for about a year now, and I do what I can to proselytize for it. Their results aren't always as comprehensive as the bigger engines, but I can usually find what I need.

WestCoastJustin• 13 years ago

You can see the stats here: http://duckduckgo.com/traffic.html

paulsutter• 13 years ago

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion.

http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the...

They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the slide), when "Upstream" access is just as big a concern.

EDIT: rephrased my concern about direct vs upstream

nwh2• 13 years ago

If you're using HTTPS, they can't even see your URLs or headers. That's sort of the point.

lurkinggrue5• 13 years ago

Email is unencrypted in transit.

gtaylor• 13 years ago

I dont understand all the hubbub about direct server access

It's upsetting. It's a breach of trust for the provider and the government. It's more principle than technical.

Both the "upstream" and "direct" methods are upsetting, just in different ways and for different reasons.

diminoten3• 13 years ago

Spoiler alert: They can't decrypt it. That's why they have to ask these companies for the info, rather than just take it from the ISPs.

smaili• 13 years ago

Doesn't necessarily mean they don't have the ability to decrypt, it just means that they have a process in place so in case shit ever hit the fan (like it just did) they can come back and say "what's the big deal? we have a process in place"

iguana• 13 years ago

If they can decrypt some SSL (maybe low bit) it is likely a very intense process that requires vast hardware resources, so even if they can do it, it is not likely it is being done for all traffic, but could be applied to some traffic.

dredmorbius2• 13 years ago

It could just as easily come down to simple costs.

If it's less expensive to ask someone to hand over the data (in bulk) rather than burn CPU cycles cracking SSL (again: in bulk), then go for it.

Even if it's feasible to crack SSL for a few crucial messages, it's likely not so for the volumes of data the NSA are capturing.

jerf3• 13 years ago

"How much are you willing to bet they can't decrypt https?"

I'd bet quite a bit, though not "my life", that they do not have a generalized "read everything" ability for all forms of SSL. They may have what cryptographers would call "a crack", but that's a low bar, and doesn't prove they have a practical attack.

However, DDG is currently using 128-bit RC4, which is very weak. [1] I wouldn't care to bet anything that the NSA doesn't have an RC4 cipher crack that is practical to run on wide swathes of traffic.

RC4 is very popular, which I believe is because some people claimed it was a defense against the BEAST attack. I researched this for work, and I couldn't find anyone whom I trusted saying that was a good mitigation. The people I trusted merely observed that RC4 was not vulnerable, but never said you should switch to it. Only secondary sources ever suggested that. My conclusion was that there was a reason for the primary sources never suggesting that; in response to a theoretical break of the rest of SSL, the correct move was not to move to a solution that had much more practical attacks already known than what BEAST demonstrated. But now it's even sillier; BEAST has been either entirely or almost entirely mitigated in browsers (there's no server-side defense against BEAST, but there's a client-side one you can use, and browsers now have it). As far as I can tell, RC4 should be abandoned and we should resume using stronger ciphers for SSL. Anyone still concerned about BEAST should update their browser.

[1] http://nakedsecurity.sophos.com/2013/03/16/has-https-finally...

dllthomas3• 13 years ago

I might bet my life on HTTPS depending on what my alternate choices are. I'm loathe to bet my life on anything, though.

icebraining7• 13 years ago

OTOH, if they can get a CA - any CA - to cooperate, they can MITM anyone without having to break SSL.

jaryd2• 13 years ago

Thanks for pointing this out. I'm looking into updating our ciphers very soon.

abrichr• 13 years ago

Thanks for the link, that was an awesome article. Well written and technically substantial. How did you come across it?

leoc5• 13 years ago

There's no question that they're monitoring upstream traffic. In fact they may still be doing the old ECHELON trick in which the US eavesdrops on non-Americans, the rest of the world spies on Americans (among others) - and then everyone swaps the data received.

But in the light of the PRISM documents it's even more likely than it was before that the NSA doesn't have the ability to decrypt HTTPS, or at the minimum that the US considers it too important to risk giving it away by using it on routine Top Secret signals intelligence. (And/or maybe too resource-intensive to use for that.) The strongest evidence for this is that we haven't heard anything about such a capacity yet from Snowden, Greenwald et al., who all have the full PRISM deck (along with other documents) in their possession and would surely tell us about it if they knew of it. So either 1) the PRISM slides do mention the ability to decrypt SSL or SSH streams but Snowden and the journalists haven't picked up on it (not impossible given the apparent incompetence they displayed over "direct access"), 2) it's too sensitive to mention in a self-aggrandising Top Secret overview of upstream and "direct collection" Internet signals intelligence, which probably means it's not in use (or at least not in regular use) for upstream collection or 3) they really don't have it.

