Slashdot Mirror


DuckDuckGo: Illusion of Privacy

An anonymous reader writes "With all of the news stories about users moving to DuckDuckGo because of NSA spying, this article discusses why the privacy provided by DuckDuckGo is more the privacy from third-party tracking (advertisers) but may do little, if anything, to prevent the NSA from tracking your searches."

264 comments

  1. FTFA by Anonymous Coward · · Score: 5, Funny

    "The NSA Can't Loose" ... Really?

    1. Re:FTFA by Anonymous Coward · · Score: 3, Insightful

      Really. If they want the information, they get it. Either you turn it over willingly, or they take it forcefully via legal means or just go above you to your host. There is nothing you can do about it.

    2. Re: FTFA by Anonymous Coward · · Score: 0

      Whoosh...

    3. Re:FTFA by ATMAvatar · · Score: 2

      Well, you do have to be somewhat of a tight-ass to be a NSA spook...

      --
      "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
    4. Re: FTFA by Anonymous Coward · · Score: 0

      If it's loose, put some glue on it.

    5. Re: FTFA by lxs · · Score: 4, Funny

      I heard it got loose and is living in a capsule hotel in a Moscow airport. Which further proves my theory that we're living in a cyberpunk novel.

    6. Re:FTFA by rainmouse · · Score: 5, Informative
      For those that don't want to actually read the loose blog post (its just an opinion from some unknown guy and backed up with no actual facts by the way. It's not actually news at all).
      In the comments is a reply apparently from DuckDuckGo :

      "Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business. We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt. There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example."

    7. Re:FTFA by Anonymous Coward · · Score: 1

      Nice daughter you have Mr DuckDuckGo. Be a shame if something were to happen to her.

    8. Re:FTFA by Anonymous Coward · · Score: 0

      If you hadn't understood that, the poster was simply laughing at the author's inability to speak english correctly ("loose" instead of "lose", the article was probably corrected afterwards). And it tells a lot about the credibility of that stuff.

    9. Re:FTFA by IamTheRealMike · · Score: 3

      Well that's convincing - not!

      Has this dude been living in a cave for the past month? We've just had a non-stop series of revelations about how governments (not just in the USA) routinely ignore their own laws or secretly redefine them into meaninglessness, in order to engage in dragnet surveillance. And his answer is "such a request would be unconstitutional". Yes, it would. It was unconstitutional for all the other search engines too. So what? That obviously doesn't matter.

      DDG is just a scam in so many ways. The entire site is basically a proxy for Bing. If Bing were to cut them off they'd have no search engine anymore. If Bing were to say "you pass through data on people or we cut you off", they'd either have to give up on their privacy guarantees or shut down completely. It's a completely self defeating business model, if they get popular they won't be able to sustain the reasons for it anymore.

      The fact that he thinks there's a difference between Amazon and Verizon with regards to NSA cooperation is especially amusing.

    10. Re:FTFA by Anonymous Coward · · Score: 0

      Oh no! The secret cabal of gov't spooks found out I saw Sharknado! And that I ordered a pizza!

    11. Re:FTFA by BrokenHalo · · Score: 1

      How come you guys can spell "spook" but nobody seems to be able to manage "lose"?

    12. Re:FTFA by BrokenHalo · · Score: 1

      ...his answer is "such a request would be unconstitutional". Yes, it would. It was unconstitutional for all the other search engines too. So what? That obviously doesn't matter.

      I guess his point is that rather than tamely rolling over and saying "tickle me just there, please", he's saying that a request (let's be honest and call it a demand) that is *OBVIOUSLY* unconstitutional should be comparatively straightforward to contest if the NSA ever had the courage to bring an action to court, which would be a matter of public record.

      Now, obviously if the spooks are serious about it, they could get an actual court order, which (while interesting from any number of perspectives) would change the state of play totally.

    13. Re:FTFA by Anonymous Coward · · Score: 0

      All our front-end servers are hosted on Amazon

      Oh, that's safe then.

    14. Re:FTFA by Anonymous Coward · · Score: 0

      Sergey, what did we agree on regarding posting on slashdot? You know what the lawyers said, if you can't leave it be, we'll have to get that gagging order.

      Larry & Eric.

    15. Re:FTFA by MrEricSir · · Score: 2

      This guy's response seems to show a lack of understanding of the entire NSA debacle:

      "All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business."

      If this were true, wouldn't Microsoft, Google, Apple, Verizon, etc. be in trouble with the FTC? What makes DuckDuckGo different?

      "We have not received any request like this, and do not expect to."

      Funny, that's exactly the same thing Google and Facebook said. What makes DuckDuckGo different? Why should I believe you?

      "If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt."

      Clearly that hasn't stopped the NSA in other cases. Again, what makes DuckDuckGo different?

      "There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example."

      Okay... and what is Amazon connected to? Saying there's technical inaccuracies but not debunking them doesn't make want to trust you.

      Anyway, let's hope for everyone's sake that the comment wasn't really left by the CEO of DuckDuckGo.

      --
      There's no -1 for "I don't get it."
    16. Re: FTFA by xgerrit · · Score: 1

      Oh no! The secret cabal of gov't spooks found out I saw Sharknado! And that I ordered a pizza!

      The subject has shown an interest in wanton destruction and a potential alliance with the Italians. We request the court grant a search warrant for his home. As this is a matter of national security, the record of this request must be sealed.

    17. Re: FTFA by jalopezp · · Score: 1

      I'm pretty sure the GP was being coy.

    18. Re:FTFA by alci63 · · Score: 2

      Notice the site is from japan... the ability to avoid any typo in an english article does not tell that much about the credibility of the stuff !

    19. Re:FTFA by IamTheRealMike · · Score: 2

      The whole fiasco is enabled by the fact that the NSA does have (secret) court orders from a (secret) court, and the regular courts won't hear cases because of state secrecy. I don't see any reason to believe DDG would have any more luck than Google or Yahoo did.

    20. Re: FTFA by Anonymous Coward · · Score: 0

      Well played sir, well played.

  2. I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 5, Insightful

    I started using DuckDuckGo because, out of all the other search engines out there, it's the only one I've found whose entire mission statement centers around _not_ collecting information on every goddamn thing you do. Yes it's probably still being tapped at the fibre optic cable level so it doesn't really matter, that's not the point. The point is to vote with your dollar, or in this case your page view, far more influential these days than one thinks.

    I don't use DuckDuckGo because it preserves my privacy. I use DuckDuckGo because they don't try to take it away from me.

    1. Re:I didn't start using DuckDuckGo for privacy by Impy+the+Impiuos+Imp · · Score: 2

      Well, that's fine, but I keep pointing out I'm less concerned with whether Google knows I might want to buy Depends than that the NSA might be able to spy on political opponents to whoever holds their ear. "Make sure you fill out the warrant form, agent #4821 out of 17436." isn't much protection for a G. Gordon Liddy type.

      --
      (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
    2. Re:I didn't start using DuckDuckGo for privacy by viperidaenz · · Score: 0

      If DuckDuckGo was about _not_ tracking me, why does every search result link go back via duckduckgo.com before being redirected to the actual link, and the link they use javascript to show in the status bar? Just like Google. It's so they know which link you clicked, no other reason.

    3. Re:I didn't start using DuckDuckGo for privacy by lxs · · Score: 1

      Obviously. The scary form is 27B/6.

    4. Re:I didn't start using DuckDuckGo for privacy by jovius · · Score: 1

      The article misses the point. It's about getting rid of the Google sphere and search filtering.

      I'm using Startpageat the moment.

    5. Re:I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 0

      how about startpage.com?

    6. Re:I didn't start using DuckDuckGo for privacy by Sabriel · · Score: 1

      Yeah, the fibre level is pretty hard to avoid. Here's something I spotted this afternoon, related to the reveal that the US was recording Telstra's Reach traffic:

      http://www.computerworld.com.au/article/520706/ludlam_demands_telstra_explain_role_us_spying/

      Telstra issued a statement defending the agreement.

      “This Agreement, at that time 12 years ago, reflected Reach’s operating obligations in the US that require carriers to comply with US domestic law," a Telstra spokesman said.

      "It relates to a Telstra joint venture company’s operating obligations in the United States under their domestic law. We understand similar agreements would be in place for all network infrastructure in the US. When operating in any jurisdiction, here or overseas, carriers are legally required to provide various forms of assistance to Government agencies.”

      Note the part I put in bold....

    7. Re:I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 0

      The point is to vote with your dollar, or in this case your page view, far more influential these days than one thinks.

      That is hilariously not true.

      Your vote matters not to them, Google or anyone else.
      You are but one small person in a sample of over a billion.
      You think you matter against all of the casual users that don't even know what a website is?

      Stop projecting your knowledge on others. People are thick. They don't know any better than "googling facebook" and complaining in some persons blog because it had facebook connect and got on top of Facebook in Google searches.

    8. Re:I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 0

      I am the author of that blog post. It doesn't miss that point at all. It says in the first two paragraphs that if you are using DDG to get "rid of the Google sphere and search filtering" this article isn't for you. DDG clearly does that. I am a DDG user for that reason. The article is simply and solely about any assertion that DDG can protect your from NSA monitoring. It can't.

    9. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      just use
      ?kd=off&q=%s
      instead of
      ?q=%s

    10. Re:I didn't start using DuckDuckGo for privacy by Kiwikwi · · Score: 1

      That's another thing to like about DDG: The fact that all settings can be stored as URL parameters in your browser, instead of a cookie (meaning you can simply disable cookies for duckduckgo.com entirely).

      And it's well-documented and easy to do:

      1. Go to https://duckduckgo.com/settings, configure DDG as you please.
      2. Click "Bookmarklet and settings data", then click on the prominent "https://duckduckgo.com/" URL.
      3. Right click in the DDG search field, select "Create search" (Opera) / "Add keyword for this search" (Firefox) .

      In other browsers, the process is more roundabout, but that's hardly DDG's fault.

    11. Re:I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 0

      looking at the site now I found
      https://duckduckgo.com/lite/
      which is really nice, and don't do the redirecting-game (I think?)
      It is a much easier alternative to stuffing fifteen &-parameters to get things right, that I first tried.
      One thing I miss is a way to set it show 100 matches per page as I have google do. (also on my wishlist would be it telling number of matches it found or like gooooooogles links to all searchresult pages. If the list would be more compact and without the (tr) (td) &nbsp ; (/td) (td) &nbsp ; (/td) (/tr) html-abuse the duckduckgo.com/lite/ would be nice visually too)

      But the reason I will not use duckduckgo is a another one:
      It gets the searchresults from Microsoft. Even though I really want to leave googles surveillancemachinery, I don't want to have anything to do with microsoft. and I don't want to bump up ms bings marketshare a tiny bit. I would love a little setting "[x] No results from bing" and only get results duckduckgo collect with their own crawler and from other non-ms sources.

    12. Re:I didn't start using DuckDuckGo for privacy by viperidaenz · · Score: 1

      They're still tracking clicks by default.

    13. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      rightclick on the searchfield after searching with for example kd=off, then click "add search engine" when you're using firefox.

    14. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      not if you use the kd=off setting or use the preferences panel to disable it.

