Slashdot Mirror


DuckDuckGo: Illusion of Privacy

An anonymous reader writes "With all of the news stories about users moving to DuckDuckGo because of NSA spying, this article discusses why the privacy provided by DuckDuckGo is more the privacy from third-party tracking (advertisers) but may do little, if anything, to prevent the NSA from tracking your searches."

167 of 264 comments (clear)

  1. FTFA by Anonymous Coward · · Score: 5, Funny

    "The NSA Can't Loose" ... Really?

    1. Re:FTFA by Anonymous Coward · · Score: 3, Insightful

      Really. If they want the information, they get it. Either you turn it over willingly, or they take it forcefully via legal means or just go above you to your host. There is nothing you can do about it.

    2. Re:FTFA by ATMAvatar · · Score: 2

      Well, you do have to be somewhat of a tight-ass to be a NSA spook...

      --
      "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
    3. Re: FTFA by lxs · · Score: 4, Funny

      I heard it got loose and is living in a capsule hotel in a Moscow airport. Which further proves my theory that we're living in a cyberpunk novel.

    4. Re:FTFA by rainmouse · · Score: 5, Informative
      For those that don't want to actually read the loose blog post (its just an opinion from some unknown guy and backed up with no actual facts by the way. It's not actually news at all).
      In the comments is a reply apparently from DuckDuckGo :

      "Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business. We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt. There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example."

    5. Re:FTFA by Anonymous Coward · · Score: 1

      Nice daughter you have Mr DuckDuckGo. Be a shame if something were to happen to her.

    6. Re:FTFA by IamTheRealMike · · Score: 3

      Well that's convincing - not!

      Has this dude been living in a cave for the past month? We've just had a non-stop series of revelations about how governments (not just in the USA) routinely ignore their own laws or secretly redefine them into meaninglessness, in order to engage in dragnet surveillance. And his answer is "such a request would be unconstitutional". Yes, it would. It was unconstitutional for all the other search engines too. So what? That obviously doesn't matter.

      DDG is just a scam in so many ways. The entire site is basically a proxy for Bing. If Bing were to cut them off they'd have no search engine anymore. If Bing were to say "you pass through data on people or we cut you off", they'd either have to give up on their privacy guarantees or shut down completely. It's a completely self defeating business model, if they get popular they won't be able to sustain the reasons for it anymore.

      The fact that he thinks there's a difference between Amazon and Verizon with regards to NSA cooperation is especially amusing.

    7. Re:FTFA by BrokenHalo · · Score: 1

      How come you guys can spell "spook" but nobody seems to be able to manage "lose"?

    8. Re:FTFA by BrokenHalo · · Score: 1

      ...his answer is "such a request would be unconstitutional". Yes, it would. It was unconstitutional for all the other search engines too. So what? That obviously doesn't matter.

      I guess his point is that rather than tamely rolling over and saying "tickle me just there, please", he's saying that a request (let's be honest and call it a demand) that is *OBVIOUSLY* unconstitutional should be comparatively straightforward to contest if the NSA ever had the courage to bring an action to court, which would be a matter of public record.

      Now, obviously if the spooks are serious about it, they could get an actual court order, which (while interesting from any number of perspectives) would change the state of play totally.

    9. Re:FTFA by MrEricSir · · Score: 2

      This guy's response seems to show a lack of understanding of the entire NSA debacle:

      "All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business."

      If this were true, wouldn't Microsoft, Google, Apple, Verizon, etc. be in trouble with the FTC? What makes DuckDuckGo different?

      "We have not received any request like this, and do not expect to."

      Funny, that's exactly the same thing Google and Facebook said. What makes DuckDuckGo different? Why should I believe you?

      "If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt."

      Clearly that hasn't stopped the NSA in other cases. Again, what makes DuckDuckGo different?

      "There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example."

      Okay... and what is Amazon connected to? Saying there's technical inaccuracies but not debunking them doesn't make want to trust you.

      Anyway, let's hope for everyone's sake that the comment wasn't really left by the CEO of DuckDuckGo.

      --
      There's no -1 for "I don't get it."
    10. Re: FTFA by xgerrit · · Score: 1

      Oh no! The secret cabal of gov't spooks found out I saw Sharknado! And that I ordered a pizza!

      The subject has shown an interest in wanton destruction and a potential alliance with the Italians. We request the court grant a search warrant for his home. As this is a matter of national security, the record of this request must be sealed.

    11. Re: FTFA by jalopezp · · Score: 1

      I'm pretty sure the GP was being coy.

    12. Re:FTFA by alci63 · · Score: 2

      Notice the site is from japan... the ability to avoid any typo in an english article does not tell that much about the credibility of the stuff !

    13. Re:FTFA by IamTheRealMike · · Score: 2

      The whole fiasco is enabled by the fact that the NSA does have (secret) court orders from a (secret) court, and the regular courts won't hear cases because of state secrecy. I don't see any reason to believe DDG would have any more luck than Google or Yahoo did.

  2. I didn't start using DuckDuckGo for privacy by Anonymous Coward · · Score: 5, Insightful

    I started using DuckDuckGo because, out of all the other search engines out there, it's the only one I've found whose entire mission statement centers around _not_ collecting information on every goddamn thing you do. Yes it's probably still being tapped at the fibre optic cable level so it doesn't really matter, that's not the point. The point is to vote with your dollar, or in this case your page view, far more influential these days than one thinks.

    I don't use DuckDuckGo because it preserves my privacy. I use DuckDuckGo because they don't try to take it away from me.

    1. Re:I didn't start using DuckDuckGo for privacy by Impy+the+Impiuos+Imp · · Score: 2

      Well, that's fine, but I keep pointing out I'm less concerned with whether Google knows I might want to buy Depends than that the NSA might be able to spy on political opponents to whoever holds their ear. "Make sure you fill out the warrant form, agent #4821 out of 17436." isn't much protection for a G. Gordon Liddy type.

      --
      (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
    2. Re:I didn't start using DuckDuckGo for privacy by lxs · · Score: 1

      Obviously. The scary form is 27B/6.

    3. Re:I didn't start using DuckDuckGo for privacy by jovius · · Score: 1

      The article misses the point. It's about getting rid of the Google sphere and search filtering.

      I'm using Startpageat the moment.

    4. Re:I didn't start using DuckDuckGo for privacy by Sabriel · · Score: 1

      Yeah, the fibre level is pretty hard to avoid. Here's something I spotted this afternoon, related to the reveal that the US was recording Telstra's Reach traffic:

      http://www.computerworld.com.au/article/520706/ludlam_demands_telstra_explain_role_us_spying/

      Telstra issued a statement defending the agreement.

      “This Agreement, at that time 12 years ago, reflected Reach’s operating obligations in the US that require carriers to comply with US domestic law," a Telstra spokesman said.

      "It relates to a Telstra joint venture company’s operating obligations in the United States under their domestic law. We understand similar agreements would be in place for all network infrastructure in the US. When operating in any jurisdiction, here or overseas, carriers are legally required to provide various forms of assistance to Government agencies.”

      Note the part I put in bold....

    5. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      just use
      ?kd=off&q=%s
      instead of
      ?q=%s

    6. Re:I didn't start using DuckDuckGo for privacy by Kiwikwi · · Score: 1

      That's another thing to like about DDG: The fact that all settings can be stored as URL parameters in your browser, instead of a cookie (meaning you can simply disable cookies for duckduckgo.com entirely).

      And it's well-documented and easy to do:

      1. Go to https://duckduckgo.com/settings, configure DDG as you please.
      2. Click "Bookmarklet and settings data", then click on the prominent "https://duckduckgo.com/" URL.
      3. Right click in the DDG search field, select "Create search" (Opera) / "Add keyword for this search" (Firefox) .

      In other browsers, the process is more roundabout, but that's hardly DDG's fault.

    7. Re:I didn't start using DuckDuckGo for privacy by viperidaenz · · Score: 1

      They're still tracking clicks by default.