A supporting reason to think that they don't have it, or hardly ever use it, is the apparent emphasis on "direct collection" in the PowerPoint. Why go to the hassle of dancing the frenemy minuet with Google and other fairly-anti-surveillance Silicon Valley firms when you can just get what you want from upstream collection at the apparently more-accommodating telcos? This isn't conclusive because even if you could understand all the traffic into and out of someone's Facebook account you'd still like to be able to see the internal state of the account, in particular so that you'd know what they'd been doing before the upstream surveillance began. But I think it's at least as likely that the whole new focus on direct collection is a workaround for the fact that, thanks to SSL and SSH, upstream collection just isn't what it used to be back in the days of ECHELON.

As the slide said, You Should Use Both: direct collection to give you access to US-company servers, probably bypassing the HTTPS problem, and upstream access to give you data, probably only unencrypted data (email!), that passes through the US without going to a US-company server.

(If you want an exotic alternative theory, you could speculate that the PRISM document is a fake, a limited hangout http://en.wikipedia.org/wiki/Limited_hangout by the US spooks, maybe precisely to direct attention away from their ability to decrypt HTTPS streams. But this now seems unlikely, for example because DNI Clapper would surely have to have approved a managed release of a set of documents that both gave away the Verizon metadata surveillance and so also implicated him in perjury.)

krek2• 13 years ago

I can't remember which interview it was, if on Democracy Now, or his MIT lecture video, but Bill Binney stated that the NSA in fact does decrypt HTTPS.

headstorm• 13 years ago

While I haven't heard explicitly about Amazon being part of PRISM, the duckduckgo ips all point to amazon's EC2 platform.

leoc5• 13 years ago

PRISM doesn't matter that much, anyway - the NSA doesn't need a workflow automation system in place to send DDG or Amazon a NSL or a FISA order.

hoov• 13 years ago

I know this is paranoid, but I keep coming back to this post that hit HN a few days ago: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

When you combine that with the beam splitter logo, things get a bit scary.

leoc5• 13 years ago

More concretely, they don't have to rely on decrypting https. An approved NSA or FISA order to DDG will give the government an en clair "wiretap" on your DDG searches for up to a year. They may not be able to get the searches you did before the wiretap began, but that's all.

humanspecies3• 13 years ago

Google wasn't passively spied on via a beam splitter or whatever you call it.

They were doing the spying and actively sending the data out.

martinlee• 13 years ago

What about Yacy? (http://yacy.net). I am not sure if the queries inside a peer network can be decrypted as easily as http requests (I am not a networking specialist though, it is just an opinion).

tocomment• 13 years ago

Is there a way to make ddg the default on the iPhone?

cinquemb3• 13 years ago

Anyone else wondering if DDG will come out with their version of email? Maybe something that uses end to end encryption (maybe working together with Mozilla Foundation)?

fourstar• 13 years ago

This is where they would kill it. Search would be supplementary, but if they pivoted and focused on email (eventually rebranding it), then that's a home run in my book. I'd like to see this, and would be interested in beta testing if/when it happens.

lignuist2• 13 years ago

I would prefer if someone else did it. Not because I do not trust DDG, but because I don't like the idea of one company providing everything (or too much). Why step into the footsteps of the dinosaurs?

cinquemb3• 13 years ago

Fair enough.

Why step into the footsteps of the dinosaurs?

I'd think adding E2EE to email would be like what pagerank did to the search engine. Why build from the ground up when you can build on the shoulders of the giants?

acdha• 13 years ago

I'd prefer they became more competitive on search first: I try DDG a few times a year and it's a pretty big self-handicap when everything takes minutes rather than seconds to find.

v1tyaz• 13 years ago

Startpage/Ixquick is coming out with an e-mail service called StartMail: https://startmail.com.

bpatrianakos• 13 years ago

I have a private writing app and I can confirm that this NSA thing has been good for me too and I'm betting lots of services concerned with privacy. I saw a 5X increase in users in the past week and reviews in blogs are getting more numerous.

I wonder though if now all services regardless of their real focus will start marketing privacy as a feature and muddy the waters, making it hard for consumers to discern who is really about privacy and who just uses it as a marketing ploy.

rosser2• 13 years ago

An observation: Ghostery blocked 22 trackers on this article.

Does it somehow make tracking my every move online okay if it's done for profit?