  3. Its not about 100% privacy by SuperCharlie · · Score: 5, Insightful

    At least for me its not, its about not feeding the beast directly. I jumped to Linux, Opera, and DDG as a way to add a few more cycles and maybe a few more man hours to the mess rather than hand it over directly with Windows, IE or Chrome, and Google. If anyone thinks they can really be anonymous in this ecosystem they are sorely mistaken. I do believe however there are less trodden paths and a little more pains in the rear that can be had, and as a silent protest, I chose to use them.

    1. Re:Its not about 100% privacy by PopeRatzo · · Score: 2

      as a silent protest, I chose to use them.

      That's all good. I've tried https://startpage.com/ but I'm not smart enough to know how effective it is at keeping my anonymous.

      It seems to keep Google from upskirting my private info, and maybe that's enough.

      --
      You are welcome on my lawn.
    2. Re:Its not about 100% privacy by itsthebin · · Score: 1

      I am trying startpage also and so far I have been happy.
      it queries google for you

      --
      ...I obey the laws of physics....
    3. Re:Its not about 100% privacy by hughbar · · Score: 1

      I so agree with this, absolute privacy is an illusion. Even if 'they' [tin foil hats on, guys and gals] can't get at the text of your stuff, they can use traffic analysis to get a little insight into some of your social graph. So I also use DDG, encrypt stuff where I can, use Tor, anything to increase the levels of difficulty and make the system run hotter.

      Also, finally, they might work out that this is foolishness: http://qz.com/92207/simple-math-shows-why-the-nsas-facebook-spying-is-a-fools-errand/ and go back to some real work, as if that would happen.

      --
      On y va, qui mal y pense!
    4. Re:Its not about 100% privacy by Anonymous Coward · · Score: 0

      "Linux, Opera, and DDG"

      Opera is proprietary.

    5. Re:Its not about 100% privacy by readingaccount · · Score: 1

      Yes, but again, it's all about the the less trodden paths. Fewer people use it, so it has less attention directed towards it from those who would see to subvert the user. I agree that it being proprietary has some concern, but it's all about weighing the pros and cons.

    6. Re:Its not about 100% privacy by Anonymous Coward · · Score: 0

      So? He never said he was going towards FLOSS, he was concerned with his privacy. He has no reason to assume that Opera are storing all his data to sell to a third-party, whereas he *does* have reason to assume that Chrome in particular does. So he moved to Opera. There is no contradiction in anything he's said beyond one that open-source zealots choose to add to it. It's worth reminding yourself occasionally that "proprietary" /= "evil" and that it's a sunny day outside, perfect for going to the park.

    7. Re:Its not about 100% privacy by Anonymous Coward · · Score: 0

      Opera is proprietary and thus sub-optimal.

    8. Re:Its not about 100% privacy by FriendlyLurker · · Score: 1

      Startpage looks great, if it is indeed legitimate and not some spook front. Will be giving it a go and watching out for more news about the company behind it... thanks for the reference

  4. DuckDuckNo by Anonymous Coward · · Score: 2, Insightful

    While the NSA brand of privacy invasion will probably never be avoidable, unless you renounce all forms of data transfer, it's pleasing to have SOME control over your internet presence in so far as keeping advertising trackers off your back. I don't think it says anywhere at DuckDuckGo that it avoids NSA tracking. and anyone using the service who believes it does so is unaware of how the NSA programs work.

    1. Re:DuckDuckNo by Anonymous Coward · · Score: 0

      Indeed. The NSA is a very powerful adversary, and PRISM was just recently discovered. It's far too much to ask of DuckDuckGo to be safe against that right now.

      One thing seems very clear:
      Servers that contains Private Keys CANNOT be located where the NSA can reach them.

  5. Credibility? by karolgajewski · · Score: 5, Interesting

    I may be breaking the fundamental rules of Slashdot, but ...
    - the "article" is a single post on a recently created blog
    - they misspell "lose"
    - a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)

    This is the very definition of "nothing to see here, move along".

    --
    - .k. -
    1. Re:Credibility? by 93+Escort+Wagon · · Score: 1

      You forgot

      - the "article" is very poorly written, using a whole lot of words to say very little.

      --
      #DeleteChrome
    2. Re:Credibility? by Anonymous Coward · · Score: 0

      So far it seems that any comments to that fact aren't being allowed through by the blog's author.

      Most likely a paid shill spewing nonsense, but that's pretty much par for the course on Slashdot.

    3. Re:Credibility? by Nimey · · Score: 2

      Since when does Slashdot have credibility? At all?

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    4. Re:Credibility? by Anonymous Coward · · Score: 0

      - a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)

      Try DuckGoGo. :)

    5. Re:Credibility? by viperidaenz · · Score: 1

      The future hasn't happened yet, so by your definition, nothing is useful yet.

    6. Re:Credibility? by viperidaenz · · Score: 2

      Perhaps because you spelt Brett Wooldridge wrong.

    7. Re:Credibility? by Anonymous Coward · · Score: 0

      I may be breaking the fundamental rules of Slashdot, but ...
      - the "article" is a single post on a recently created blog
      - they misspell "lose"
      - a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)

      This is the very definition of "nothing to see here, move along".

      Really? Those things tells me far more. The likelihood of this being a paid NSA commercial / part of the ongoing psy-ops damage limitation (weak sauce as it is) is very close to 100%. I'm not going to point out either the extrfemely obvious reasons nor the subtle but very convincing ones (especially those) no matter how gratifying it would be to do so because the whole thing is likely automated and I feel no need to help the US power that be destroy everything that made the US great.

      I pity anyone/everyone actually named Brett Wooldrige though, must suck to see ones name on shit like this.

    8. Re:Credibility? by mu22le · · Score: 1

      In addition to this the author is blatantly ignorant about ssl and criptography:

      If you possess DuckDuckGo’s cert, you can decrypt all traffic to DuckDuckGo

      They claim NSA can decrypt all SSL traffic on a whim. They probably can obtain DDG private key if they want to, but that does not mean that anyone with the _public_ key can decrypt all SSL traffic directed to them.

    9. Re:Credibility? by Anonymous Coward · · Score: 0

      And their premise is very silly. Of course the NSA can get the data if they want it. They're way above any laws, including the constitution and the human rights declaration: nobody's in a position to reprimand AND punish the NSA.

      "If fascism ever comes to America, it will come wrapped in an American flag."

    10. Re:Credibility? by Anonymous Coward · · Score: 0

      You won't be saying that when a "sudden breakthrough" results in a perfectly working quantum computer... in 15 years. After all your files are decrypted... next year.

    11. Re:Credibility? by Anonymous Coward · · Score: 0

      I am Brett Wooldridge, I wrote the article. I have been a software engineer for 25 years, and I know cryptography extremely well. I never implied that the NSA can decrypt all SSL traffic on a whim. I never said or implied that their public key would do anything useful at all. I did point out exactly what you said, if the NSA obtains the DDG private key, which they surely can if they are determined, the can decrypt all traffic to DDG. However, more importantly, they (the NSA) doesn't have to. They have the FISA court on their side.

    12. Re:Credibility? by crazyvas · · Score: 1

      I agree that it seems to be a biased article with not much emphasis on quality. However:

      1) Slashdot likely has a higher proportion of DDG users than the general population given the interest in privacy, security, and tech here.

      2) Since there are very few DDG users in general (compared to google, etc.), it's difficult to find an opposing view to DDG's stance. An opposing view can be helpful in seeing where the problems lie, and what all a DDG user might want to be concerned about.

      Hence, even though this blog might lack any credibility at all (and its misspellings and seeming bias don't help it any), it still holds some value here on Slashdot, IMHO.

    13. Re:Credibility? by crazyvas · · Score: 1

      And even if the arguments on the blog article are poorly made or outright incorrect, my personal hope is that it would initiate a more technically correct and interesting debate here that will help us all understand DDG and similar search engines better.

      What's that? No, I'm not new here. I can still hope, can't I? :)

    14. Re:Credibility? by Rato+Ruter · · Score: 0

      I may be breaking the fundamental rules of Slashdot, but ... - the "article" is a single post on a recently created blog - they misspell "lose" - a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)

      This is the very definition of "nothing to see here, move along".

      You're misinterpreting, this guy is so good he leaves no digital footprints! =P

  6. Oh come on now... by Anonymous Coward · · Score: 2, Insightful

    This is one, gigantic, "no shit, sherlock".

  7. so what? by Anonymous Coward · · Score: 0

    Most probably google knows more about me than the NSA, making money with this information and not paying taxes, well only a bit

  8. What about Startpage? by Anonymous Coward · · Score: 2, Interesting

    Is it any safer? They bill themselves as "the world's most private search engine" but that doesn't really mean anything.

    1. Re:What about Startpage? by UltraZelda64 · · Score: 2

      I don't know, but when I want to search using queries that may bring in potentially "illegal" search results, I just use Ixquick. To be honest though, I don't know what the difference (other than name) is between the two. Both Ixquick and Startpage are run by the same people, they both look practically identical, and you probably couldn't go wrong with either one. I just happened to find out about Ixquick first and saw a few more mentions of it on different websites so I just use it. Ixquick does not log any user IP addresses. According to Wikipedia article on Ixquick, Startpage is just an "easier-to-remember" alias of the same exact search engine. Ironically, I find Ixquick's fewer letters to be faster and easier to type.

    2. Re:What about Startpage? by Anonymous Coward · · Score: 0

      Startpage.com seems to be some type of proxy that serves results from Google.

      Ixquick.com seems to use other, non-Google, sources to gather results.

    3. Re:What about Startpage? by Anonymous Coward · · Score: 0

      I don't know, but when I want to search using queries that may bring in potentially "illegal" search results, I just use Ixquick. To be honest though, I don't know what the difference (other than name) is between the two.

      Startpage just scrapes google results.

      Ixquick aggregates results from several search engines (and gives preference by how many hit the same result, as well as the result's ranking in each).

      According to Wikipedia article on Ixquick, Startpage is just an "easier-to-remember" alias of the same exact search engine.

      If so, somebody who gives a fuck should correct it -- they're manifestly not the same.

    4. Re:What about Startpage? by UltraZelda64 · · Score: 1

      Interesting. I've even done various web searches to find out what the difference between the two are, and the most I could find is that Wikipedia article. I wonder why they don't make it more clear on their own site exactly what the difference is.

  9. VPN by xtal · · Score: 4, Informative

    Run your traffic encrypted through another country with actual privacy protections.

    It's not perfect, but it is another complication and barrier to direct monitoring.

    Ultimately, the NSA reveal is a good thing - it's going to drive demand for virtual private cloud services where you hold the keys, and perhaps, a move back to corporate controlled cloud services on-site. Great news if you're in IT.

    --
    ..don't panic
    1. Re:VPN by Anonymous Coward · · Score: 1

      Great way to get marked a foreigner and guarantee for intense surveillance.

    2. Re:VPN by wisnoskij · · Score: 1

      Was that not part of the NSA spying reveal.
      The huge amount of cooperation between countries with laws that protect spying on their own citizens but not other nation's citizens?

      You route your data through a country with strict privacy laws, and that country intercepts it because their laws do not protect you, a non-citizen.
      They then allow access of that data to the NSA, and no one broke any laws.

      --
      Troll is not a replacement for I disagree.
    3. Re:VPN by Anonymous Coward · · Score: 0

      Please name for me this wonder country that will protect my rights even though I am not a citizen. Furthermore, please tell me how you guarantee that any so-named country does not already have agreements in place with the government of my own country (I am a U.S. citizen) to spy on my traffic.