    8. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      rightclick on the searchfield after searching with for example kd=off, then click "add search engine" when you're using firefox.

    9. Re:I didn't start using DuckDuckGo for privacy by allo · · Score: 1

      not if you use the kd=off setting or use the preferences panel to disable it.

  3. Its not about 100% privacy by SuperCharlie · · Score: 5, Insightful

    At least for me its not, its about not feeding the beast directly. I jumped to Linux, Opera, and DDG as a way to add a few more cycles and maybe a few more man hours to the mess rather than hand it over directly with Windows, IE or Chrome, and Google. If anyone thinks they can really be anonymous in this ecosystem they are sorely mistaken. I do believe however there are less trodden paths and a little more pains in the rear that can be had, and as a silent protest, I chose to use them.

    1. Re:Its not about 100% privacy by PopeRatzo · · Score: 2

      as a silent protest, I chose to use them.

      That's all good. I've tried https://startpage.com/ but I'm not smart enough to know how effective it is at keeping my anonymous.

      It seems to keep Google from upskirting my private info, and maybe that's enough.

      --
      You are welcome on my lawn.
    2. Re:Its not about 100% privacy by itsthebin · · Score: 1

      I am trying startpage also and so far I have been happy.
      it queries google for you

      --
      ...I obey the laws of physics....
    3. Re:Its not about 100% privacy by hughbar · · Score: 1

      I so agree with this, absolute privacy is an illusion. Even if 'they' [tin foil hats on, guys and gals] can't get at the text of your stuff, they can use traffic analysis to get a little insight into some of your social graph. So I also use DDG, encrypt stuff where I can, use Tor, anything to increase the levels of difficulty and make the system run hotter.

      Also, finally, they might work out that this is foolishness: http://qz.com/92207/simple-math-shows-why-the-nsas-facebook-spying-is-a-fools-errand/ and go back to some real work, as if that would happen.

      --
      On y va, qui mal y pense!
    4. Re:Its not about 100% privacy by readingaccount · · Score: 1

      Yes, but again, it's all about the the less trodden paths. Fewer people use it, so it has less attention directed towards it from those who would see to subvert the user. I agree that it being proprietary has some concern, but it's all about weighing the pros and cons.

    5. Re:Its not about 100% privacy by FriendlyLurker · · Score: 1

      Startpage looks great, if it is indeed legitimate and not some spook front. Will be giving it a go and watching out for more news about the company behind it... thanks for the reference

  4. DuckDuckNo by Anonymous Coward · · Score: 2, Insightful

    While the NSA brand of privacy invasion will probably never be avoidable, unless you renounce all forms of data transfer, it's pleasing to have SOME control over your internet presence in so far as keeping advertising trackers off your back. I don't think it says anywhere at DuckDuckGo that it avoids NSA tracking. and anyone using the service who believes it does so is unaware of how the NSA programs work.

  5. Credibility? by karolgajewski · · Score: 5, Interesting

    I may be breaking the fundamental rules of Slashdot, but ...
    - the "article" is a single post on a recently created blog
    - they misspell "lose"
    - a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)

    This is the very definition of "nothing to see here, move along".

    --
    - .k. -
    1. Re:Credibility? by 93+Escort+Wagon · · Score: 1

      You forgot

      - the "article" is very poorly written, using a whole lot of words to say very little.

      --
      #DeleteChrome
    2. Re:Credibility? by Nimey · · Score: 2

      Since when does Slashdot have credibility? At all?

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    3. Re:Credibility? by viperidaenz · · Score: 1

      The future hasn't happened yet, so by your definition, nothing is useful yet.

    4. Re:Credibility? by viperidaenz · · Score: 2

      Perhaps because you spelt Brett Wooldridge wrong.

    5. Re:Credibility? by mu22le · · Score: 1

      In addition to this the author is blatantly ignorant about ssl and criptography:

      If you possess DuckDuckGo’s cert, you can decrypt all traffic to DuckDuckGo

      They claim NSA can decrypt all SSL traffic on a whim. They probably can obtain DDG private key if they want to, but that does not mean that anyone with the _public_ key can decrypt all SSL traffic directed to them.

    6. Re:Credibility? by crazyvas · · Score: 1

      I agree that it seems to be a biased article with not much emphasis on quality. However:

      1) Slashdot likely has a higher proportion of DDG users than the general population given the interest in privacy, security, and tech here.

      2) Since there are very few DDG users in general (compared to google, etc.), it's difficult to find an opposing view to DDG's stance. An opposing view can be helpful in seeing where the problems lie, and what all a DDG user might want to be concerned about.

      Hence, even though this blog might lack any credibility at all (and its misspellings and seeming bias don't help it any), it still holds some value here on Slashdot, IMHO.

    7. Re:Credibility? by crazyvas · · Score: 1

      And even if the arguments on the blog article are poorly made or outright incorrect, my personal hope is that it would initiate a more technically correct and interesting debate here that will help us all understand DDG and similar search engines better.

      What's that? No, I'm not new here. I can still hope, can't I? :)

  6. Oh come on now... by Anonymous Coward · · Score: 2, Insightful

    This is one, gigantic, "no shit, sherlock".

  7. What about Startpage? by Anonymous Coward · · Score: 2, Interesting

    Is it any safer? They bill themselves as "the world's most private search engine" but that doesn't really mean anything.

    1. Re:What about Startpage? by UltraZelda64 · · Score: 2

      I don't know, but when I want to search using queries that may bring in potentially "illegal" search results, I just use Ixquick. To be honest though, I don't know what the difference (other than name) is between the two. Both Ixquick and Startpage are run by the same people, they both look practically identical, and you probably couldn't go wrong with either one. I just happened to find out about Ixquick first and saw a few more mentions of it on different websites so I just use it. Ixquick does not log any user IP addresses. According to Wikipedia article on Ixquick, Startpage is just an "easier-to-remember" alias of the same exact search engine. Ironically, I find Ixquick's fewer letters to be faster and easier to type.

    2. Re:What about Startpage? by UltraZelda64 · · Score: 1

      Interesting. I've even done various web searches to find out what the difference between the two are, and the most I could find is that Wikipedia article. I wonder why they don't make it more clear on their own site exactly what the difference is.

  8. VPN by xtal · · Score: 4, Informative

    Run your traffic encrypted through another country with actual privacy protections.

    It's not perfect, but it is another complication and barrier to direct monitoring.

    Ultimately, the NSA reveal is a good thing - it's going to drive demand for virtual private cloud services where you hold the keys, and perhaps, a move back to corporate controlled cloud services on-site. Great news if you're in IT.

    --
    ..don't panic
    1. Re:VPN by Anonymous Coward · · Score: 1

      Great way to get marked a foreigner and guarantee for intense surveillance.

    2. Re:VPN by wisnoskij · · Score: 1

      Was that not part of the NSA spying reveal.
      The huge amount of cooperation between countries with laws that protect spying on their own citizens but not other nation's citizens?

      You route your data through a country with strict privacy laws, and that country intercepts it because their laws do not protect you, a non-citizen.
      They then allow access of that data to the NSA, and no one broke any laws.

      --
      Troll is not a replacement for I disagree.
    3. Re:VPN by g1nG3Rj0urNAl157 · · Score: 1

      Am I missing something really obvious? Why would you even try something like DuckDuckgo? It's only "remedy" for privacy is it's policy of not tracking users. Serious considerations for privacy would impel one to consider an anonymizing network layer such as I2P. Or if you really want relatively foolproof privacy, get a VPN connection, install VPN network monitoring software and configure your DNS settings manually.

      --
      "I like the dreams of the future better than the history of the past." Thomas Jefferson.
    4. Re:VPN by Clsid · · Score: 1

      Lol, keep spreading the FUD. There are things that can be done. They are not God you know.

