Slashdot Mirror
DuckDuckGo: Illusion of Privacy
An anonymous reader writes "With all of the news stories about users moving to DuckDuckGo because of NSA spying, this article discusses why the privacy provided by DuckDuckGo is more the privacy from third-party tracking (advertisers) but may do little, if anything, to prevent the NSA from tracking your searches."
"The NSA Can't Loose" ... Really?
I started using DuckDuckGo because, out of all the other search engines out there, it's the only one I've found whose entire mission statement centers around _not_ collecting information on every goddamn thing you do. Yes it's probably still being tapped at the fibre optic cable level so it doesn't really matter, that's not the point. The point is to vote with your dollar, or in this case your page view, far more influential these days than one thinks.
I don't use DuckDuckGo because it preserves my privacy. I use DuckDuckGo because they don't try to take it away from me.
At least for me its not, its about not feeding the beast directly. I jumped to Linux, Opera, and DDG as a way to add a few more cycles and maybe a few more man hours to the mess rather than hand it over directly with Windows, IE or Chrome, and Google. If anyone thinks they can really be anonymous in this ecosystem they are sorely mistaken. I do believe however there are less trodden paths and a little more pains in the rear that can be had, and as a silent protest, I chose to use them.
While the NSA brand of privacy invasion will probably never be avoidable, unless you renounce all forms of data transfer, it's pleasing to have SOME control over your internet presence in so far as keeping advertising trackers off your back. I don't think it says anywhere at DuckDuckGo that it avoids NSA tracking. and anyone using the service who believes it does so is unaware of how the NSA programs work.
I may be breaking the fundamental rules of Slashdot, but ...
- the "article" is a single post on a recently created blog
- they misspell "lose"
- a quick google of Brett Wooldrige doesn't bring up anything exciting (a Forbes blog account with no content?)
This is the very definition of "nothing to see here, move along".
-
This is one, gigantic, "no shit, sherlock".
Is it any safer? They bill themselves as "the world's most private search engine" but that doesn't really mean anything.
Run your traffic encrypted through another country with actual privacy protections.
It's not perfect, but it is another complication and barrier to direct monitoring.
Ultimately, the NSA reveal is a good thing - it's going to drive demand for virtual private cloud services where you hold the keys, and perhaps, a move back to corporate controlled cloud services on-site. Great news if you're in IT.
..don't panic
At least Ixquick is not a U.S. company: https://ixquick.com/eng/prism-program-revealed.html
While their searches aren't as fast as Google's, I have found them to be pretty good quality-wise.
This is because DDG does not use crypto algorithms which support perfect forward secrecy.
So it would require significantly more work for NSA to deal with a site using PFS. Source: netcraft
Be gentle. It's his first Blog Post.
It's about as good as a google search and it gives the wikipedia article for any topic at the top. My opinion is better than your opinion.
It's about as good as a google search [b]and it gives the wikipedia article for any topic at the top[/b]. My opinion is better than your opinion.
Don't know about you, but when I want to look up something on Wikipedia, I look for it on Wikipedia. Having Wikipedia info displayed automatically for a search isn't really a "feature" as far as I'm concerned.
I think the article brings up and interesting point about who's SSL certs the NSA has access to. It's reasonable to assume that they are capturing most if not all Internet traffic in the states (at the very least all packets entering or leaving the county.) What is unknown is how much of that encrypted traffic can be easily decrypted. If I were a three letter gov't agency intent on decrypting massive amounts of traffic, I would go straight for the keys. It's particularly of note that DuckDuckGo does NOT use session keys in its SSL implementation, meaning if their private key got compromised, all previous searches would also be compromised. I don't think it's too much of a stretch to assume that the NSA has found a way to that key, either through secret court orders, or good old fashioned nefarious means. Especially for a site like DDG, who makes promises of "privacy". Makes you wonder who else's keys they have access to.
DDG is a reskinned Yandex with shortcuts to search particular sites. If you don't commonly use site: searches on Google, and you can't stand Yandex, you won't like DDG.
Hi, this is Gabriel Weinberg, CEO and founder of DuckDuckGo. I do not believe we can be compelled to store or siphon off user data to the NSA or anyone else. All the existing US laws are about turning over existing business records and not about compelling you change your business practices. In our case such an order would further force us to lie to consumers, which would put us in trouble with the FTC and irreparably hurt our business. We have not received any request like this, and do not expect to. We have spoken with many lawyers particularly skilled and experienced in this part of US and international law. If we were to receive such a request we believe as do these others it would be highly unconstitutional on many independent grounds, and there is plenty of legal precedent there. With CALEA in particular, search engines are exempt. There are many additional legal and technical inaccuracies in this article and I will not address all of them in this comment. All our front-end servers are hosted on Amazon not Verizon, for example. A couple other responses to things I've noticed in the comments already: --Our servers are already located around the world. European users are generally not hitting US-based servers, for example. --We do have PFS on our cert: https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com&s=50.18.192.251
I found it funny that, right there at the top, there's a big proud "Ads by Google" link. There's nothing wrong with that per se, but it does color one's perception when the blogger is basically saying "sure Google is cooperating with the NSA, but they're a lot bigger than DuckDuckGo" (for whatever reason we should care about that).
I switched to DDG a few weeks ago, but it had more to do with my changing perception of companies like Facebook and Google than it did with any idea the move would somehow deter the NSA from snooping on me.
#DeleteChrome
what do you expect? it's bing. Since when did people believe a microsoft-based search is privacy friendly? "anonymous" is just a hilarious misnomer.
I feel compelled to let anyone here who has not RTFA to not bother. It is a poorly written blog entry that's nothing but hyperbole and speculation. It's also badly researched and contains a lot of inaccuracies. One of the commenters is the CEO of DDG and he corrects some of the misinformation.