    4. Re:VPN by g1nG3Rj0urNAl157 · · Score: 1

      Am I missing something really obvious? Why would you even try something like DuckDuckgo? It's only "remedy" for privacy is it's policy of not tracking users. Serious considerations for privacy would impel one to consider an anonymizing network layer such as I2P. Or if you really want relatively foolproof privacy, get a VPN connection, install VPN network monitoring software and configure your DNS settings manually.

      --
      "I like the dreams of the future better than the history of the past." Thomas Jefferson.
    5. Re:VPN by Clsid · · Score: 1

      Lol, keep spreading the FUD. There are things that can be done. They are not God you know.

    6. Re:VPN by Clsid · · Score: 1

      No country or government will protect your rights. But there is something you can do about it, like having your own small server back home and use alternative services like Yandex, etc. Yandex is a Russian company that have to comply with government requests in the same way American companies have to do back home. So as far as search engines go, you truly have to go with whatever lesser evil you are willing to tolerate. In that regard, DuckDuckGo is a good option.

      But if you get a cheap VPS server, even if it isn't as secure as having your own, it's very convenient and you don't have to rely on stuff like Dropbox/GDrive/SkyDrive, ad-supported e-mail, or internet companies with huge tracking issues like Facebook and Google. You can also use DailyMotion to try and break your dependence on YouTube.

    7. Re:VPN by AHuxley · · Score: 1

      Recall http://news.slashdot.org/story/13/07/03/1952228/mastercard-and-visa-start-banning-vpn-providers
      They can track you for been too smart and using a VPN and making easy ongoing payment interesting.

      --
      Domestic spying is now "Benign Information Gathering"
    8. Re:VPN by houghi · · Score: 2

      It's not perfect, but it is another complication and barrier to direct monitoring.

      If it isn't perfect, it means it isn't useful.

      Moving to better privacy laws or to another country means nothing. Other countries have just not yet been caught doing this. What this should mean is better encryption.

      Unfortunately what we see is that nobody really cares. How many emails have you received that were digitally signed and send by a non-geek? Ask anybody if they would trust sending their private information on a postcard. Ask the CxO of the company if they would send company information via a postcard.
      Would they accept any information that was not signed?
      Hopefully people will say no, yet that is what people do with email.

      Email is basically a postcard. Implementing digital signatures is what the IT should concentrate on. They are able to add the legal bullshit that is useless (From MY point of view, somebody send or gave me the email, so it was intended for me. Perhaps YOU did not intend it for me, but that is YOUR problem.) and instead use some CPU cycles and add digital signatures.

      That would be a great first step. It does not break the readability of the message. In the beginning you will need to explain what this means and how people could verify this. There is nothing that would stop e.g. banks and credit card companies and others in using this.

      Very soon people will suddenly notice that you can also encrypt it and send messages encrypted. When enough people use it, it will become a standard and gmail and outlook (both program and website) will start using the signatures.

      However I hear nothing about this, so I assume that nobody is seriously interested in privacy. Apathy is the great danger here. Not the NSA (or your local version). We (the people) allow them to get away with it. We are the problem and only we can be the solution.

      --
      Don't fight for your country, if your country does not fight for you.
    9. Re:VPN by Anonymous Coward · · Score: 0

      Name a country.

    10. Re:VPN by Seumas · · Score: 2

      Unfortunately, if the VPN provider is located in the US, they are compelled to comply with the government in providing access to your logs and data and anything else. They can also simply put in a shunt and siphon off a copy of your data (even without the provider even being aware it is happening, just as is likely to have happened with Google/Facebook/etc). If they are outside of the US, you'll have a hard time getting the service, since credit card companies are banning payments made to VPN providers.

      Anyway, there are things you can do to make everything just a tiny bit more of a nuisance -- that is about it. There is nothing you can really do to safeguard yourself if you somehow become a specific target, of course.

      You need to be able to trust the sites and services and systems you connect to. Good luck, there. You need to be able to trust that the government isn't tapping all data transfer with a shunt at your ISP, or as near the service as possible, or at the backbone. You need to have an encryption tunnel for your data. You need to make sure that the provider of that service is reliable and not logging data. Or isn't being tapped. And can't be compelled to hand over whatever data they *do* have. Then, you have to trust that all of the advertisers tracking you on all these sites and services aren't able to correlate your identity. That's almost impossible, since they need very few data points (mostly seemingly anonymous ones) to pinpoint who you actually are.

        You need to trust that all of this is the same about any online/cloud services you may happen to use. After all of that -- if it is all somehow accounted for -- you still have to be able to trust your operating system and your hardware. That there isn't something built into your OS or some software you are running or into the hardware itself that grants access to the government.

      And once you are sure of all of that *too* . . . you just have to be able to trust that someone hasn't infected your system directly with something and that nobody has planted something on your system. Say, while you were out of the house for awhile, one day.

      In other words, no matter what we do, we are doing the modern equivalent of setting a Windows desktop/screensaver password. It will protect you against the opportunistic coworker or nosey family member -- but provide no protection against someone who truly wants to get information on you and monitor you.

    11. Re: VPN by Anonymous Coward · · Score: 0

      i think the plant comes preinstallled with something like redmond os. no need to break in. also if you do anything that involves an elecronic money transfer your anonymity is history. as they say. the mind boggles at the computing requirment though to first keeep track of the electronic transfer And then another meta layer ontop of that. you know keep track of you keeping track ...to be honest i dont believe in a real free market anymore since there obviously is a limitation on how much can be reliabily tracked. so even maybe if u made a smart investment choice, if it doesnt fit into the computational capacity of the system it will be discarded as a .. lose.

    12. Re:VPN by allo · · Score: 1

      yeah, because everyone in the foreign country is supervised.
      Maybe you're in your own american filter bubble, looking down at the rest of the world?

    13. Re:VPN by allo · · Score: 1

      it may be a good idea anyway, to seperate processes where you are non-anonymous because of entering your details/using a login for an account with your details from your private browsing anyway. If you login to some bank account, you can use your dsl ip as well, because you will not be anonymous anyway. And you may want to seperate it, because from the moment you logged in, someone knows which vpn ip belongs to you, until you disconnect and change the ip.

    14. Re:VPN by allo · · Score: 1

      the vpn provider does not log (and keeps this promise), you encrypt your traffic. Noone will be able to identify you or read your traffic.

    15. Re:VPN by allo · · Score: 1

      sweden, ukraine

    16. Re:VPN by Znork · · Score: 1

      What would be the point of having gmail and outlook using signatures or encryption? Anything the user of those can do one can assume the NSA can do on behalf of the user. You need to be doing your encryption on secure endpoints on both ends for there to be a point. Which means no webmail. No proprietary Microsoft/Google/Apple software. None of todays smartphones. Etc.

      That's not to say it can't be done, but if you want to move beyond postcards vis-a-vis the NSA you'll have to go open source for OS and software and start using vpn's, darknets and things like i2p for communications.

    17. Re:VPN by Natales · · Score: 0

      I'm using iVPN with multihop to avoid traffic analysis. Excellent service. All my personal browsing is done from inside a VM which gets cleared at shutdown. For banking and other services that require to see your actual IP, I have a clean "banking VM" only for that purpose.

  10. Ixquick? by rycamor · · Score: 4, Informative

    At least Ixquick is not a U.S. company: https://ixquick.com/eng/prism-program-revealed.html

    While their searches aren't as fast as Google's, I have found them to be pretty good quality-wise.

  11. No PFS at DDG by Lawrence_Bird · · Score: 2

    DuckDuckGo, a search engine, has been prominent in the media since the start of the Snowden revelations due to its privacy policy which promotes anonymity. If the private key used by DuckDuckGo were ever compromised — for example if one of their servers were seized — all previous searches would be revealed where logged traffic is available. DuckDuckGo may be a particularly interesting target for the NSA due to its audience and the small volume of traffic (as compared to Google).

    This is because DDG does not use crypto algorithms which support perfect forward secrecy.

    When PFS is used, the compromise of an SSL site's private key does not necessarily reveal the secrets of past private communication; connections to SSL sites which use PFS have a per-session key which is not revealed if the long-term private key is compromised. The security of PFS depends on both parties discarding the shared secret after the transaction is complete (or after a reasonable period to allow for session resumption).

    So it would require significantly more work for NSA to deal with a site using PFS. Source: netcraft

    1. Re:No PFS at DDG by anagama · · Score: 1

      I'm trying to understand PFS having not heard of it before -- If I understand correctly, it is a system wherein a unique public/private key pair is generated on demand using a long term key. Or to put it more simply -- a system that gives every session a new and unique set of encryption keys, thus making compromise of the private key hugely less of a bonanza. If that's the case, that sounds like a great system.

      Reading your linked article demonstrates that some sites already do this ... how do I make sure I'm taking advantage of it?

      --
      What changed under Obama? Nothing Good
    2. Re:No PFS at DDG by Lawrence_Bird · · Score: 1

      Use this it details towards the bottom the ordering of ciphers.

    3. Re: No PFS at DDG by Anonymous Coward · · Score: 0

      they have pfs. check their blog

    4. Re: No PFS at DDG by Lawrence_Bird · · Score: 1

      actually, I found it in a forum post and have verified, they do now use ECDHE, clearly as a result of the netcraft article.

    5. Re:No PFS at DDG by Anonymous Coward · · Score: 0

      SSL offering at Ixquick and Startpage are way better. DuckDuckGo doesn't even support TLS 1.1 and 1.2 yet.

    6. Re:No PFS at DDG by Anonymous Coward · · Score: 0

      If I understand correctly, it is a system wherein a unique public/private key pair is generated on demand using a long term key. Or to put it more simply -- a system that gives every session a new and unique set of encryption keys, thus making compromise of the private key hugely less of a bonanza. If that's the case, that sounds like a great system.

      Why do you need a public/private key pair?

      Just use Diffie-Hellman key-exchange over the SSL public/private channel to create a symmetric key and use the symmetric key for actual data transfer.

      In any case, I don't know what the GP is talking about: DuckDuckGo has forward secrecy, it does use RC4 though which isn't a very good cipher.

  12. Blogs are not news; they're Op-Ed by Anonymous Coward · · Score: 0

    IMHO, any "story" that's clearly a blog entry should be rejected as op-ed flamebait. Slashdot devs should make this easier for the "editors" by blacklisting blockspot in the submission filter.

    With that said, I don't think anyone here is naive enough to think that federal agencies can't spy on anyone they want. My guess is that people are using DDG to make a statement. I personally don't use DDG because its results were terrible when I gave it an honest try about 6 months ago after Google briefly broke their search engine results for anyone using Adblock.

    1. Re:Blogs are not news; they're Op-Ed by Clsid · · Score: 1

      I don't know what you searched but DDG works fine for me. I have to use Bing for image search and that's it. I'm testing Yandex to see if I can replace both with that.

    2. Re:Blogs are not news; they're Op-Ed by Anonymous Coward · · Score: 0

      I have to use Bing for image search...

      !bi for bing image search from ddg
      !gi for google image search from ddg

      Maybe that's what you meant anyhow...