    5. Re:VPN by Clsid · · Score: 1

      No country or government will protect your rights. But there is something you can do about it, like having your own small server back home and use alternative services like Yandex, etc. Yandex is a Russian company that have to comply with government requests in the same way American companies have to do back home. So as far as search engines go, you truly have to go with whatever lesser evil you are willing to tolerate. In that regard, DuckDuckGo is a good option.

      But if you get a cheap VPS server, even if it isn't as secure as having your own, it's very convenient and you don't have to rely on stuff like Dropbox/GDrive/SkyDrive, ad-supported e-mail, or internet companies with huge tracking issues like Facebook and Google. You can also use DailyMotion to try and break your dependence on YouTube.

    6. Re:VPN by AHuxley · · Score: 1

      Recall http://news.slashdot.org/story/13/07/03/1952228/mastercard-and-visa-start-banning-vpn-providers
      They can track you for been too smart and using a VPN and making easy ongoing payment interesting.

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:VPN by houghi · · Score: 2

      It's not perfect, but it is another complication and barrier to direct monitoring.

      If it isn't perfect, it means it isn't useful.

      Moving to better privacy laws or to another country means nothing. Other countries have just not yet been caught doing this. What this should mean is better encryption.

      Unfortunately what we see is that nobody really cares. How many emails have you received that were digitally signed and send by a non-geek? Ask anybody if they would trust sending their private information on a postcard. Ask the CxO of the company if they would send company information via a postcard.
      Would they accept any information that was not signed?
      Hopefully people will say no, yet that is what people do with email.

      Email is basically a postcard. Implementing digital signatures is what the IT should concentrate on. They are able to add the legal bullshit that is useless (From MY point of view, somebody send or gave me the email, so it was intended for me. Perhaps YOU did not intend it for me, but that is YOUR problem.) and instead use some CPU cycles and add digital signatures.

      That would be a great first step. It does not break the readability of the message. In the beginning you will need to explain what this means and how people could verify this. There is nothing that would stop e.g. banks and credit card companies and others in using this.

      Very soon people will suddenly notice that you can also encrypt it and send messages encrypted. When enough people use it, it will become a standard and gmail and outlook (both program and website) will start using the signatures.

      However I hear nothing about this, so I assume that nobody is seriously interested in privacy. Apathy is the great danger here. Not the NSA (or your local version). We (the people) allow them to get away with it. We are the problem and only we can be the solution.

      --
      Don't fight for your country, if your country does not fight for you.
    8. Re:VPN by Seumas · · Score: 2

      Unfortunately, if the VPN provider is located in the US, they are compelled to comply with the government in providing access to your logs and data and anything else. They can also simply put in a shunt and siphon off a copy of your data (even without the provider even being aware it is happening, just as is likely to have happened with Google/Facebook/etc). If they are outside of the US, you'll have a hard time getting the service, since credit card companies are banning payments made to VPN providers.

      Anyway, there are things you can do to make everything just a tiny bit more of a nuisance -- that is about it. There is nothing you can really do to safeguard yourself if you somehow become a specific target, of course.

      You need to be able to trust the sites and services and systems you connect to. Good luck, there. You need to be able to trust that the government isn't tapping all data transfer with a shunt at your ISP, or as near the service as possible, or at the backbone. You need to have an encryption tunnel for your data. You need to make sure that the provider of that service is reliable and not logging data. Or isn't being tapped. And can't be compelled to hand over whatever data they *do* have. Then, you have to trust that all of the advertisers tracking you on all these sites and services aren't able to correlate your identity. That's almost impossible, since they need very few data points (mostly seemingly anonymous ones) to pinpoint who you actually are.

        You need to trust that all of this is the same about any online/cloud services you may happen to use. After all of that -- if it is all somehow accounted for -- you still have to be able to trust your operating system and your hardware. That there isn't something built into your OS or some software you are running or into the hardware itself that grants access to the government.

      And once you are sure of all of that *too* . . . you just have to be able to trust that someone hasn't infected your system directly with something and that nobody has planted something on your system. Say, while you were out of the house for awhile, one day.

      In other words, no matter what we do, we are doing the modern equivalent of setting a Windows desktop/screensaver password. It will protect you against the opportunistic coworker or nosey family member -- but provide no protection against someone who truly wants to get information on you and monitor you.

    9. Re:VPN by allo · · Score: 1

      yeah, because everyone in the foreign country is supervised.
      Maybe you're in your own american filter bubble, looking down at the rest of the world?

    10. Re:VPN by allo · · Score: 1

      it may be a good idea anyway, to seperate processes where you are non-anonymous because of entering your details/using a login for an account with your details from your private browsing anyway. If you login to some bank account, you can use your dsl ip as well, because you will not be anonymous anyway. And you may want to seperate it, because from the moment you logged in, someone knows which vpn ip belongs to you, until you disconnect and change the ip.

    11. Re:VPN by allo · · Score: 1

      the vpn provider does not log (and keeps this promise), you encrypt your traffic. Noone will be able to identify you or read your traffic.

    12. Re:VPN by allo · · Score: 1

      sweden, ukraine

    13. Re:VPN by Znork · · Score: 1

      What would be the point of having gmail and outlook using signatures or encryption? Anything the user of those can do one can assume the NSA can do on behalf of the user. You need to be doing your encryption on secure endpoints on both ends for there to be a point. Which means no webmail. No proprietary Microsoft/Google/Apple software. None of todays smartphones. Etc.

      That's not to say it can't be done, but if you want to move beyond postcards vis-a-vis the NSA you'll have to go open source for OS and software and start using vpn's, darknets and things like i2p for communications.

  9. Ixquick? by rycamor · · Score: 4, Informative

    At least Ixquick is not a U.S. company: https://ixquick.com/eng/prism-program-revealed.html

    While their searches aren't as fast as Google's, I have found them to be pretty good quality-wise.

  10. No PFS at DDG by Lawrence_Bird · · Score: 2

    DuckDuckGo, a search engine, has been prominent in the media since the start of the Snowden revelations due to its privacy policy which promotes anonymity. If the private key used by DuckDuckGo were ever compromised — for example if one of their servers were seized — all previous searches would be revealed where logged traffic is available. DuckDuckGo may be a particularly interesting target for the NSA due to its audience and the small volume of traffic (as compared to Google).

    This is because DDG does not use crypto algorithms which support perfect forward secrecy.

    When PFS is used, the compromise of an SSL site's private key does not necessarily reveal the secrets of past private communication; connections to SSL sites which use PFS have a per-session key which is not revealed if the long-term private key is compromised. The security of PFS depends on both parties discarding the shared secret after the transaction is complete (or after a reasonable period to allow for session resumption).

    So it would require significantly more work for NSA to deal with a site using PFS. Source: netcraft

    1. Re:No PFS at DDG by anagama · · Score: 1

      I'm trying to understand PFS having not heard of it before -- If I understand correctly, it is a system wherein a unique public/private key pair is generated on demand using a long term key. Or to put it more simply -- a system that gives every session a new and unique set of encryption keys, thus making compromise of the private key hugely less of a bonanza. If that's the case, that sounds like a great system.

      Reading your linked article demonstrates that some sites already do this ... how do I make sure I'm taking advantage of it?

      --
      What changed under Obama? Nothing Good
    2. Re:No PFS at DDG by Lawrence_Bird · · Score: 1

      Use this it details towards the bottom the ordering of ciphers.

    3. Re: No PFS at DDG by Lawrence_Bird · · Score: 1

      actually, I found it in a forum post and have verified, they do now use ECDHE, clearly as a result of the netcraft article.

  11. Derp by SGT+CAPSLOCK · · Score: 1

    It's kind of tough to understand why people would think that DDG has any magic to stop the NSA from eavesdropping on it in realtime. Isn't its hosting done by Amazon to begin with? (srsly a question, idk)

    Aside from that, DDG does have its benefits. Not setting any cookies is important. Not remembering search history on their end is important. It also prefers to serve up SSL-enabled pages instead of their unencrypted counterparts. And a very beneficial feature is that it doesn't set the referrer when you go somewhere.