EDIT: phrasing.

guelo• 13 years ago

With all the tracking by advertisers it makes one wonder if the Feds have approached them for access to those databases.

devindotcom• 13 years ago

I know, it's ridiculous. But people do want to see how many likes the story has, and cross-service comments are pretty next-wave, so you have to have widgets now for 5 social sites, 7 comment systems, global analytics, live analytics, sitewide ad, contextual ad, site cookie and maybe add two more because I haven't thought of them... that's 19 right there!

We really need something better than having these MASSIVE amounts of callouts. It's like those pictures of Internet Explorer totally taken over by toolbars, except it's a different set on every single site on the web. Bah!

gohrt2• 13 years ago

It turns out that if you block all the trackers and 3rd part widgets, the website continues to function as the use desires, and nothing of value is lost.

humanspecies3• 13 years ago

Everyone was ok with google's tracking for ads and commercial purposes, even though it felt kinda weird, we had a feelign it wasn't evil somehow.

Now I can't even look at Google anymore, they're like a spouse that cheated on you. You knew the spouse may have been watching you, but at least they weren't fucking with someone else while you trusted them.

teeja• 13 years ago

Try that with Noscript on, and it gets cut down to 3 trackers.

mikemoka• 13 years ago

I like DDG, but has it ever mentioned how this TRACKING data is used?

http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org... (every time you click on a search result you actually click on a link like this,which redirects you to the actual page)

Is it just for pagerank?

zwegner• 13 years ago

This irritated me, as it makes me somewhat skeptical of the "we don't track" claim.

However, I noticed that if you use their HTML version (i.e., use duckduckgo.com/html/<query> instead), that they don't do the click-tracking. The only downside I've noticed is that there's no infinite-scrolling mode, you have to hit "next".

Whether they're still tracking the search queries, though, I have no idea...

gohrt2• 13 years ago

DDG just claims they don't store your history. Presumably they could use redirected clicks as quality signal, without tying it to your browser cookies.

boyter3• 13 years ago

It might be used internally for additional ranking signals. But the privacy policy states it can never be tied back to you as an individual so nothing to worry about.

From memory the main reason they do this is to allow downstream websites to determine if a user was referred to them by DuckDuckGo without the actual search term. IE you know they came from DDG but with no leakage.

I run searchcode.com (which provides a lot of the code doco and sample results) and since this was done I can now determine how much referral traffic actually comes from DDG but have no idea what you were searching for when you click through.

claudius2• 13 years ago

You can turn that on/off in the settings dialog, essentially it is meant to hide the search queries from the target website.

mratzloff• 13 years ago

Whenever I think about DDG, I think "Oh, you think Gabriel Weinberg suddenly cares about your privacy after he sold a truckload of user information to Classmates.com?"

arindone• 13 years ago

Anyone going to say it? DuckDuckGo searches are still really low quality. I WANT them to be a legitimate competitor in the space (in fact, I've been having similar hopes for Bing for years) but it's just not there yet.

beefsack• 13 years ago

It's been around for a long time, but I really love the TTY mode of DDG: https://duckduckgo.com/tty/

ninetenel• 13 years ago

Somewhat related but I've been canceling my subscriptions (Office365 in my case) to services I can't properly secure..

I'm also in the process of selling my surface pro and going back to a Linux laptop (OneNote 2013 sucks with touch on the Desktop for me .. and Microsoft's Windows8 version won't allow you to not use Skydrive)

Also, I pay Microsoft .. why won't they let me save my OneNote docs in a secure way using their Windows8 apps?

Lyaserkiev• 13 years ago

One thing that I prefer about DDG is that it doesn't try to guess what language I want to search in other than by my input. It is ridiculous that google forces me to go through worse results based solely on my location, it shouldn't matter where you are from.

isaacb2• 13 years ago

It really only took me about a week to get used to DuckDuckGo, and now using Google just feels wrong.

josteink• 13 years ago

Things like PRISM makes me completely want to back out of the Google ecosystem.

Part of that would be replacing Gmail. That can be done, but what good (free) options exists for a webmail solution?

I'd also love this instant to cut gtalk (or "hangouts" which it is called now. hopeless), but Google just declared hate on XMPP, so setting up your own node will land you on your own tiny island.

The trend is clear though: Google is stuffing the exit-holes while the US government is requiring more and more of Google's data.

If you haven't started moving out yet, you better get started. And for the love of God, ditch Chrome. Support someone who supports the open web and respects your privacy.

ausjke• 13 years ago

I tried duckduckgo and it did not work as well as google, yet.

I especially dislike its name, it's odd and too long to type, and again, duck 'walks' slowly, not a good sign.

can this be renamed to something better, and shorter? sometimes name does matter.

PRISM fears give private search engine DuckDuckGo its best week ever

Related Stories