  13. Derp by SGT+CAPSLOCK · · Score: 1

    It's kind of tough to understand why people would think that DDG has any magic to stop the NSA from eavesdropping on it in realtime. Isn't its hosting done by Amazon to begin with? (srsly a question, idk)

    Aside from that, DDG does have its benefits. Not setting any cookies is important. Not remembering search history on their end is important. It also prefers to serve up SSL-enabled pages instead of their unencrypted counterparts. And a very beneficial feature is that it doesn't set the referrer when you go somewhere.

    But NOTHING will prevent the NSA from eavesdropping on traffic en-route if they choose to do so, given that they have the incentive to do so and the cooperation of the providers that actually matter.

  14. icons by atherophage · · Score: 1

    At least it appears DDG is trying to help with privacy. They have links on their minimalist home page which lead to suggestions for protecting your search privacy. Found out about Disconnect.me through DDG. DDG also has way cool swag [http://help.dukgo.com/customer/portal/articles/216375-t-shirts-stickers-more] on the cheap.

  15. Re:blog colors by Jeremy+Erwin · · Score: 2

    Be gentle. It's his first Blog Post.

  16. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 3, Interesting

    It's about as good as a google search and it gives the wikipedia article for any topic at the top. My opinion is better than your opinion.

  17. Re:DuckDuckGo sucks by SeaFox · · Score: 4, Insightful

    It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.

    Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia. Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.

  18. Decrypting SSL by BringYourOwnBacon · · Score: 4, Interesting

    I think the article brings up and interesting point about who's SSL certs the NSA has access to. It's reasonable to assume that they are capturing most if not all Internet traffic in the states (at the very least all packets entering or leaving the county.) What is unknown is how much of that encrypted traffic can be easily decrypted. If I were a three letter gov't agency intent on decrypting massive amounts of traffic, I would go straight for the keys. It's particularly of note that DuckDuckGo does NOT use session keys in its SSL implementation, meaning if their private key got compromised, all previous searches would also be compromised. I don't think it's too much of a stretch to assume that the NSA has found a way to that key, either through secret court orders, or good old fashioned nefarious means. Especially for a site like DDG, who makes promises of "privacy". Makes you wonder who else's keys they have access to.

  19. 100% serious question by Anonymous Coward · · Score: 0, Interesting

    When was the last time you searched for something and found it using a commercial search engine? I've never, ever found anything on search engines. I have my bookmark library (entirely non-cloud) and ask HUMAN BEINGS for recommendations when I need a new kind of software. Then I might use the search engine to find their site the first time, but that's hardly blindly searching for stuff. I always just find 100% spam, irrelevant crap and generally low-grade junk when I search for *anything*. The entire concept of searching for things in general (not counting service-specific engines) is foreign to me. It just doesn't work in my world. I don't understand what people search for that they get proper results. Or maybe they just have extremely low demands.

    1. Re:100% serious question by number11 · · Score: 1

      When was the last time you searched for something and found it using a commercial search engine? I've never, ever found anything on search engines. I have my bookmark library (entirely non-cloud) and ask HUMAN BEINGS for recommendations when I need a new kind of software. Then I might use the search engine to find their site the first time, but that's hardly blindly searching for stuff. I always just find 100% spam, irrelevant crap and generally low-grade junk when I search for *anything*. The entire concept of searching for things in general (not counting service-specific engines) is foreign to me. It just doesn't work in my world. I don't understand what people search for that they get proper results. Or maybe they just have extremely low demands.

      Maybe I just have extremely low demands. But when I want to know what a particular error message means, or if some unknown program that seems to be running is malware, or if the latest "OMG This Unlikely Thing Happened" post is true, or how to knock the password off of a protected pdf file, or how to spell "indefatigable", or where the hell "Bozy's Bar" (where the meetup is) is, or where I can get a cheap replacement bumper for my car, I use a commercial search engine. Maybe your problem is searching for "anything", I find it works much better if you have a particular subject in mind.

    2. Re:100% serious question by lxs · · Score: 2

      When was the last time you searched for something and found it using a commercial search engine?

      Three minutes ago.

    3. Re:100% serious question by gmhowell · · Score: 2

      I have to give you points for a rather interesting troll post, but I'm gonna have to deduct a few for the lack of inherent humor as well as the lack of a specific target.

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
  20. In Russia, Yandex searches YOU by tepples · · Score: 4, Informative

    DDG is a reskinned Yandex with shortcuts to search particular sites. If you don't commonly use site: searches on Google, and you can't stand Yandex, you won't like DDG.

    1. Re:In Russia, Yandex searches YOU by arth1 · · Score: 1

      Yeah, it's a search aggregator, and not a search engine.
      I used it before, but stopped, because it uses Bing, which is maed forr pepple whoo cann nott speel. When I make exact and correctly spelled search queries, I get a lot of rubbish back because Bing returns results for "similar" queries.

      Example query: iwlyfmbp deflate

      Now run this through Google and DDG and see where you get the best results.

    2. Re:In Russia, Yandex searches YOU by Caetel · · Score: 5, Informative

      DDG shows no results. Bing's only result is this post. Google has this post and and OpenQNX forum post... so, Google, I guess?

    3. Re:In Russia, Yandex searches YOU by Anonymous Coward · · Score: 0

      If you are an American and still believe in competition, you should be concerned about letting Russia know all of your thoughts by using their search engine. What you should be concerned about it not only your privacy, but the fact you're giving Russia free data through each API call DuckDuckGo makes to Yandex.

    4. Re:In Russia, Yandex searches YOU by lxs · · Score: 2

      Yes! I believe in free and fair competition so the obvious step is to let the Russians snoop on me as much as the Americans do.

    5. Re:In Russia, Yandex searches YOU by Anonymous Coward · · Score: 0

      Everyone is so focused on their "privacy", they completely overlook the fact they are giving a foreign competitior free search data. LOL

    6. Re:In Russia, Yandex searches YOU by lxs · · Score: 3, Interesting

      Not living in either country, both the US and Russia are foreign competitors with a shady track record on business ethics and human rights and politics, so it really doesn't make a difference to me. Both nations have wasted a decade bombing Afghanistan, you're both prosecuting dissidents. I have serious trouble telling you guys apart.

    7. Re:In Russia, Yandex searches YOU by AllyGreen · · Score: 1

      According to duckduckgo themselves, it comes from over one hundred sources including google, bing, yahoo etc. http://help.dukgo.com/customer/portal/articles/216399-sources

    8. Re:In Russia, Yandex searches YOU by arth1 · · Score: 1

      I incorrectly thought that when people got zero results on the combined search, they'd try each of the words separately.

      iwlyfmbp returns a boatload of WFMB radio station results on DDG, because Bing returns them. Whoever designed the algorithms for Bing was probably doing sabotage, cause you can't get that wrong by accident.

      DDG has a way to specify a specific search engine to use, but it does not have a way to exclude one. Like Bing, which is worse than useless because of how it attempts to second-guess its users, and botches it.

  21. DuckDuckGo Response by yegg · · Score: 5, Informative

    Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business. We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt. There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example. A couple other responses to things I've noticed in the comments already: --Our servers are already located around the world. European users are generally not hitting US-based servers, for example. --We do have PFS on our cert: https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com&s=50.18.192.251

    1. Re:DuckDuckGo Response by Khopesh · · Score: 4, Interesting

      Thanks, that was a nice official response to a crackpot article that should never have made it to slashdot.

      My read of that article was that nothing is really safe (which is true, but you have to be reasonable about these things) and that larger companies at least have accountability. It kindly forgets that this accountability isn't to users, it's to shareholders. DuckDuckGo protects against these larger companies, and DDG might just fly low enough under the radar to avoid the attention of the NSA.

      Keep up the good work, Gabe. If you're in the SF area, I'd love to buy you a beer.

      --
      Use my userscript to add story images to Slashdot. There's no going back.
    2. Re:DuckDuckGo Response by Anonymous Coward · · Score: 0

      Yeah, but all traffic from US and all north America has to go through the tel-co combine. I'm sure everything is secure once it reaches your servers, but there is no way to secure the traffic from local IP through the cloud server farms (like hetzner.de and mmu.nac.net) before it arrives at your server. At least not from the tel-co gang.

    3. Re:DuckDuckGo Response by Anonymous Coward · · Score: 0

      Ixquick and Startpage offer better SSL than DuckDuckGo. They have TLS 1.1 and 1.2 (DDG has only 1.0), and have enabled TLS 1.2 256-bit ciphers with a higher priority. I think they still keep RC4 for TLS 1.0 and SSL 3.0 to mitigate the BEAST attack for CBC ciphers, since 128-bit RC4 is the better devil until everybody moves to TLS 1.2.

      Ixquick/Startpage seem to have servers in both the US and Europe.

      https://www.ssllabs.com/ssltest/analyze.html?d=startpage.com&s=69.28.209.119

      https://www.ssllabs.com/ssltest/analyze.html?d=ixquick.com&s=69.90.210.8

    4. Re:DuckDuckGo Response by evilviper · · Score: 1

      Wonderful response!

      I'd also like to throw-in the fact that DDG is a big proponent of SSL as well. Their website redirects you to their SSL site, and all their search results will send you to the HTTPS version of a site, if it exists (eg. Wikipedia). Things which other search providers do not do.

      So, in the context of the NSA tapping all internet communications (which we know for a fact they have been doing since 9/11/2001: https://www.eff.org/nsa/hepting), DDG also provides much more privacy and security than any other major search engine, which don't take these steps at all.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    5. Re:DuckDuckGo Response by readingaccount · · Score: 1

      Calm the fuck down already. You don't go bashing a small-time company unless you have an ulterior motive to ensure they disappear. Which it disturbingly sounds like you're trying to do.

      Even if he said something untruthful, that's very different to being a willful lie and your rant is out of proportion.

    6. Re:DuckDuckGo Response by Antique+Geekmeister · · Score: 2, Informative

      I'm afraid I went over the top here. You may mean well for your customers, and may in fact resist unconstitutional data requests. But there is a compelling amount of legislation that is aimed _precisely_ at controlling corporate data gathering, ranging from the tax code to the SEC's regulations about business finance to the HIPAA regulations about medical information, the TeleCommunications Privacy Act and its poorly writt4en regulations bout consumer protection, and the export encryption regulations of the department of commerce. Those are not merely about what you must turn over from current records, they are about what you must keep or what you must not publish.

      CALEA is aimed at voice communications, and is not particularly relevant to this except that it was aimed squarely at controlling and preventing changes to business practices. Exemption or not for search engines, it prevented the use of new telecomm technologies that would prohibit easy wiretapping.

    7. Re:DuckDuckGo Response by sessamoid · · Score: 1

      Look, I think it's clear from the context that Weinberg was not talking about all US laws about everything, but strictly in the context of the recent NSA brouhaha revealed by the Snowden leaks. In that context, it appears he was not lying at all as that relates onto the NSA's domestic spying activities, not all corporate laws.

      Perhaps you should try decaf?

      --
      "No, no, no. Don't tug on that. You never know what it might be attached to."
    8. Re:DuckDuckGo Response by Anonymous Coward · · Score: 0

      If I had mod points, I'd mod you down. There is nothing crackpot about that article. It is actually spot on. You on the other hand sound like a "DuckDuckGo" shill.