    But NOTHING will prevent the NSA from eavesdropping on traffic en-route if they choose to do so, given that they have the incentive to do so and the cooperation of the providers that actually matter.

  12. icons by atherophage · · Score: 1

    At least it appears DDG is trying to help with privacy. They have links on their minimalist home page which lead to suggestions for protecting your search privacy. Found out about Disconnect.me through DDG. DDG also has way cool swag [http://help.dukgo.com/customer/portal/articles/216375-t-shirts-stickers-more] on the cheap.

  13. Re:blog colors by Jeremy+Erwin · · Score: 2

    Be gentle. It's his first Blog Post.

  14. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 3, Interesting

    It's about as good as a google search and it gives the wikipedia article for any topic at the top. My opinion is better than your opinion.

  15. Re:DuckDuckGo sucks by SeaFox · · Score: 4, Insightful

    It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.

    Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia. Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.

  16. Decrypting SSL by BringYourOwnBacon · · Score: 4, Interesting

    I think the article brings up and interesting point about who's SSL certs the NSA has access to. It's reasonable to assume that they are capturing most if not all Internet traffic in the states (at the very least all packets entering or leaving the county.) What is unknown is how much of that encrypted traffic can be easily decrypted. If I were a three letter gov't agency intent on decrypting massive amounts of traffic, I would go straight for the keys. It's particularly of note that DuckDuckGo does NOT use session keys in its SSL implementation, meaning if their private key got compromised, all previous searches would also be compromised. I don't think it's too much of a stretch to assume that the NSA has found a way to that key, either through secret court orders, or good old fashioned nefarious means. Especially for a site like DDG, who makes promises of "privacy". Makes you wonder who else's keys they have access to.

  17. In Russia, Yandex searches YOU by tepples · · Score: 4, Informative

    DDG is a reskinned Yandex with shortcuts to search particular sites. If you don't commonly use site: searches on Google, and you can't stand Yandex, you won't like DDG.

    1. Re:In Russia, Yandex searches YOU by arth1 · · Score: 1

      Yeah, it's a search aggregator, and not a search engine.
      I used it before, but stopped, because it uses Bing, which is maed forr pepple whoo cann nott speel. When I make exact and correctly spelled search queries, I get a lot of rubbish back because Bing returns results for "similar" queries.

      Example query: iwlyfmbp deflate

      Now run this through Google and DDG and see where you get the best results.

    2. Re:In Russia, Yandex searches YOU by Caetel · · Score: 5, Informative

      DDG shows no results. Bing's only result is this post. Google has this post and and OpenQNX forum post... so, Google, I guess?

    3. Re:In Russia, Yandex searches YOU by lxs · · Score: 2

      Yes! I believe in free and fair competition so the obvious step is to let the Russians snoop on me as much as the Americans do.

    4. Re:In Russia, Yandex searches YOU by lxs · · Score: 3, Interesting

      Not living in either country, both the US and Russia are foreign competitors with a shady track record on business ethics and human rights and politics, so it really doesn't make a difference to me. Both nations have wasted a decade bombing Afghanistan, you're both prosecuting dissidents. I have serious trouble telling you guys apart.

    5. Re:In Russia, Yandex searches YOU by AllyGreen · · Score: 1

      According to duckduckgo themselves, it comes from over one hundred sources including google, bing, yahoo etc. http://help.dukgo.com/customer/portal/articles/216399-sources

    6. Re:In Russia, Yandex searches YOU by arth1 · · Score: 1

      I incorrectly thought that when people got zero results on the combined search, they'd try each of the words separately.

      iwlyfmbp returns a boatload of WFMB radio station results on DDG, because Bing returns them. Whoever designed the algorithms for Bing was probably doing sabotage, cause you can't get that wrong by accident.

      DDG has a way to specify a specific search engine to use, but it does not have a way to exclude one. Like Bing, which is worse than useless because of how it attempts to second-guess its users, and botches it.

  18. DuckDuckGo Response by yegg · · Score: 5, Informative

    Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business. We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt. There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example. A couple other responses to things I've noticed in the comments already: --Our servers are already located around the world. European users are generally not hitting US-based servers, for example. --We do have PFS on our cert: https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com&s=50.18.192.251

    1. Re:DuckDuckGo Response by Khopesh · · Score: 4, Interesting

      Thanks, that was a nice official response to a crackpot article that should never have made it to slashdot.

      My read of that article was that nothing is really safe (which is true, but you have to be reasonable about these things) and that larger companies at least have accountability. It kindly forgets that this accountability isn't to users, it's to shareholders. DuckDuckGo protects against these larger companies, and DDG might just fly low enough under the radar to avoid the attention of the NSA.

      Keep up the good work, Gabe. If you're in the SF area, I'd love to buy you a beer.

      --
      Use my userscript to add story images to Slashdot. There's no going back.
    2. Re:DuckDuckGo Response by evilviper · · Score: 1

      Wonderful response!

      I'd also like to throw-in the fact that DDG is a big proponent of SSL as well. Their website redirects you to their SSL site, and all their search results will send you to the HTTPS version of a site, if it exists (eg. Wikipedia). Things which other search providers do not do.

      So, in the context of the NSA tapping all internet communications (which we know for a fact they have been doing since 9/11/2001: https://www.eff.org/nsa/hepting), DDG also provides much more privacy and security than any other major search engine, which don't take these steps at all.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    3. Re:DuckDuckGo Response by readingaccount · · Score: 1

      Calm the fuck down already. You don't go bashing a small-time company unless you have an ulterior motive to ensure they disappear. Which it disturbingly sounds like you're trying to do.

      Even if he said something untruthful, that's very different to being a willful lie and your rant is out of proportion.

    4. Re:DuckDuckGo Response by Antique+Geekmeister · · Score: 2, Informative

      I'm afraid I went over the top here. You may mean well for your customers, and may in fact resist unconstitutional data requests. But there is a compelling amount of legislation that is aimed _precisely_ at controlling corporate data gathering, ranging from the tax code to the SEC's regulations about business finance to the HIPAA regulations about medical information, the TeleCommunications Privacy Act and its poorly writt4en regulations bout consumer protection, and the export encryption regulations of the department of commerce. Those are not merely about what you must turn over from current records, they are about what you must keep or what you must not publish.

      CALEA is aimed at voice communications, and is not particularly relevant to this except that it was aimed squarely at controlling and preventing changes to business practices. Exemption or not for search engines, it prevented the use of new telecomm technologies that would prohibit easy wiretapping.

    5. Re:DuckDuckGo Response by sessamoid · · Score: 1

      Look, I think it's clear from the context that Weinberg was not talking about all US laws about everything, but strictly in the context of the recent NSA brouhaha revealed by the Snowden leaks. In that context, it appears he was not lying at all as that relates onto the NSA's domestic spying activities, not all corporate laws.

      Perhaps you should try decaf?

      --
      "No, no, no. Don't tug on that. You never know what it might be attached to."
    6. Re:DuckDuckGo Response by Zontar+The+Mindless · · Score: 1

      Hi, Brett. :)

      --
      Il n'y a pas de Planet B.
    7. Re: DuckDuckGo Response by evilviper · · Score: 1

      After 2 minutes playing with ixsearch, I find the results to be TERRIBLE, and have no interest in using it further. Anyone can put together a crap search engine overnight, it takes a lot of work to make it "good" and they haven't done that.

      And when I talk about search engines, I don't pretend I've used every single one that has ever existed... I was just referring to the most popular ones, and ixsearch doesn't remotely qualify.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    8. Re:DuckDuckGo Response by Znork · · Score: 1

      As most users trust their browsers for SSL verification it is of limited use against entities like the NSA. They certainly have their own signed certificates for any site they're interested in intercepting and thus could easily man-in-the-middle any session they're interested in.

      Of course, that's most useful in targetted surveillance and much less useful in the dragnets where it'd most likely get noticed reasonably fast.

