Slashdot Mirror
DuckDuckGo Search Engine Erects Tor Hidden Service
An anonymous reader writes "Viewable with Tor installed, search engine DuckDuckGo has erected a hidden service for secure, encrypted searches through the Tor network. While past attempts at hidden service search engines failed due to uptime or quality issues, DuckDuckGo marks the first time a real company operating a public search engine has offered a solid search engine as a hidden service for Tor users."
Hidden erection ... hurr hurr hurr
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
How long until it's going to be shut down because you can find nasty bits with it?
thegodmovie.com - watch it
Which is it?
NSA?
CIA?
FBI?
All of the above?
Which of the social policing groups (with some Acronym name) do we have to thank for this search engine service?
"This site requires JavaScript"
How stupid is that, for a Tor hidden service? Sure, it may well provide "secure, encrypted searches", but there's going to be no guarantee of privacy for so long as it demands script active to function.
How is this better than using any other search engine via Tor? At least Google/Scroogle/Ixquick/[many others] don't require script to perform such a very basic task, so at least with those I can feel confident about retaining my privacy, in addition to performing similarly secure, encrypted searches.
Yeah, a new search engine... It doesn't search hidden services, it just operates as a hidden service. If you want it to...
Oh, and as noted above it requires JavaScript to see any more results than the first few.
Hee hee... "erect!"
Infamous 4chan often plays various jokes on the users - like "wordfilters", you post one word, the post contains another. You write "moot", your post contains "doug" and so on. Over some time 4chan wordfiltered "loli" to "duck". The anonymous liked the joke so much that once it was removed, users kept posting "links to duck porn" and so on.
I can't help but think there's a connection.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
It's hiding in plain sight. Like ninjas.
What would be the point of building a website people can't identify? ;)
Tor is compromised by the US government. So go have fun on it but fon't get too cocky.
linky (warning:.pdf)
linky
linky
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
I registered a domain a while back for an bike hobbyist site that I wanted to start. Nothing major, just swap tips and meetups to help out the community.
Over the next few months I started getting random emails from some users that my site was "infected" and "hacked", etc. The first thought was that their machines were infected so I didn't think much of it. But I checked to see if there was anything wrong with my server and everything looked ok.
Next thought was that somehow I got stuck in one of the Google filters in the SERP (i.e. "visiting this site may harm your computer") . Again, no evidence that was the case.
So I emailed back to a couple of the folks that reported the problem and asked for a screenshot of exactly they were seeing. Sure enough I get a browser screenshot back that has DuckDuckGo plastered all over it, warning about how my site was not to be trusted.
After some more research, it turns out that anyone browsing with the Duck Duck Go toolbar is hooked into a database at ivegotafang.com (also maintained by the Duck Duck Go folks). It acts as a net nanny and filters out parking pages and other "unsavory" sites on the fly. Sure enough, since the domain I used had previously been parked, it was still flagged as evil.
To get out of the database you're supposed to go to the site and basically beg to be removed. On principle there was no way I was going to stoop to this level so I just told my users the story and to uninstall the Duck Duck Go toolbar. Everything was fine after that.
Of course there are very few people using the Duck Duck Go search engine, let alone the toolbar. But the bigger issue is whether this behavior should be encouraged. This isn't like a net-nanny filter for porn. It's for something as innocent as a parking page which lots of sites resolve to while being developed.
With Google a parked page simply doesn't show up in the index and they reeevaluate periodically. Duck Duck Go says they also reevaluate but that obviously wasn't the case for my site. The warning page is essentially a manifestation of guilty until proven innocent.
What if there were a hundred for-profit companies like Duck Duck Go, and for each one you were responsible for their erroneous results? And what if you were running a business and just one of your customers saw that screen and started spreading the word that my business can't be trusted because of a false positive on Duck Duck Go? Then you're on the hook for spending hours trying to undo the damage, not Duck Duck Go. Good luck with that.
Soapbox off. Imho, the whole Duck Duck Go thing is nasty and should be avoided at all costs.