    9. Re:DuckDuckGo Response by Anonymous Coward · · Score: 0

      Hi, this is Brett Wooldridge, author of that blog post. I addressed this in your reply to the blog, but I'll address it here directly for the SlashDot users. Simply put, you are badly mistaken about "all the existing US laws". I suggest to you and the readers here that you kindly read this article and see if you still hold to your interpretation of US laws:

      http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-forces-net-firms-to-cooperate-on-surveillance/

    10. Re:DuckDuckGo Response by Zontar+The+Mindless · · Score: 1

      Hi, Brett. :)

      --
      Il n'y a pas de Planet B.
    11. Re: DuckDuckGo Response by Anonymous Coward · · Score: 0

      Yeah, "things which other search providers do not" -- except other search providers like ixquick that do.

      DuckDuckGo has exactly one benefit over ixquick -- the !foo special searches. From every other perspective, ixquick is as good or better. Personally, I've not much use for !foo; I've already got my browser capable of defining keyword searches. But if you do use that feature, I can see why you might go with DDG. But if you did know about ixquick, lying about the competition seems pretty low. And if you didn't know about ixquick, maybe you should step back and consider the "ddg is the one true way" marketing/propaganda and how you swallowed it hook, line, and sinker. Maybe just a little skepticism toward corporate marketing would be in order...

    12. Re: DuckDuckGo Response by evilviper · · Score: 1

      After 2 minutes playing with ixsearch, I find the results to be TERRIBLE, and have no interest in using it further. Anyone can put together a crap search engine overnight, it takes a lot of work to make it "good" and they haven't done that.

      And when I talk about search engines, I don't pretend I've used every single one that has ever existed... I was just referring to the most popular ones, and ixsearch doesn't remotely qualify.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    13. Re:DuckDuckGo Response by Znork · · Score: 1

      As most users trust their browsers for SSL verification it is of limited use against entities like the NSA. They certainly have their own signed certificates for any site they're interested in intercepting and thus could easily man-in-the-middle any session they're interested in.

      Of course, that's most useful in targetted surveillance and much less useful in the dragnets where it'd most likely get noticed reasonably fast.

      But against government sponsored entities any hierarchial trust such as SSL is fundamentally flawed as they can simply compell the issuing of false certificates.

    14. Re:DuckDuckGo Response by Anonymous Coward · · Score: 0

      The comments in this thread unfortunately indicate the opposite - DDG's employees are blatantly shilling with multiple accounts. They have been known to use unscrupulous methods on reddit to promote their little project (like a fake TIL by the founder and spread lies about other search engines regarding referrer key words).

    15. Re:DuckDuckGo Response by evilviper · · Score: 1

      could easily man-in-the-middle any session they're interested in.

      Yes, but MiTM is the complete opposite of "tapping all internet communications", which is what I said SSL protects against. Are you disagreeing someone else here?

      If the NSA is interested in you, they'll just send a couple spooks to break-in to your house and install key-loggers, so the SSL trust thing isn't that relevant to most individuals.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  22. Why was this posted? by Anonymous Coward · · Score: 0

    Article has nothing to do with title. No supporting evidence either. Author obviously has done no research and throws a bunch of hypothetical nonsense against Weinberg. Thumbs DOWN.

  23. Re:blog colors by 93+Escort+Wagon · · Score: 2

    I found it funny that, right there at the top, there's a big proud "Ads by Google" link. There's nothing wrong with that per se, but it does color one's perception when the blogger is basically saying "sure Google is cooperating with the NSA, but they're a lot bigger than DuckDuckGo" (for whatever reason we should care about that).

    I switched to DDG a few weeks ago, but it had more to do with my changing perception of companies like Facebook and Google than it did with any idea the move would somehow deter the NSA from snooping on me.

    --
    #DeleteChrome
  24. Re:DuckDuckGo sucks by poetmatt · · Score: 2

    what do you expect? it's bing. Since when did people believe a microsoft-based search is privacy friendly? "anonymous" is just a hilarious misnomer.

  25. I defaulted all my browers to DuckDuckGo by Anonymous Coward · · Score: 0

    About four hours ago and saved off a new image so they'll stay that way on restore. I care less about privacy that redirecting money away from Google.

  26. The world's most virtuous whore by ulatekh · · Score: 1

    They bill themselves as "the world's most private search engine" but that doesn't really mean anything.

    It means about as much as "the world's most virtuous whore".

    --
    "Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
  27. Dice by Anonymous Coward · · Score: 0

    Slashdot: Illusion of Content

  28. Speculative and inaccurate opinion piece by PureRain · · Score: 2, Informative

    I feel compelled to let anyone here who has not RTFA to not bother. It is a poorly written blog entry that's nothing but hyperbole and speculation. It's also badly researched and contains a lot of inaccuracies. One of the commenters is the CEO of DDG and he corrects some of the misinformation.

    I've been using DDG for 2 years and it is great. Not always as good as Google but a good alternative for most searches. Make sure you set it to your region (settings).

  29. Larger picture... by Shoten · · Score: 3, Insightful

    So, the majority of the population now realizes that their activity is in some way monitored, and they wish to evade that monitoring. They need to consider this: they are amateurs playing for nickel stakes in this game. The NSA doesn't care about them, and the people aren't used to playing this game either, for their part. This game exists, at the moment, primarily between the most sophisticated intelligence apparatus in human history and a very small population that is doing everything they can possibly do to hide. We think that using airgapping a network and using USB drives simply to move data across the room is a powerful security measure...these guys used USB drives to move data between countries, and even that wasn't good enough to protect them. The average citizen merely worries about some amorphous knowledge of their habits...the real target population faces death, or perhaps even worse internment in a black site somewhere for years first. And that population has been working on hiding for quite some time now; this is not a new game just because the rest of us know it's being played now.

    So...with that context, why would anyone think that simply using a different search engine fucking matters?

    --

    For your security, this post has been encrypted with ROT-13, twice.
    1. Re:Larger picture... by Anonymous Coward · · Score: 0

      Because this is Slashdot. People here think so highly of themselves as to believe that NSA or any other spying organization gives a shit about their gay porn activities, blatant Linux/Google cocksucking, or any other man titted bullshit that occurs here.

    2. Re:Larger picture... by Anonymous Coward · · Score: 0

      It doesn't matter because NSA's facial reaction will always be the same on the type of shit I look up in google images. Goatse doesn't even begin to describe the horror. I welcome the entire census of neticens(sp?) to do the same.

    3. Re:Larger picture... by Anonymous Coward · · Score: 2, Insightful

      why would anyone think that simply using a different search engine fucking matters?

      It may not. But anything that makes more work for the secret police is a good thing.

      (If you object to the NSA being called "secret police", remember that they turn over any evidence of crimes that they find to other police agencies. They don't have "active" agents, they don't torture like the Gestapo, the US has other organizations to do that, they're more like a department of the Stasi.)

    4. Re:Larger picture... by Anonymous Coward · · Score: 0

      If nothing else, to punish Google and other companies that choose to be a part of the "team sports".

    5. Re:Larger picture... by SigmundFloyd · · Score: 1

      The NSA doesn't care about them

      Yeah, carry on and pay no attention to the man behind the curtain.

      --
      Knowledge is power; knowledge shared is power lost.
    6. Re:Larger picture... by Anonymous Coward · · Score: 0

      Fully agree, all this talk about switching providers is only to make people fell better with themselves.

      Anyone with experience living in places where secret services/police matter, know that people are being too naive.

  30. A Dubious Article by Kplx138 · · Score: 2

    Apparently all you need to get front page on slashdot is an article with one link to a blog, that has only one post, created by a random user. Hell the 3rd paragraph of the article beings with 'TL;DR' a phrase I associate with image boards such as 4chan than I do actual journalism and news. While the article is somewhat interesting it's nothing more than an op-ed piece or a letter-to-the-editor at best or some anti-DDG fud created by some PR firm at worst.

  31. Re:DuckDuckGo sucks by Trepidity · · Score: 2

    I like to think that would be true, but honestly about 50% of the things I click on in a Google search are Wikipedia articles, even when I didn't initially search Wikipedia directly.

  32. Re: DuckDuckGo sucks by Anonymous Coward · · Score: 0

    Still wasting time navigating to websites, eh?

  33. the NSA doesn't care about them?? by transporter_ii · · Score: 2

    > .these guys used USB drives to move data between countries

    Look, if anyone with any sense can bypass the snooping, they must know that. That only leaves *us* that they are snooping on.

    --
    Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
    1. Re:the NSA doesn't care about them?? by Shoten · · Score: 1

      > .these guys used USB drives to move data between countries

      Look, if anyone with any sense can bypass the snooping, they must know that. That only leaves *us* that they are snooping on.

      I notice how you conveniently change what I said by omitting the second half of the sentence: "...and even that wasn't good enough to protect them." So no, that does not leave *us* that they are snooping on. And also, your premise assumes that no new targets come up, that there's no reason to snoop on other nations, and that no nations ever change sides from friendly to hostile (like happened with Venezuela, Belarus and the Ukraine and is happening with Argentina, for example).

      Compare the value of a terrorist organization or hostile nation state to an average American, and you'll see that there's absolutely no comparison in terms of targeting. Even with their massive budget, the NSA still has finite resources and capability. They can't spy on everyone at once, even when they're grabbing all the data, any more than a librarian at the Library of Congress can read every book in the building.

      --

      For your security, this post has been encrypted with ROT-13, twice.
  34. You're kidding, right? by Anonymous Coward · · Score: 0

    At least it appears DDG is trying to help with privacy.

    You're kidding, right? They're a Union Square Ventures startup, which is a Fred Wilson VC funded fund.
    http://en.wikipedia.org/wiki/Fred_Wilson_(financier)

    Chase Capital Partners as the sole active LP. This is JPMorgan/Chase Bank:
    http://en.wikipedia.org/wiki/Chase_Manhattan

    This is one of the "Big Four" ... these guys got $25B in TARP funds in the Wall Street bailout because they were "too big to fail":
    http://projects.propublica.org/bailout/list

    These guys collect more information on people than God. When the Pope wants to know something, instead of praying, he calls up these guys.

  35. Tor and Hidden Service by UnsignedInt32 · · Score: 2

    They have an exit enclave for DDG search engine traffic and also hidden service at 3g2upl4pq6kufc4m.onion...
    So there at least they provide some additional layer of protection for those who are needed.

    1. Re: Tor and Hidden Service by Anonymous Coward · · Score: 0

      Use the tails operating system to minimise your risk of unmasking yourself when browsing the net using tor. Their advice is to boot Tails from a Live CD.

  36. Re:DuckDuckGo sucks by Aighearach · · Score: 1

    aka "go fish"

  37. Re:DuckDuckGo sucks by Aighearach · · Score: 1

    I just add "wiki" to the end of my search and wikipedia will be in the top 3

  38. Wait one second by mpbrede · · Score: 1

    The source link for the article is a new blog with one (yes, count it, one) post?? I call fowl.

    1. Re:Wait one second by Hypotensive · · Score: 1

      Cluck, cluck.

  39. Re: DuckDuckGo sucks by Anonymous Coward · · Score: 0

    navigating...
    and are you still using netscape?

  40. DuckDuckGo Rocks, Google must be hurting by Anonymous Coward · · Score: 2, Insightful

    DuckDuckGo should move out of USA (and UK) at this point. They could have a huge business, but not in NSA occupied territory.