      But against government sponsored entities any hierarchial trust such as SSL is fundamentally flawed as they can simply compell the issuing of false certificates.

    9. Re:DuckDuckGo Response by evilviper · · Score: 1

      could easily man-in-the-middle any session they're interested in.

      Yes, but MiTM is the complete opposite of "tapping all internet communications", which is what I said SSL protects against. Are you disagreeing someone else here?

      If the NSA is interested in you, they'll just send a couple spooks to break-in to your house and install key-loggers, so the SSL trust thing isn't that relevant to most individuals.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  19. Re:blog colors by 93+Escort+Wagon · · Score: 2

    I found it funny that, right there at the top, there's a big proud "Ads by Google" link. There's nothing wrong with that per se, but it does color one's perception when the blogger is basically saying "sure Google is cooperating with the NSA, but they're a lot bigger than DuckDuckGo" (for whatever reason we should care about that).

    I switched to DDG a few weeks ago, but it had more to do with my changing perception of companies like Facebook and Google than it did with any idea the move would somehow deter the NSA from snooping on me.

    --
    #DeleteChrome
  20. Re:DuckDuckGo sucks by poetmatt · · Score: 2

    what do you expect? it's bing. Since when did people believe a microsoft-based search is privacy friendly? "anonymous" is just a hilarious misnomer.

  21. The world's most virtuous whore by ulatekh · · Score: 1

    They bill themselves as "the world's most private search engine" but that doesn't really mean anything.

    It means about as much as "the world's most virtuous whore".

    --
    "Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
  22. Speculative and inaccurate opinion piece by PureRain · · Score: 2, Informative

    I feel compelled to let anyone here who has not RTFA to not bother. It is a poorly written blog entry that's nothing but hyperbole and speculation. It's also badly researched and contains a lot of inaccuracies. One of the commenters is the CEO of DDG and he corrects some of the misinformation.

    I've been using DDG for 2 years and it is great. Not always as good as Google but a good alternative for most searches. Make sure you set it to your region (settings).

  23. Larger picture... by Shoten · · Score: 3, Insightful

    So, the majority of the population now realizes that their activity is in some way monitored, and they wish to evade that monitoring. They need to consider this: they are amateurs playing for nickel stakes in this game. The NSA doesn't care about them, and the people aren't used to playing this game either, for their part. This game exists, at the moment, primarily between the most sophisticated intelligence apparatus in human history and a very small population that is doing everything they can possibly do to hide. We think that using airgapping a network and using USB drives simply to move data across the room is a powerful security measure...these guys used USB drives to move data between countries, and even that wasn't good enough to protect them. The average citizen merely worries about some amorphous knowledge of their habits...the real target population faces death, or perhaps even worse internment in a black site somewhere for years first. And that population has been working on hiding for quite some time now; this is not a new game just because the rest of us know it's being played now.

    So...with that context, why would anyone think that simply using a different search engine fucking matters?

    --

    For your security, this post has been encrypted with ROT-13, twice.
    1. Re:Larger picture... by Anonymous Coward · · Score: 2, Insightful

      why would anyone think that simply using a different search engine fucking matters?

      It may not. But anything that makes more work for the secret police is a good thing.

      (If you object to the NSA being called "secret police", remember that they turn over any evidence of crimes that they find to other police agencies. They don't have "active" agents, they don't torture like the Gestapo, the US has other organizations to do that, they're more like a department of the Stasi.)

    2. Re:Larger picture... by SigmundFloyd · · Score: 1

      The NSA doesn't care about them

      Yeah, carry on and pay no attention to the man behind the curtain.

      --
      Knowledge is power; knowledge shared is power lost.
  24. A Dubious Article by Kplx138 · · Score: 2

    Apparently all you need to get front page on slashdot is an article with one link to a blog, that has only one post, created by a random user. Hell the 3rd paragraph of the article beings with 'TL;DR' a phrase I associate with image boards such as 4chan than I do actual journalism and news. While the article is somewhat interesting it's nothing more than an op-ed piece or a letter-to-the-editor at best or some anti-DDG fud created by some PR firm at worst.

  25. Re:DuckDuckGo sucks by Trepidity · · Score: 2

    I like to think that would be true, but honestly about 50% of the things I click on in a Google search are Wikipedia articles, even when I didn't initially search Wikipedia directly.

  26. the NSA doesn't care about them?? by transporter_ii · · Score: 2

    > .these guys used USB drives to move data between countries

    Look, if anyone with any sense can bypass the snooping, they must know that. That only leaves *us* that they are snooping on.

    --
    Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
    1. Re:the NSA doesn't care about them?? by Shoten · · Score: 1

      > .these guys used USB drives to move data between countries

      Look, if anyone with any sense can bypass the snooping, they must know that. That only leaves *us* that they are snooping on.

      I notice how you conveniently change what I said by omitting the second half of the sentence: "...and even that wasn't good enough to protect them." So no, that does not leave *us* that they are snooping on. And also, your premise assumes that no new targets come up, that there's no reason to snoop on other nations, and that no nations ever change sides from friendly to hostile (like happened with Venezuela, Belarus and the Ukraine and is happening with Argentina, for example).

      Compare the value of a terrorist organization or hostile nation state to an average American, and you'll see that there's absolutely no comparison in terms of targeting. Even with their massive budget, the NSA still has finite resources and capability. They can't spy on everyone at once, even when they're grabbing all the data, any more than a librarian at the Library of Congress can read every book in the building.

      --

      For your security, this post has been encrypted with ROT-13, twice.
  27. Tor and Hidden Service by UnsignedInt32 · · Score: 2

    They have an exit enclave for DDG search engine traffic and also hidden service at 3g2upl4pq6kufc4m.onion...
    So there at least they provide some additional layer of protection for those who are needed.

  28. Re:DuckDuckGo sucks by Aighearach · · Score: 1

    aka "go fish"

  29. Re:DuckDuckGo sucks by Aighearach · · Score: 1

    I just add "wiki" to the end of my search and wikipedia will be in the top 3

  30. Wait one second by mpbrede · · Score: 1

    The source link for the article is a new blog with one (yes, count it, one) post?? I call fowl.

    1. Re:Wait one second by Hypotensive · · Score: 1

      Cluck, cluck.

  31. Re:100% serious question by number11 · · Score: 1

    When was the last time you searched for something and found it using a commercial search engine? I've never, ever found anything on search engines. I have my bookmark library (entirely non-cloud) and ask HUMAN BEINGS for recommendations when I need a new kind of software. Then I might use the search engine to find their site the first time, but that's hardly blindly searching for stuff. I always just find 100% spam, irrelevant crap and generally low-grade junk when I search for *anything*. The entire concept of searching for things in general (not counting service-specific engines) is foreign to me. It just doesn't work in my world. I don't understand what people search for that they get proper results. Or maybe they just have extremely low demands.

    Maybe I just have extremely low demands. But when I want to know what a particular error message means, or if some unknown program that seems to be running is malware, or if the latest "OMG This Unlikely Thing Happened" post is true, or how to knock the password off of a protected pdf file, or how to spell "indefatigable", or where the hell "Bozy's Bar" (where the meetup is) is, or where I can get a cheap replacement bumper for my car, I use a commercial search engine. Maybe your problem is searching for "anything", I find it works much better if you have a particular subject in mind.

  32. DuckDuckGo Rocks, Google must be hurting by Anonymous Coward · · Score: 2, Insightful

    DuckDuckGo should move out of USA (and UK) at this point. They could have a huge business, but not in NSA occupied territory.

    1) The reason I switched was because it doesn't use tracking cookies.
    2) It doesn't own Android, Gmail, Youtube Adsense Doublclick Maps or a myriad of other sides that can be used to 'un-proxy' me and 'un-NAT' me and get around my cookie blocks.
    3) It is https so the NSA *need* a warrant, unencrypted search automatically goes into the NSA database.
    4) Gmail failed a link test, a disguised link (not a straight http://...) sent from my old gmail account to a pop3 was visited by a server in Arizona.
    5) They don't have a feed to NSA currently, its not listed on PRISM

    But best of all

    6) It's actually quite good at finding stuff and better than Google at finding job CVs from NSA spooks to see what else they might want to confess to. Google is keeps substituting more popular works.