Can someone explain specifically what's special about this? How is this any better than using Tor yourself to search through any other search engine? Presumably, as long as you don't reveal personal information, your searches will be anonymous anyway. If that's the case, how does being able to point your browser to a *.onion domain to access a given service help - is it somehow more anonymous?
(please don't read sarcasm into my question - I'm actually interested to know this).
Many sites have been shut down, despite claiming to do only what google does. A search index linking to leaked documents, for instance, would probably be under some pressure lately, especially if they couldn't identify the data sources, but only the index that people were finding them through. Hiding the search engine server would help protect them.
More like 1.5, and you don't want those bits on your computer... ever.
http://www.debunkingskeptics.com/
Even when they do:
A exit node can pretend to be the real site, and do a MITM attack. For simple joes you would just send the data unencrypted to the tos user and hope he does not notice it is an unencrypted page. (THIS HAS BEEN OBSERVED IN THE WILD!!!)
3 letter agencies have their own root certificates and can reencrypt data that would be accepted by the browser as trusted. Only careful examinition of the certificate would show that is was issued by a differt CA.
The whole point of TOR is that you cannot trust you own governmet police. But browser do give your governmet a root certificate of trust. really.
Default Tor traffic, for normal websites like google.com, go through exitnodes. At the exitnodes, everything needs to be decrypted unless it's ssl or similarly encrypted at the application layer. Additionally the traffic is also directed to the REAL IP address. Combined with cleartext, it is quite a big risk actually.
Basically, an exitnode needs the decrypted data for usual http / decrypted traffic, and is a heaven for snoopers and adversaries wanting to do man in the middle-attacks. Even SSL becomes insecure, since such a node gets the power to present fake ssl-certificates, so unless you're careful, or running Firefox with its annoying warning pages, you can be bitten even when using internet bank accounts. It's also easier to snoop SSL at such exitnodes, since you can just harvest keys and do very deep packet inspection, unless keys are transferred in another medium (how it always should be).
Of course, since Tor is used by people seeking anonymity, the reward is higher for snoopers who want to find them. Besides, being an exitnode is a low barrier of entry to become a snooper as well, since every "shady character" is sending data your way. So do good research before using Tor, as care must be taken to preserve anonymity. Don't just run Tor and forget it.
When using hidden services, everything is encrypted along the whole route. The onionrouting will ensure high barrier of entry for adversaries and snoopers. So such hidden services is indeed more "secure" than using google.com (which you can bet is giving APIs to governments and highest bidders to snoop on us), and any other "normal" internet service, including your ISP..
What exitnodes and Tor is good at is this:
Privacy: As in being one "dissident" among thousands of other voices. As long as you don't leak private information in any way, which excludes plugins, java and javascript (disable all such things now, even images can be "unsafe" unless you've anonymized your DNS requests).
Speed: Snoopers of course wants to snoop on you with the utmost efficiency, so the exitnodes are blazing fast servers, which will be faster than relying on random nodes for reaching a "hidden service".
But privacy may quickly be offset by bad research, usage of Tor or even unreleased attacks. Security threats may leak private information in the blink of an eye, especially when using exitnodes.
Don't use Tor unless you REALLY REALLY need it (like getting killed), and do good research and proper setup of the entire machine. Preferably use a prebuilt VM like JanusVM.
Or use Tor if you don't really care and want to try a new thing, but don't act surprised when your identity is leaked..
Using this duck-search engine thingy is off limits, since it requires javascript. Forget it. You might as well use google.com or another hidden service which has no javascript requirements.
If you like anonymity, I like I2P better than Tor. It has a nice community and does have more safe defaults than Tor. In I2P, outproxies, another word for exitnodes, are heavily disencouraged. Instead they're trying to build an entire network of hidden services, to do anonymous search, email, bittorrent, irc, websites, etc. INSIDE the darknet itself. It is like this article, but everything else is built inside the network itself as well. It's a huge project, with lots of volunteers.
I recommend reading on their site how it works, you'll find they address much more issues than most other "darknets", and is open source and seems "honest" about what they know and don't know:
http://www.i2p2.de/
But you never know..
http://www.debunkingskeptics.com/
Are you sure about this? Because if so then that means someone has been looking for this on my Browser? Please be 100% certain in reply.