    1) The reason I switched was because it doesn't use tracking cookies.
    2) It doesn't own Android, Gmail, Youtube Adsense Doublclick Maps or a myriad of other sides that can be used to 'un-proxy' me and 'un-NAT' me and get around my cookie blocks.
    3) It is https so the NSA *need* a warrant, unencrypted search automatically goes into the NSA database.
    4) Gmail failed a link test, a disguised link (not a straight http://...) sent from my old gmail account to a pop3 was visited by a server in Arizona.
    5) They don't have a feed to NSA currently, its not listed on PRISM

    But best of all

    6) It's actually quite good at finding stuff and better than Google at finding job CVs from NSA spooks to see what else they might want to confess to. Google is keeps substituting more popular works.

    I assume from this piece that Google are suffering. Well, point 2) is entirely their fault, they linked all that data together so I have little sympathy for them.

    I don't like being tracked for daring to question the legality of an illegal mass surveillance program, and Google's can always move their business out of mainland USA and to Hong Kong where they are on the other side of the great spywall of NSAland.

    1. Re:DuckDuckGo Rocks, Google must be hurting by allo · · Score: 1

      > 3)
      do not trust https. The NSA will have the power to sign certificates on at least one CA which is in all browsers.

    2. Re:DuckDuckGo Rocks, Google must be hurting by TheLink · · Score: 1

      Use firefox with certificate patrol and disable the CAs that you don't trust.

      On Windows Chrome and IE use the same cert infra. Go delete a CA's cert and then go visit the CA's https website with Chrome/IE. Watch the cert get readded ;).

      --
    3. Re:DuckDuckGo Rocks, Google must be hurting by allo · · Score: 1

      so, which one do you trust? And how do you authenticate sites, which are only signed by untrusted CAs?

      The whole CA system is broken, because there is no real trustpath to the site. Do you even know, if your download of firefox was clean, or if a MITM inserted some bad CA, which is not part of the default firefox?

    4. Re:DuckDuckGo Rocks, Google must be hurting by Anonymous Coward · · Score: 0

      0) It's a matter of probabilities. You're unlikely to get MITM all the time.
      1) Certificate patrol would warn you of the "bad CA" and of certificate changes.
      2) If you're paranoid you can take the effort to get the cert fingerprints directly from the organization. This may take a few days or longer.

      Some organization private keys might be accessible to 3rd parties - this could be for performance monitoring or troubleshooting or caching etc. Or for spying. But if the organization is already letting 3rd parties spy on your traffic, they could just give the 3rd parties info in other ways - the servers are theirs after all.

  41. Use it via Tor hodden service by gweihir · · Score: 1

    Sure, the NSA still gets what you search for and the results, but unless they have control over the Tor network (which is doubtful), they cannot associate that info with you.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    1. Re:Use it via Tor hodden service by fulldecent · · Score: 1

      Tor fails against an adversary that has access to the transport of all traffic

      --

      -- I was raised on the command line, bitch

  42. Huh by Anonymous Coward · · Score: 0

    Duck Duck WTF

  43. To hide the referrer by Anonymous Coward · · Score: 5, Interesting

    To strip off the referrer. Otherwise the end site would see the URL of the DuckDuckGo search revealing the details of the search, page, etc.

    1. Re:To hide the referrer by jones_supa · · Score: 1

      But that still tells DuckDuckGo which page you went to. We can't be sure if they store that information. It's better if you can simply disable sending the referrer information from your browser.

    2. Re:To hide the referrer by sydneyfong · · Score: 1

      I've found a pointing the link to a datauri encoded html page with a meta tag to redirect works pretty well.

      --
      Don't quote me on this.
    3. Re:To hide the referrer by Anonymous Coward · · Score: 0

      The referrer is stripped automatically when you leave a HTTPS site for a HTTP site or a different HTTPS site.

  44. My next network protocol... by OrangeTide · · Score: 1

    The headers in my next protocol will use identifiers, like any ther protocol. except my identifiers will be: JIHAD, NUKE, SARIN, INFIDEL, ...

    It's about time to apply techniques similar to Culture jamming to these spying tactics. It probably won't stop them, but we can at least try to piss them off.

    --
    “Common sense is not so common.” — Voltaire
  45. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 1

    It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.

    Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia. Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.

    Oh, I agree, but it's worse than that.

    Not only does DDG put that "helpful" wikipedia excerpt/link at the top of their search results, but if you install the "DuckDuckGo Plus" Firefox extension, they will intercept your Google search, and cram that box in your Google search results as well. I get that some people may want that functionality (I don't -- if I use Google, it's because I want to see exactly what Google returns), but it's questionable to have this sort of content injection enabled at all in an extension whose primary purpose is to add a search engine to the search-bar, search completions, etc. lists, not to perform content injection. And it's downright evil to have it enabled by default, but I guess they think I should consider myself lucky they permit me to turn it off at all...

    Yeah, no thanks, DuckFace. I'll stick with ixquick.

    My other complaint with DuckDuckGo is that they use redirects to search results, just like Google. (Ostensibly, a purpose of these is to prevent information about your search leaking through the referer header -- in practice, https accomplishes that automatically, but the redirects do let the search engine monitor what you click on.) No, I don't think DDG is logging the redirects in a user-identifiable way, but why should I have to trust them (with anything beyond the query itself) when I can use ixquick which links directly to the results?

  46. Re:DuckDuckGo sucks by Clsid · · Score: 4, Informative

    I don't know but if you do not want to use Google, DuckDuckGo is by far one of the best alternatives. Try doing temperature, currency conversions with DuckDuckGo, the integrated results from WolframAlpha are pretty good. The only thing is missing is image search imho.

  47. Re:DuckDuckGo sucks by Clsid · · Score: 1

    haha same here. Although on Safari I have the keywords extension installed so I can type w and then whatever I want, and the search goes directly to wikipedia.

  48. Usual Slashdot trolling by Anonymous Coward · · Score: 0

    DuckDuckGo has NOTHING to do with hiding from the NSA, and the owners of Slashdot know this. The privacy offered by services like this is against common or garden abuse of your search history by ordinary establishment agencies like the police.

    It is standard operating procedure today for any person under OVERT government investigation to have their computer seized, and to have Google et al provide details of that person's search history. If that target has been a careful user of services like DuckDuckGo, their search history CANNOT be discovered. This being so, why is Slashdot attempting to downplay the usefulness of such services? Do you really have to be told?

    The owners of Slashdot, with ZERO legal necessity, disconnected the citizens of Iran from all the open-source services they provide. Slashdot is the establishment, and the owners of Slashdot willingly participate in ALL black propaganda ploys designed to make people less careful online. We see the same phenomenon with US TV shows made today. There is a total BAN on shows reminding people that their cell phones are tracked in real-time so long as the phone has a powered battery. GPS like functions have been a legal requirement for all phones sold in the USA for years now, but the TV networks have agreed to NEVER remind the viewers that their phones provide law enforcement with a constant trace on their location.

    Indeed, so insane is this rule, that there was a recent episode of the American version of 'Shameless' where the plot revolved around finding a person with a cellphone who was trapped in a lorry somewhere. The story included characters who were supposed to be technical experts, but not once did they suggest using the location tracking ability of the phone. You are probably stupid enough to disbelieve me (regarding the ban) but pay attention to any recent US TV show, and you'll see what I say is true. Much older shows, before the ban, of course frequently had the storyline using the location tracking feature, but the government has ALWAYS been concerned about TV shows 'educating' potential criminals.

    Watch any popular show with criminal activity, and you'll see the characters ALWAYS do it wrong (by design). Realistic depictions of criminal methods are not allowed on shows popular with the sheeple. Your government calculates that far more (dumb) criminals will be caught as a result of their cell phone use if TV shows fail to remind people how the technology really works.

    On a similar note, the owners of Slashdot would like to remind you that using encryption is a waste of time, because the NSA has magic computers that can crack any encryption, and using proper software methods to erase information on hard-drives is pointless, because data recovery teams have magic surface scanning technology that can reconstruct any erased data.

    Yes, Slashdot uses that old psychological method known today as FUD. And sadly, this method does discourage a significant number of people from engaging in best practises, which is why Slashdot runs these stories.

    1. Re:Usual Slashdot trolling by lxs · · Score: 1

      The weekend sure does bring out the crazy. You know these days your paranoid delusions are bland and boring compared to the shit going on in consensus reality. Seek help.

  49. Tor onion router end point by Norny · · Score: 3, Interesting

    Name me another major web search engine with an official Tor onion endpoint. DDG is the only one I know.

    https://3g2upl4pq6kufc4m.onion/
    https://3g2upl4pq6kufc4m.tor2web.org/

  50. Re: DuckDuckGo sucks by Torodung · · Score: 1

    If clicking a bookmark or using a Firefox search assist is navigating, then yes. You make it sound like he's typing in the URL.

  51. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 3, Informative

    The only thing is missing is image search imho.

    Use ixquick.

    Actually, use ixquick (or its sister site startpage) for all the other stuff, too.

  52. Re:blog colors by Clsid · · Score: 1

    I have been using DDG for quite a bit, but its lack of image search is a little bit inconvenient. I'm testing Yandex to see if I can use it for everyday stuff.

  53. My Major Concern with DuckDuckGo by Anonymous Coward · · Score: 2, Insightful

    I have been using DuckDuckGo for some time now but stopped lately because I notice something fishy. When you hover over a link the bar at the bottom of the screen displays the link address to make you believe clicking on that link will go to that address, but if you look closely at it when you click it flashes "Sending Request..." then "Waiting for https://duckduckgo.com/" and finally "Waiting for https://what-you-clicked.com/". So they are redirecting all the search results so they know who clicked what. Great. There is no reason a company dedicated to privacy would be using any type of redirect, they should take you directly to the page you clicked simple as that.

    1. Re:My Major Concern with DuckDuckGo by jones_supa · · Score: 1

      This is true.

    2. Re:My Major Concern with DuckDuckGo by heypete · · Score: 4, Informative

      It's so their system will strip out referrals, thus increasing your privacy: the site you end up on won't know what search terms you used to get there.

    3. Re:My Major Concern with DuckDuckGo by Anonymous Coward · · Score: 0

      It's so their system will strip out referrals, thus increasing your privacy: the site you end up on won't know what search terms you used to get there.

      While that is likely true, they could accomplish the same thing by using POST to submit search queries so that the search terms aren't a part of the URL.

    4. Re:My Major Concern with DuckDuckGo by Anonymous Coward · · Score: 0

      There are significant problems with using POST; it breaks a lot of history / back button functionality, bookmarks and the ability to save or email search URLs. Might be a nice idea as an option for the paranoid though.

    5. Re:My Major Concern with DuckDuckGo by Anonymous Coward · · Score: 0

      But referrers are already stripped when the referring page uses HTTPS. The web browser does this automatically.

    6. Re:My Major Concern with DuckDuckGo by Ash-Fox · · Score: 1

      It is only stripped if the new page is on HTTP. If it's HTTPS, it will retain the referrer header.

      --
      Change is certain; progress is not obligatory.
  54. Startpage by flyingfsck · · Score: 1

    There are many similar services in other countries. Startpage is hosted in the Netherlands for example.

    --
    Excuse me, but please get off my Pennisetum Clandestinum, eh!
  55. NSA or Russia? by Anonymous Coward · · Score: 0

    DuckDuckGo is partnered with Yandex (top Russian search engine). Do you want your search data being viewed by the NSA or Russia? Choose one, or find another search engine.