    I assume from this piece that Google are suffering. Well, point 2) is entirely their fault, they linked all that data together so I have little sympathy for them.

    I don't like being tracked for daring to question the legality of an illegal mass surveillance program, and Google's can always move their business out of mainland USA and to Hong Kong where they are on the other side of the great spywall of NSAland.

    1. Re:DuckDuckGo Rocks, Google must be hurting by allo · · Score: 1

      > 3)
      do not trust https. The NSA will have the power to sign certificates on at least one CA which is in all browsers.

    2. Re:DuckDuckGo Rocks, Google must be hurting by TheLink · · Score: 1

      Use firefox with certificate patrol and disable the CAs that you don't trust.

      On Windows Chrome and IE use the same cert infra. Go delete a CA's cert and then go visit the CA's https website with Chrome/IE. Watch the cert get readded ;).

      --
    3. Re:DuckDuckGo Rocks, Google must be hurting by allo · · Score: 1

      so, which one do you trust? And how do you authenticate sites, which are only signed by untrusted CAs?

      The whole CA system is broken, because there is no real trustpath to the site. Do you even know, if your download of firefox was clean, or if a MITM inserted some bad CA, which is not part of the default firefox?

  33. Use it via Tor hodden service by gweihir · · Score: 1

    Sure, the NSA still gets what you search for and the results, but unless they have control over the Tor network (which is doubtful), they cannot associate that info with you.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    1. Re:Use it via Tor hodden service by fulldecent · · Score: 1

      Tor fails against an adversary that has access to the transport of all traffic

      --

      -- I was raised on the command line, bitch

  34. To hide the referrer by Anonymous Coward · · Score: 5, Interesting

    To strip off the referrer. Otherwise the end site would see the URL of the DuckDuckGo search revealing the details of the search, page, etc.

    1. Re:To hide the referrer by jones_supa · · Score: 1

      But that still tells DuckDuckGo which page you went to. We can't be sure if they store that information. It's better if you can simply disable sending the referrer information from your browser.

    2. Re:To hide the referrer by sydneyfong · · Score: 1

      I've found a pointing the link to a datauri encoded html page with a meta tag to redirect works pretty well.

      --
      Don't quote me on this.
  35. My next network protocol... by OrangeTide · · Score: 1

    The headers in my next protocol will use identifiers, like any ther protocol. except my identifiers will be: JIHAD, NUKE, SARIN, INFIDEL, ...

    It's about time to apply techniques similar to Culture jamming to these spying tactics. It probably won't stop them, but we can at least try to piss them off.

    --
    “Common sense is not so common.” — Voltaire
  36. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 1

    It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.

    Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia. Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.

    Oh, I agree, but it's worse than that.

    Not only does DDG put that "helpful" wikipedia excerpt/link at the top of their search results, but if you install the "DuckDuckGo Plus" Firefox extension, they will intercept your Google search, and cram that box in your Google search results as well. I get that some people may want that functionality (I don't -- if I use Google, it's because I want to see exactly what Google returns), but it's questionable to have this sort of content injection enabled at all in an extension whose primary purpose is to add a search engine to the search-bar, search completions, etc. lists, not to perform content injection. And it's downright evil to have it enabled by default, but I guess they think I should consider myself lucky they permit me to turn it off at all...

    Yeah, no thanks, DuckFace. I'll stick with ixquick.

    My other complaint with DuckDuckGo is that they use redirects to search results, just like Google. (Ostensibly, a purpose of these is to prevent information about your search leaking through the referer header -- in practice, https accomplishes that automatically, but the redirects do let the search engine monitor what you click on.) No, I don't think DDG is logging the redirects in a user-identifiable way, but why should I have to trust them (with anything beyond the query itself) when I can use ixquick which links directly to the results?

  37. Re:DuckDuckGo sucks by Clsid · · Score: 4, Informative

    I don't know but if you do not want to use Google, DuckDuckGo is by far one of the best alternatives. Try doing temperature, currency conversions with DuckDuckGo, the integrated results from WolframAlpha are pretty good. The only thing is missing is image search imho.

  38. Re:DuckDuckGo sucks by Clsid · · Score: 1

    haha same here. Although on Safari I have the keywords extension installed so I can type w and then whatever I want, and the search goes directly to wikipedia.

  39. Tor onion router end point by Norny · · Score: 3, Interesting

    Name me another major web search engine with an official Tor onion endpoint. DDG is the only one I know.

    https://3g2upl4pq6kufc4m.onion/
    https://3g2upl4pq6kufc4m.tor2web.org/

  40. Re: DuckDuckGo sucks by Torodung · · Score: 1

    If clicking a bookmark or using a Firefox search assist is navigating, then yes. You make it sound like he's typing in the URL.

  41. Re:DuckDuckGo sucks by Anonymous Coward · · Score: 3, Informative

    The only thing is missing is image search imho.

    Use ixquick.

    Actually, use ixquick (or its sister site startpage) for all the other stuff, too.

  42. Re:blog colors by Clsid · · Score: 1

    I have been using DDG for quite a bit, but its lack of image search is a little bit inconvenient. I'm testing Yandex to see if I can use it for everyday stuff.

  43. Re:Blogs are not news; they're Op-Ed by Clsid · · Score: 1

    I don't know what you searched but DDG works fine for me. I have to use Bing for image search and that's it. I'm testing Yandex to see if I can replace both with that.

  44. My Major Concern with DuckDuckGo by Anonymous Coward · · Score: 2, Insightful

    I have been using DuckDuckGo for some time now but stopped lately because I notice something fishy. When you hover over a link the bar at the bottom of the screen displays the link address to make you believe clicking on that link will go to that address, but if you look closely at it when you click it flashes "Sending Request..." then "Waiting for https://duckduckgo.com/" and finally "Waiting for https://what-you-clicked.com/". So they are redirecting all the search results so they know who clicked what. Great. There is no reason a company dedicated to privacy would be using any type of redirect, they should take you directly to the page you clicked simple as that.

    1. Re:My Major Concern with DuckDuckGo by jones_supa · · Score: 1

      This is true.

    2. Re:My Major Concern with DuckDuckGo by heypete · · Score: 4, Informative

      It's so their system will strip out referrals, thus increasing your privacy: the site you end up on won't know what search terms you used to get there.

    3. Re:My Major Concern with DuckDuckGo by Ash-Fox · · Score: 1

      It is only stripped if the new page is on HTTP. If it's HTTPS, it will retain the referrer header.

      --
      Change is certain; progress is not obligatory.
  45. Startpage by flyingfsck · · Score: 1

    There are many similar services in other countries. Startpage is hosted in the Netherlands for example.

    --
    Excuse me, but please get off my Pennisetum Clandestinum, eh!
  46. Re:100% serious question by lxs · · Score: 2

    When was the last time you searched for something and found it using a commercial search engine?

    Three minutes ago.

  47. Re:Usual Slashdot trolling by lxs · · Score: 1

    The weekend sure does bring out the crazy. You know these days your paranoid delusions are bland and boring compared to the shit going on in consensus reality. Seek help.

  48. Re:DuckDuckGo sucks by Stoutlimb · · Score: 2

    I've never tried DuckDuckGo, but did today because of this article. I chose a type of search that I do often and tried it on Duck, Google, and Bing. (Searching for a specific string on a large forum website.) Google, my usual favourite, came in last. Middle was Bing, and for some reason, DuckDuckGo was the best, and found things for me I had never before known about. I was mildly impressed. I know this is totally anecdotal, but it made me happy. That, along with the slightly better privacy, made me switch today. Also, I think it's important to punish Google for rolling over for the US government. They were somewhat good at standing up to the Chinese government for privacy issues, yet did nothing when the USA decided to do far worse. In my opinion, they've lost every bit of good will they've gained with their "don't be evil" slogan and policies. They're no better morally than Goldman Sachs, Monsanto, or Microsoft, the slow slide into corruption is now complete. On to the next underdog...

  49. SSL protects the search queries? by cyberjock1980 · · Score: 1

    Probably going to get modded down for asking such a simple(stupid?) question.. I've never been able to find this answer though.

    From the article:

    However, DuckDuckGo is using SSL encryption. Without DuckDuckGo's private SSL certificate, your search queries (but not your location) are invisible.

    Can someone clarify this for me? I want to make sure I understand this. If I search for "Star Trek" in Google then I get redirected to

    https://www.google.com/search?q=star%20trek&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=np&source=hp.

    Naturally, "star trek" is the search if you are only provided that address. It also clearly shows that I am using firefox. Does SSL protect the actual web address from being sniffed without Google's SSL master cert?

    If so, then its safe to assume that my cable internet provider could see that I'm using google(based on the IP address of the traffic) but can't tell that I might be a hardcore Trekkie or that I'm using Firefox(at least from the link.. surely they could sniff traffic from elsewhere and determine my user agent string). Is this correct?

    So how do I determine what actually is protected by SSL and what isn't? Is there a cheat sheet somewhere? I've always been curious about this but I don't want a 4 year degree in network design...

    1. Re:SSL protects the search queries? by mat8913 · · Score: 2

      Yes, your ISP will be able to tell that you are using Google from the IP address but all of the communication (that includes the web address) should be encrypted.

    2. Re:SSL protects the search queries? by AHuxley · · Score: 1

      http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html
      "for example if one of their servers were seized — all previous searches would be revealed where logged traffic is available." is the real worry long term.

      --
      Domestic spying is now "Benign Information Gathering"
  50. When I'm being nefarious by adolf · · Score: 1

    When I'm being nefarious and Googling things, I use a dedicated local machine which knows nothing about me, and which has all of its Internet traffic routed through a country (over a VPN) that I do not expect trouble from.

    My VPN provider does not keep logs. I fire up a browser (on that VPN-connected machine) with Private Browsing turned on, and do my nefarious things with plain-old Google.

    I disconnect and reconnect to the provider periodically, which flushes the state and the connection relationship I have with them.

    Not that I look for anything particularly wrong or harmful, but my desire to learn is powerful, and I simply do not want to be restrained in the future for being curious now.

    The only attack I'm aware of, given this scenario, is timing-based: If the NSA were watching my local address and the off-shore VPN'd address, a correlation could be made between the timing and size of some packets.

    But if OpenVPN had random padding and latency abilities, even a timing-based attack would be impossible. (Indeed, I might just suggest this to them.)

  51. There is a real difference by iamacat · · Score: 1

    If DDG doesn't store data persistently or share cookies with other sites, NSA would have to dedicate a data center bigger than DDGs own one to store all searches and subsequent clicks if they are needed later. They would then only have IP addresses which would be hard to resolve to identities of foreign users they are most interested in. They would never be able to scale this to EVERY popular site in existence.

  52. NSA be damned.... by hotrodent · · Score: 1

    I use DDG because [a] it's simply not Google, [b] the CEO posts on slashdot, [c] they're clear about what they do and don't do, and [d] they have a cool bow-tie wearing duck as their mascot!

  53. Re: DuckDuckGo sucks by SeaFox · · Score: 1

    Actually, I have a Quick Search set up on Firefox for it.

  54. Re: DuckDuckGo sucks by SeaFox · · Score: 1

    If be "navigating" you mean typing "wiki (search term)" in my address bar, causing the Quick Search I have set up in Firefox to automatically run it through Wikipedia and take me straight to the results, then yes.

  55. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    That's a feature Firefox has had built-in since version 2.something.

  56. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Try bookmarking this:

    http://en.wikipedia.org/wiki/Special:Search/%25s ...and then make "wiki" the bookmark's keyword.
    Now start typing your search in the address bar and make "wiki" the first word.

  57. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Oh, I agree, but it's worse than that.

    Not only does DDG put that "helpful" wikipedia excerpt/link at the top of their search results, but if you install the "DuckDuckGo Plus" Firefox extension, they will intercept your Google search, and cram that box in your Google search results as well. I get that some people may want that functionality (I don't -- if I use Google, it's because I want to see exactly what Google returns), but it's questionable to have this sort of content injection enabled at all in an extension whose primary purpose is to add a search engine to the search-bar, search completions, etc. lists, not to perform content injection.

    Why not set up Quick Search bookmarks for every engine and get rid of the search bar (and those extensions)?

  58. Re:DuckDuckGo sucks by WGFCrafty · · Score: 1

    I like to think that would be true, but honestly about 50% of the things I click on in a Google search are Wikipedia articles, even when I didn't initially search Wikipedia directly.

    I feel the same. Google's search is better, and it could be when searching about, say, wagon wheels, there is a more definitive site than wikipedia.

  59. The NSA Canâ(TM)t Lose by Taco+Cowboy · · Score: 3, Insightful

    I read TFA, and the paragraph title "The NSA Canâ(TM)t Lose" really irked me.

    But, as an American who knows that my own government has turned into a cabal, I know that it is the reality.

    I used to be proud as an American. Used to be.

    Now, I hang my head low, feeling so powerless, so ashamed.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:The NSA Canâ(TM)t Lose by craigminah · · Score: 2

      Ironic you chose those wordsthe First Lady was, "for the first time in her life", "proud to be an American." I think we the people need to speak our minds and let The Man know we don't want to give up our rights as Americans. Doesn't this mean the terrorists are winning if their actions cause our government to infringe on our rights?

    2. Re:The NSA Canâ(TM)t Lose by Dcnjoe60 · · Score: 1

      Ironic you chose those wordsthe First Lady was, "for the first time in her life", "proud to be an American." I think we the people need to speak our minds and let The Man know we don't want to give up our rights as Americans. Doesn't this mean the terrorists are winning if their actions cause our government to infringe on our rights?

      Except that the infringement of rights was occuring even before 9/11. Using terrorist and national security as the reason are only ploys to keep the public at bay. So, technically, the terrorists aren't winning, because all the surveilance and infringement doesn't have anything to really do with them. They were just a means to an end by those in power.

    3. Re:The NSA Canâ(TM)t Lose by craigminah · · Score: 1

      The government is using "terrorism" as a buzz word to do what they want. I don't care if President Bush or Obama started it, this isn't an issue based on political parties. I do think programs like these have grown and they are always justified by "hunting terrorism." When the Director of National Intelligence, Mr. Clapper, tried to explain away and justify the NSA program he cited it's effective use vs terrorism.

      What other reason is there other than distrust of Americans and I don't think they will go that far.

      I don't think these programs are inherently bad, but they need a lot of oversight to prevent them from devolving into a big brother state...that's all. I still love my country but we (e.g. average citizens) need to let our elected representatives know what we want, and if being watched is ok with the majority of citizen, then so be it. I don't mind too much but I don't want to see drones spying on Americans.

    4. Re:The NSA Canâ(TM)t Lose by doccus · · Score: 1

      Yes, the First lady wasn't yet the first lady at the time, but just a black woman who had seen firsthand the terrible way things really were, and made the mistake of speaking her mind. She hasn't repeated *that* mistake!. The prez also appears black, but has betrayed those of every creed and color. I would have been a lot happier if Jesse Jackson Jr had been the first black US president...

  60. Re:DuckDuckGo sucks by ssam · · Score: 1

    I use duckduckgo's !bang feature https://duckduckgo.com/bang.html

  61. DuckDuckGo is hosted in America by allo · · Score: 1

    any further questions?