  56. Re:DuckDuckGo sucks by Stoutlimb · · Score: 2

    I've never tried DuckDuckGo, but did today because of this article. I chose a type of search that I do often and tried it on Duck, Google, and Bing. (Searching for a specific string on a large forum website.) Google, my usual favourite, came in last. Middle was Bing, and for some reason, DuckDuckGo was the best, and found things for me I had never before known about. I was mildly impressed. I know this is totally anecdotal, but it made me happy. That, along with the slightly better privacy, made me switch today. Also, I think it's important to punish Google for rolling over for the US government. They were somewhat good at standing up to the Chinese government for privacy issues, yet did nothing when the USA decided to do far worse. In my opinion, they've lost every bit of good will they've gained with their "don't be evil" slogan and policies. They're no better morally than Goldman Sachs, Monsanto, or Microsoft, the slow slide into corruption is now complete. On to the next underdog...

  57. SSL protects the search queries? by cyberjock1980 · · Score: 1

    Probably going to get modded down for asking such a simple(stupid?) question.. I've never been able to find this answer though.

    From the article:

    However, DuckDuckGo is using SSL encryption. Without DuckDuckGo's private SSL certificate, your search queries (but not your location) are invisible.

    Can someone clarify this for me? I want to make sure I understand this. If I search for "Star Trek" in Google then I get redirected to

    https://www.google.com/search?q=star%20trek&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=np&source=hp.

    Naturally, "star trek" is the search if you are only provided that address. It also clearly shows that I am using firefox. Does SSL protect the actual web address from being sniffed without Google's SSL master cert?

    If so, then its safe to assume that my cable internet provider could see that I'm using google(based on the IP address of the traffic) but can't tell that I might be a hardcore Trekkie or that I'm using Firefox(at least from the link.. surely they could sniff traffic from elsewhere and determine my user agent string). Is this correct?

    So how do I determine what actually is protected by SSL and what isn't? Is there a cheat sheet somewhere? I've always been curious about this but I don't want a 4 year degree in network design...

    1. Re:SSL protects the search queries? by mat8913 · · Score: 2

      Yes, your ISP will be able to tell that you are using Google from the IP address but all of the communication (that includes the web address) should be encrypted.

    2. Re:SSL protects the search queries? by AHuxley · · Score: 1

      http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html
      "for example if one of their servers were seized — all previous searches would be revealed where logged traffic is available." is the real worry long term.

      --
      Domestic spying is now "Benign Information Gathering"
  58. DuckDuckGo and Blekko are Russian Yandex by Anonymous Coward · · Score: 0

    Give American Google all your search data or give Russian Yandex (DuckDuckGo/Blekko) all your search data.

  59. Ridiculous by Anonymous Coward · · Score: 0

    When has DDG ever claimed to be a counter for federal tracking? Hint: NEVER. Their main selling point is twofold:

      1. Do not get "search bubbled"
      2. Do not get tracked by advertisers

    If you don't want to be tracked, use TOR. Anyone with half a fucking clue how the internet works would understand that DDG isn't doing shit to prevent federal tracking, and was never designed to in the first place.

  60. Derp by Anonymous Coward · · Score: 0

    What makes you all think Yandex (DuckDuckGo) doesn't share their data with the NSA?

  61. When I'm being nefarious by adolf · · Score: 1

    When I'm being nefarious and Googling things, I use a dedicated local machine which knows nothing about me, and which has all of its Internet traffic routed through a country (over a VPN) that I do not expect trouble from.

    My VPN provider does not keep logs. I fire up a browser (on that VPN-connected machine) with Private Browsing turned on, and do my nefarious things with plain-old Google.

    I disconnect and reconnect to the provider periodically, which flushes the state and the connection relationship I have with them.

    Not that I look for anything particularly wrong or harmful, but my desire to learn is powerful, and I simply do not want to be restrained in the future for being curious now.

    The only attack I'm aware of, given this scenario, is timing-based: If the NSA were watching my local address and the off-shore VPN'd address, a correlation could be made between the timing and size of some packets.

    But if OpenVPN had random padding and latency abilities, even a timing-based attack would be impossible. (Indeed, I might just suggest this to them.)

    1. Re: When I'm being nefarious by Anonymous Coward · · Score: 0

      I use att uverse. When I connect to the VPN of the Canadian investment bank I.work for, a subseof my contacts *immediately* get knocked offline. Trigger based bullshit

  62. Slashdot sucks by Anonymous Coward · · Score: 0

    After deleting and hiding my posts about the connection between DuckDuckGo, Russia and Yandex, I have now pointed Slashdot.org to 0.0.0.0 in my hosts file.

    1. Re:Slashdot sucks by Anonymous Coward · · Score: 0

      How did they hide the posts after deleting them? I'm genuinely curious.

    2. Re:Slashdot sucks by Anonymous Coward · · Score: 0

      After deleting and hiding my posts about the connection between DuckDuckGo, Russia and Yandex, I have now pointed Slashdot.org to 0.0.0.0 in my hosts file.

      That's the mating call for APK and you've just used it. /facepalm

      He'll be here shortly.

  63. There is a real difference by iamacat · · Score: 1

    If DDG doesn't store data persistently or share cookies with other sites, NSA would have to dedicate a data center bigger than DDGs own one to store all searches and subsequent clicks if they are needed later. They would then only have IP addresses which would be hard to resolve to identities of foreign users they are most interested in. They would never be able to scale this to EVERY popular site in existence.

  64. NSA be damned.... by hotrodent · · Score: 1

    I use DDG because [a] it's simply not Google, [b] the CEO posts on slashdot, [c] they're clear about what they do and don't do, and [d] they have a cool bow-tie wearing duck as their mascot!

  65. Microsoft has a log of every DDC search ... by Anonymous Coward · · Score: 0

    DDC sends every search request (including the search term and your IP) to Microsoft to see if Microsoft has any advertising for DDC to show. And we all know that Microsoft and the NSA are good friends. So when DCC say they do not track it may be correct, however they do send your data to a company that does track.

  66. Re: DuckDuckGo sucks by SeaFox · · Score: 1

    Actually, I have a Quick Search set up on Firefox for it.

  67. Re: DuckDuckGo sucks by SeaFox · · Score: 1

    If be "navigating" you mean typing "wiki (search term)" in my address bar, causing the Quick Search I have set up in Firefox to automatically run it through Wikipedia and take me straight to the results, then yes.

  68. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    That's a feature Firefox has had built-in since version 2.something.

  69. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Try bookmarking this:

    http://en.wikipedia.org/wiki/Special:Search/%25s ...and then make "wiki" the bookmark's keyword.
    Now start typing your search in the address bar and make "wiki" the first word.

  70. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Oh, I agree, but it's worse than that.

    Not only does DDG put that "helpful" wikipedia excerpt/link at the top of their search results, but if you install the "DuckDuckGo Plus" Firefox extension, they will intercept your Google search, and cram that box in your Google search results as well. I get that some people may want that functionality (I don't -- if I use Google, it's because I want to see exactly what Google returns), but it's questionable to have this sort of content injection enabled at all in an extension whose primary purpose is to add a search engine to the search-bar, search completions, etc. lists, not to perform content injection.

    Why not set up Quick Search bookmarks for every engine and get rid of the search bar (and those extensions)?

  71. Re:DuckDuckGo sucks by WGFCrafty · · Score: 1

    I like to think that would be true, but honestly about 50% of the things I click on in a Google search are Wikipedia articles, even when I didn't initially search Wikipedia directly.

    I feel the same. Google's search is better, and it could be when searching about, say, wagon wheels, there is a more definitive site than wikipedia.

  72. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 0

    please, tell us more

  73. Re: DuckDuckGo sucks by Anonymous Coward · · Score: 0

    Just make a greasemonkey script to blast away the url redirect. There is one for google already

  74. The NSA Canâ(TM)t Lose by Taco+Cowboy · · Score: 3, Insightful

    I read TFA, and the paragraph title "The NSA Canâ(TM)t Lose" really irked me.

    But, as an American who knows that my own government has turned into a cabal, I know that it is the reality.

    I used to be proud as an American. Used to be.

    Now, I hang my head low, feeling so powerless, so ashamed.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:The NSA Canâ(TM)t Lose by craigminah · · Score: 2

      Ironic you chose those wordsthe First Lady was, "for the first time in her life", "proud to be an American." I think we the people need to speak our minds and let The Man know we don't want to give up our rights as Americans. Doesn't this mean the terrorists are winning if their actions cause our government to infringe on our rights?

    2. Re:The NSA Canâ(TM)t Lose by Dcnjoe60 · · Score: 1

      Ironic you chose those wordsthe First Lady was, "for the first time in her life", "proud to be an American." I think we the people need to speak our minds and let The Man know we don't want to give up our rights as Americans. Doesn't this mean the terrorists are winning if their actions cause our government to infringe on our rights?

      Except that the infringement of rights was occuring even before 9/11. Using terrorist and national security as the reason are only ploys to keep the public at bay. So, technically, the terrorists aren't winning, because all the surveilance and infringement doesn't have anything to really do with them. They were just a means to an end by those in power.

    3. Re:The NSA Canâ(TM)t Lose by craigminah · · Score: 1

      The government is using "terrorism" as a buzz word to do what they want. I don't care if President Bush or Obama started it, this isn't an issue based on political parties. I do think programs like these have grown and they are always justified by "hunting terrorism." When the Director of National Intelligence, Mr. Clapper, tried to explain away and justify the NSA program he cited it's effective use vs terrorism.

      What other reason is there other than distrust of Americans and I don't think they will go that far.

      I don't think these programs are inherently bad, but they need a lot of oversight to prevent them from devolving into a big brother state...that's all. I still love my country but we (e.g. average citizens) need to let our elected representatives know what we want, and if being watched is ok with the majority of citizen, then so be it. I don't mind too much but I don't want to see drones spying on Americans.

    4. Re:The NSA Canâ(TM)t Lose by doccus · · Score: 1

      Yes, the First lady wasn't yet the first lady at the time, but just a black woman who had seen firsthand the terrible way things really were, and made the mistake of speaking her mind. She hasn't repeated *that* mistake!. The prez also appears black, but has betrayed those of every creed and color. I would have been a lot happier if Jesse Jackson Jr had been the first black US president...

  75. welcome to PENIS search by Anonymous Coward · · Score: 0

    where a script runs all day search for penis and when i actually do a search it just encrypts the text and result to me.
    every day you get a new trigger word the nsa needs to look for like , BOMB , TERRORIST....MURDER , KILL , JIHAD....FUCK
    and more....

    this brand new service will be offered by your most trusted AT&T whom uses the system to remove all your copyrighted material and hands you over to hollywood and the fbi ( whom due to the loads encountered must stop all other criminal investigations to start going after that lone music tune downloader)

  76. Re:DuckDuckGo sucks by ssam · · Score: 1

    I use duckduckgo's !bang feature https://duckduckgo.com/bang.html

  77. NSA SEEKS help? by Anonymous Coward · · Score: 0

    you asking the spying sacks a shit to stop so then the people aren't looking over there backs even when doing no wrong?
    YA SEEK HELP NSA AGENTS YOUR PARANOIA WILL DESTROY YA

  78. DuckDuckGo is hosted in America by allo · · Score: 1

    any further questions?

  79. Re:DuckDuckGo sucks by allo · · Score: 4, Insightful

    if you search for something, you may want to have web-results and wikipedia. When DDG displays you an excerpt from Wikipedia (like a Definition of your term), it may be enough, so you do not need to open wikipedia, but read it just before reading the rest of the search results.

  80. Re:DuckDuckGo sucks by allo · · Score: 1

    why the Special Search? Its just one page more ... try using:
    http://en.wikipedia.org/wiki/%25s

  81. Re:DuckDuckGo sucks by allo · · Score: 1

    who needs such plugins? I did not install it either, just as i do not install stupid toolbars. Some people may want it, but noone is required to use it.

  82. Re: DuckDuckGo sucks by Anonymous Coward · · Score: 0

    GP here -- I never installed it either; I discovered this antifeature on someone else's computer. But the point is, if you write an evil extension, I'm gonna hold you responsible and (to the extent feasible) quit using your other services, whether or not they appear evil, because it means you're a {person,organization} who can't be trusted to make correct judgement calls.

  83. so ? by Tom · · Score: 1

    Even if it would do just that, it would still be a step in the right direction.

    --
    Assorted stuff I do sometimes: Lemuria.org
  84. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 0

    Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.

    It is when Wikipedia's search is bloody awful, leading you to go to a search engine to find what you're looking for. Honestly, if you don't know the exact title of the page you're looking for, finding it via Wikipedia is fairly difficult. It becomes impossible if you don't know how to correctly spell what you're looking for. However, type it into duckduckgo and you get the Wikipedia page you want right at the top.

    Granted, maybe Wikipedia's search has improved. I haven't bothered to use it since two years ago when I discovered that using duckduckgo was far easier.

  85. Re:DuckDuckGo sucks by BrokenHalo · · Score: 1

    Even when I'm specifically searching for Wikipedia articles, I usually find a Google search including "wiki" much quicker than Wikipedia's search. I guess it's a simple matter of how much money can be spent on great servers.

  86. Re:DuckDuckGo sucks by BrokenHalo · · Score: 1

    what do you expect? it's bing.

    On what do you base that statement? (I have only played with DDG briefly, and found it OK, but bing is total crap).

  87. biggest probelm the framers left us with... by Anonymous Coward · · Score: 0

    The framers of the Constitution made a flaw that we're beginning to see the consequences of this error:

    Civil vs. Criminal.

    A violation of the U.S. Constitution is considered a civil issue rather than a criminal issue. Today, you have to sue
    to enforce it. Had it been codified as a criminal issue, Bush et. al. would not have been so careless about trashing it,
    and many of the things we're seeing today would be in much better check, or non-existent. That means, the people
    would have the right to prosecute a violation of the U.S. Constitution in criminal court with consequences that are
    meaningful to the offenders (personal jail time, etc.). Right now, if you happen to sway the Supreme Court in your favor,
    you haven't actually punished the offenders, just made it a little harder for them to violate the U.S. Constitution in the future.

  88. Wiki by unixisc · · Score: 1

    I fully agree w/ this. I use different browsers, and in IE, I've made Wiki the default and in Firefox, DuckDuckGo the default. In Chrome, I've left it w/ Google. If I want the Wiki explanation of something, I check Wiki, but otherwise, I check other search engines and ignore their Wiki results.

  89. Re:DuckDuckGo sucks by Patch86 · · Score: 1

    I use Startpage on some of my machines as the default, but it's not as good at Google. Plenty of searches that provide fruitful results in Google return nil results in Startpage.

    I've never used DDG in anger; I should probably give it a go.

  90. A Blog With One Post by dcollins · · Score: 1

    It's been said above, but boy... the linked article seems SUPER fishy. It's the one and only post on a newly-created blog, just for the purpose of hammering DDG on this issue, apparently. It has a lot of claims that are adamantly delivered but seem really suspicious. For example: The claim that FISA can order real-time intercepts of any data, even data that the company itself doesn't collect during its business operations. (CEO of DDG responds respectfully in comments and blogger slaps him down and calls him a liar.) There's a bunch of things that ping my "don't trust this" alarm.

    --
    We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
  91. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 0

    I use Startpage on some of my machines as the default, but it's not as good at Google. Plenty of searches that provide fruitful results in Google return nil results in Startpage.

    I sometimes notice this, do you know what it could be? Are you signed into Google at the time of doing a Google search from Google itself? Startpage results should be apathetic towards personalization as well as location, try deleting your Google cookies and using http://www.google.com/ncr to avoid the GeoIP country redirect.

  92. A Quick DuckDuckGo ... by Anonymous Coward · · Score: 0

    "a quick google of ..." reveals why DuckDuckGo won't be taking over as the dominant search engine any time soon. Having your brand become a generic term is a nearly insurmountable advantage.

  93. Who watches you masturbate? by Anonymous Coward · · Score: 0

    Jesus has been joined by the NSA.

  94. I've long held that privacy is an illusion. by mark-t · · Score: 1

    ... only maintained by whatever levels of disinterest in one's affairs people around them might have. Because people are generally concerned with their own affairs more than other people's, it can often be fairly easy to hold onto privacy, ironically, in a public place. Although there's nothing in such public places to necessarily keep arbitrary people from seeing or hearing whatever it is you might want to keep private, as long as you aren't doing anything which would actually attract outsidee attention, it's unlikely that anybody around you will be paying enough attention to notice, and you can achieve privacy through apathy.

  95. Sets up a legal defense by phrackthat · · Score: 1

    One of the things that courts consider when looking at whether communication evidence should be suppressed under the 4th is the measures that the person took to keep the communication private - in short, is there an expectation of privacy? While Duck Duck Go's search engine does not provide perfect opacity, it does provide evidence that you intended to keep your search request private and that you had an expectation of privacy that is worth protection.

    1. Re:Sets up a legal defense by Stan92057 · · Score: 1

      Who owns DuckDuckGo? Are they an American company? If so they will be forced by our corrupt government to save all US and foreign citizens search results. The Other worrie if they decide to go public, that will also be the doom of DuckDuckGo or anyother company that goes public. All IMO off course.

      --
      Jack of all trades,master of none
  96. Re:100% serious question [about searchability] by waterbear · · Score: 1

    >I've never, ever found anything on search engines.

    Pity about that, I've found them useful in a variety of subjects, usually topical or technical. Your experience stated at that level of generality could have two causes. (a) You could be searching for some difficult target subject, where the web-objects you want to see just don't have any characteristic searchable 'flag' words with relevant meaning. (b) It could be your search technique, not searching by the 'flag' words that do characterize your subject.

    Case (a) would cover subjects where the only characteristic words are heavily used elsewhere too, bringing search results with low 'signal-to-noise ratio'. Examples are person-searches using very common names.

    You mention searching for software. Searches in some software areas could be difficult, I guess, if the only 'flag-words' are either pretty much meaningless or over-generalized tokens, or else, words arbitrarily transferred from other contexts in defiance of their usual specific meaning. (Maybe their authors haven't thought about searchability, or else just don't want them to be found in searches.) If that's the special stuff you're searching for then you may be SOL :(

  97. No, I am Brett Wooldridge by Anonymous Coward · · Score: 0

    I am Wooldridge! Do not believe the false Wooldridge.

    Any AC claiming to be Brett Wooldridge is a liar.

  98. I'm spamming my affilliate link by Anonymous Coward · · Score: 0

    Yaaay! Use MY favorite VPN, Excellent service. No NSA. Promise.

  99. Distribution by Anonymous Coward · · Score: 0

    Is there any notion of a peer to peer search engine that could avoid a central server?

  100. Route encrypted out of US? Not sure it'll help. by xenoc_1 · · Score: 1

    Problem is, running through another country, especially one that does not have an NSA-reciprocity deal, is itself most likely a marker to NSA to pay extra attention. Plus doesn't the NSA have full authority to monitor transmissions where at least one side is outside of the USA? Sure, they don't need no steenkin' warrants. But their surveillance becomes arguably even more legal (by US law) and less unconstitutional, if you have voluntarily routed outside of the USA.

    I don't disagree with your advice; in fact I do the same thing often, VPNing to Venezuela, or Iceland, or random other countries first, when the sites/transactions I'm using do not require specific IP geolocation. It makes it harder to track, harder to decypher. But I don't think it is all that meaningful, because it puts in more on the NSA "radar". In part, I do it as a big FU to NSA, like a bumper sticker or political billboard. But I have little faith that it makes it all that much more difficult for NSA to determine patterns of my traffic, if they really want to do so. Sure, it keeps my ISP in the dark.

    But my ISP is the freakin' government of Uruguay, via Antel, which is the fixed-internet monopoly in this "socialist" country. So I'm on the NSA radar anyhow, as one of those "evil Americans who leave the country". Though "Tio Pepe" Mujica, held for a dozen years in a US-funded jail, two at the bottom of a well, would probably tell them to FOAD anyhow. Just as he is doing to the toady EU countries that denied Evo Morales air overflight, by recalling Uruguay's ambassadors.

  101. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 0

    It's there, but it just piggybacks off of Google, Bing.

  102. !w by Anonymous Coward · · Score: 0

    It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.

    Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia.

    How quaint. I just add "!w"

  103. Re:DuckDuckGo sucks by hobarrera · · Score: 1

    Actually, it's not 100% wikipedia. It displays smart information on top.
    I remember searching for an apache httpd configuration directive last week, and DDG showed a snippet of the documentation on top. It was exactly what I was looking for. It's slightly smart, and rather helpful in general.

    Personally, I use DDG as my primary search engine. But when I need to look for very specific issues (why is my commanlink not working with X and Y in JSF), I find that google gives better results. Google still works better if you have lots of keywords or long sentances, but otherwise DDG is enough.

  104. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Because if you use regular search and an article of that name isn't there (or a redirect taking you somewhere else from your term) you end up on a page telling you nothing was found for your query, and asking if you want to create a new article on the topic.

    Special search will display the results that closely match what you were looking for, in case it's not quite listed the way you thought, or is covered by a subsection of a different article, etc.

    At least that's how it was when I set up the Quick Search (many years ago). Maybe Wikipedia has changed the behavior of the search box since then.

  105. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 0

    After using both DuckDuckGo and StartPage (Ixquick) for months, I switched to PrivateLee a year ago. It provides the most relevant results of the three and includes an image search. The main thing I'm missing are the convenient conversions between measurement units and currencies, but I'm willing to take an extra step for those as long as the vast majority of my searches provide relevant results and respect my privacy.

    The secret to PrivateLee's good search results is that they proxy the results from Google and Bing without letting either one know who is the end-user initiating the query.

  106. Re:DuckDuckGo sucks by poetmatt · · Score: 1

    I find bing to continually be less accurate than even yahoo searches. That says a lot, considering yahoo searches are inaccurate.

  107. Re:DuckDuckGo sucks by allo · · Score: 1

    This is exactly the behaviour, i want to have. I know how Wikipedia Titles are written, sometimes they have a redirect, and if i really not find the article, i am at least on the wikipedia-site and can use the searchfield there. But most the time i can avoid clicking on search results / following a redirect first.

  108. Re: DuckDuckGo sucks by allo · · Score: 1

    yeah, you're having some point there ... but on the other hand, count the evil google extensions ...

  109. -1 Mod Undeserved by Anonymous Coward · · Score: 0

    Hey, I don't think this guy deserved that -1 mod. Sure, his comment is entirely pointless and contributes nothing, but at least he's not pretending to be fair: he admits it right in his nickname!