  62. Re:DuckDuckGo sucks by allo · · Score: 4, Insightful

    if you search for something, you may want to have web-results and wikipedia. When DDG displays you an excerpt from Wikipedia (like a Definition of your term), it may be enough, so you do not need to open wikipedia, but read it just before reading the rest of the search results.

  63. Re:DuckDuckGo sucks by allo · · Score: 1

    why the Special Search? Its just one page more ... try using:
    http://en.wikipedia.org/wiki/%25s

  64. Re:DuckDuckGo sucks by allo · · Score: 1

    who needs such plugins? I did not install it either, just as i do not install stupid toolbars. Some people may want it, but noone is required to use it.

  65. so ? by Tom · · Score: 1

    Even if it would do just that, it would still be a step in the right direction.

    --
    Assorted stuff I do sometimes: Lemuria.org
  66. Re:DuckDuckGo sucks by BrokenHalo · · Score: 1

    Even when I'm specifically searching for Wikipedia articles, I usually find a Google search including "wiki" much quicker than Wikipedia's search. I guess it's a simple matter of how much money can be spent on great servers.

  67. Re:DuckDuckGo sucks by BrokenHalo · · Score: 1

    what do you expect? it's bing.

    On what do you base that statement? (I have only played with DDG briefly, and found it OK, but bing is total crap).

  68. Wiki by unixisc · · Score: 1

    I fully agree w/ this. I use different browsers, and in IE, I've made Wiki the default and in Firefox, DuckDuckGo the default. In Chrome, I've left it w/ Google. If I want the Wiki explanation of something, I check Wiki, but otherwise, I check other search engines and ignore their Wiki results.

  69. Re:DuckDuckGo sucks by Patch86 · · Score: 1

    I use Startpage on some of my machines as the default, but it's not as good at Google. Plenty of searches that provide fruitful results in Google return nil results in Startpage.

    I've never used DDG in anger; I should probably give it a go.

  70. A Blog With One Post by dcollins · · Score: 1

    It's been said above, but boy... the linked article seems SUPER fishy. It's the one and only post on a newly-created blog, just for the purpose of hammering DDG on this issue, apparently. It has a lot of claims that are adamantly delivered but seem really suspicious. For example: The claim that FISA can order real-time intercepts of any data, even data that the company itself doesn't collect during its business operations. (CEO of DDG responds respectfully in comments and blogger slaps him down and calls him a liar.) There's a bunch of things that ping my "don't trust this" alarm.

    --
    We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
  71. I've long held that privacy is an illusion. by mark-t · · Score: 1

    ... only maintained by whatever levels of disinterest in one's affairs people around them might have. Because people are generally concerned with their own affairs more than other people's, it can often be fairly easy to hold onto privacy, ironically, in a public place. Although there's nothing in such public places to necessarily keep arbitrary people from seeing or hearing whatever it is you might want to keep private, as long as you aren't doing anything which would actually attract outsidee attention, it's unlikely that anybody around you will be paying enough attention to notice, and you can achieve privacy through apathy.

  72. Sets up a legal defense by phrackthat · · Score: 1

    One of the things that courts consider when looking at whether communication evidence should be suppressed under the 4th is the measures that the person took to keep the communication private - in short, is there an expectation of privacy? While Duck Duck Go's search engine does not provide perfect opacity, it does provide evidence that you intended to keep your search request private and that you had an expectation of privacy that is worth protection.

    1. Re:Sets up a legal defense by Stan92057 · · Score: 1

      Who owns DuckDuckGo? Are they an American company? If so they will be forced by our corrupt government to save all US and foreign citizens search results. The Other worrie if they decide to go public, that will also be the doom of DuckDuckGo or anyother company that goes public. All IMO off course.

      --
      Jack of all trades,master of none
  73. Re:100% serious question [about searchability] by waterbear · · Score: 1

    >I've never, ever found anything on search engines.

    Pity about that, I've found them useful in a variety of subjects, usually topical or technical. Your experience stated at that level of generality could have two causes. (a) You could be searching for some difficult target subject, where the web-objects you want to see just don't have any characteristic searchable 'flag' words with relevant meaning. (b) It could be your search technique, not searching by the 'flag' words that do characterize your subject.

    Case (a) would cover subjects where the only characteristic words are heavily used elsewhere too, bringing search results with low 'signal-to-noise ratio'. Examples are person-searches using very common names.

    You mention searching for software. Searches in some software areas could be difficult, I guess, if the only 'flag-words' are either pretty much meaningless or over-generalized tokens, or else, words arbitrarily transferred from other contexts in defiance of their usual specific meaning. (Maybe their authors haven't thought about searchability, or else just don't want them to be found in searches.) If that's the special stuff you're searching for then you may be SOL :(

  74. Route encrypted out of US? Not sure it'll help. by xenoc_1 · · Score: 1

    Problem is, running through another country, especially one that does not have an NSA-reciprocity deal, is itself most likely a marker to NSA to pay extra attention. Plus doesn't the NSA have full authority to monitor transmissions where at least one side is outside of the USA? Sure, they don't need no steenkin' warrants. But their surveillance becomes arguably even more legal (by US law) and less unconstitutional, if you have voluntarily routed outside of the USA.

    I don't disagree with your advice; in fact I do the same thing often, VPNing to Venezuela, or Iceland, or random other countries first, when the sites/transactions I'm using do not require specific IP geolocation. It makes it harder to track, harder to decypher. But I don't think it is all that meaningful, because it puts in more on the NSA "radar". In part, I do it as a big FU to NSA, like a bumper sticker or political billboard. But I have little faith that it makes it all that much more difficult for NSA to determine patterns of my traffic, if they really want to do so. Sure, it keeps my ISP in the dark.

    But my ISP is the freakin' government of Uruguay, via Antel, which is the fixed-internet monopoly in this "socialist" country. So I'm on the NSA radar anyhow, as one of those "evil Americans who leave the country". Though "Tio Pepe" Mujica, held for a dozen years in a US-funded jail, two at the bottom of a well, would probably tell them to FOAD anyhow. Just as he is doing to the toady EU countries that denied Evo Morales air overflight, by recalling Uruguay's ambassadors.

  75. Re:DuckDuckGo sucks by hobarrera · · Score: 1

    Actually, it's not 100% wikipedia. It displays smart information on top.
    I remember searching for an apache httpd configuration directive last week, and DDG showed a snippet of the documentation on top. It was exactly what I was looking for. It's slightly smart, and rather helpful in general.

    Personally, I use DDG as my primary search engine. But when I need to look for very specific issues (why is my commanlink not working with X and Y in JSF), I find that google gives better results. Google still works better if you have lots of keywords or long sentances, but otherwise DDG is enough.

  76. Re:100% serious question by gmhowell · · Score: 2

    I have to give you points for a rather interesting troll post, but I'm gonna have to deduct a few for the lack of inherent humor as well as the lack of a specific target.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  77. Re:DuckDuckGo sucks by SeaFox · · Score: 1

    Because if you use regular search and an article of that name isn't there (or a redirect taking you somewhere else from your term) you end up on a page telling you nothing was found for your query, and asking if you want to create a new article on the topic.

    Special search will display the results that closely match what you were looking for, in case it's not quite listed the way you thought, or is covered by a subsection of a different article, etc.

    At least that's how it was when I set up the Quick Search (many years ago). Maybe Wikipedia has changed the behavior of the search box since then.

  78. Re:DuckDuckGo sucks by poetmatt · · Score: 1

    I find bing to continually be less accurate than even yahoo searches. That says a lot, considering yahoo searches are inaccurate.

  79. Re:DuckDuckGo sucks by allo · · Score: 1

    This is exactly the behaviour, i want to have. I know how Wikipedia Titles are written, sometimes they have a redirect, and if i really not find the article, i am at least on the wikipedia-site and can use the searchfield there. But most the time i can avoid clicking on search results / following a redirect first.

  80. Re: DuckDuckGo sucks by allo · · Score: 1

    yeah, you're having some point there ... but on the other hand, count the evil google extensions ...