I've been using DDG for 2 years and it is great. Not always as good as Google but a good alternative for most searches. Make sure you set it to your region (settings).
So, the majority of the population now realizes that their activity is in some way monitored, and they wish to evade that monitoring. They need to consider this: they are amateurs playing for nickel stakes in this game. The NSA doesn't care about them, and the people aren't used to playing this game either, for their part. This game exists, at the moment, primarily between the most sophisticated intelligence apparatus in human history and a very small population that is doing everything they can possibly do to hide. We think that using airgapping a network and using USB drives simply to move data across the room is a powerful security measure...these guys used USB drives to move data between countries, and even that wasn't good enough to protect them. The average citizen merely worries about some amorphous knowledge of their habits...the real target population faces death, or perhaps even worse internment in a black site somewhere for years first. And that population has been working on hiding for quite some time now; this is not a new game just because the rest of us know it's being played now.
So...with that context, why would anyone think that simply using a different search engine fucking matters?
For your security, this post has been encrypted with ROT-13, twice.
Apparently all you need to get front page on slashdot is an article with one link to a blog, that has only one post, created by a random user. Hell the 3rd paragraph of the article beings with 'TL;DR' a phrase I associate with image boards such as 4chan than I do actual journalism and news. While the article is somewhat interesting it's nothing more than an op-ed piece or a letter-to-the-editor at best or some anti-DDG fud created by some PR firm at worst.
I like to think that would be true, but honestly about 50% of the things I click on in a Google search are Wikipedia articles, even when I didn't initially search Wikipedia directly.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
> .these guys used USB drives to move data between countries
Look, if anyone with any sense can bypass the snooping, they must know that. That only leaves *us* that they are snooping on.
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
They have an exit enclave for DDG search engine traffic and also hidden service at 3g2upl4pq6kufc4m.onion...
So there at least they provide some additional layer of protection for those who are needed.
DuckDuckGo should move out of USA (and UK) at this point. They could have a huge business, but not in NSA occupied territory.
1) The reason I switched was because it doesn't use tracking cookies.
2) It doesn't own Android, Gmail, Youtube Adsense Doublclick Maps or a myriad of other sides that can be used to 'un-proxy' me and 'un-NAT' me and get around my cookie blocks.
3) It is https so the NSA *need* a warrant, unencrypted search automatically goes into the NSA database.
4) Gmail failed a link test, a disguised link (not a straight http://...) sent from my old gmail account to a pop3 was visited by a server in Arizona.
5) They don't have a feed to NSA currently, its not listed on PRISM
But best of all
6) It's actually quite good at finding stuff and better than Google at finding job CVs from NSA spooks to see what else they might want to confess to. Google is keeps substituting more popular works.
I assume from this piece that Google are suffering. Well, point 2) is entirely their fault, they linked all that data together so I have little sympathy for them.
I don't like being tracked for daring to question the legality of an illegal mass surveillance program, and Google's can always move their business out of mainland USA and to Hong Kong where they are on the other side of the great spywall of NSAland.
To strip off the referrer. Otherwise the end site would see the URL of the DuckDuckGo search revealing the details of the search, page, etc.
I don't know but if you do not want to use Google, DuckDuckGo is by far one of the best alternatives. Try doing temperature, currency conversions with DuckDuckGo, the integrated results from WolframAlpha are pretty good. The only thing is missing is image search imho.
Name me another major web search engine with an official Tor onion endpoint. DDG is the only one I know.
https://3g2upl4pq6kufc4m.onion/
https://3g2upl4pq6kufc4m.tor2web.org/
The only thing is missing is image search imho.
Use ixquick.
Actually, use ixquick (or its sister site startpage) for all the other stuff, too.
I have been using DuckDuckGo for some time now but stopped lately because I notice something fishy. When you hover over a link the bar at the bottom of the screen displays the link address to make you believe clicking on that link will go to that address, but if you look closely at it when you click it flashes "Sending Request..." then "Waiting for https://duckduckgo.com/" and finally "Waiting for https://what-you-clicked.com/". So they are redirecting all the search results so they know who clicked what. Great. There is no reason a company dedicated to privacy would be using any type of redirect, they should take you directly to the page you clicked simple as that.
When was the last time you searched for something and found it using a commercial search engine?
Three minutes ago.
I've never tried DuckDuckGo, but did today because of this article. I chose a type of search that I do often and tried it on Duck, Google, and Bing. (Searching for a specific string on a large forum website.) Google, my usual favourite, came in last. Middle was Bing, and for some reason, DuckDuckGo was the best, and found things for me I had never before known about. I was mildly impressed. I know this is totally anecdotal, but it made me happy. That, along with the slightly better privacy, made me switch today. Also, I think it's important to punish Google for rolling over for the US government. They were somewhat good at standing up to the Chinese government for privacy issues, yet did nothing when the USA decided to do far worse. In my opinion, they've lost every bit of good will they've gained with their "don't be evil" slogan and policies. They're no better morally than Goldman Sachs, Monsanto, or Microsoft, the slow slide into corruption is now complete. On to the next underdog...
Yes, your ISP will be able to tell that you are using Google from the IP address but all of the communication (that includes the web address) should be encrypted.
I read TFA, and the paragraph title "The NSA Canâ(TM)t Lose" really irked me.
But, as an American who knows that my own government has turned into a cabal, I know that it is the reality.
I used to be proud as an American. Used to be.
Now, I hang my head low, feeling so powerless, so ashamed.
Muchas Gracias, Señor Edward Snowden !
if you search for something, you may want to have web-results and wikipedia. When DDG displays you an excerpt from Wikipedia (like a Definition of your term), it may be enough, so you do not need to open wikipedia, but read it just before reading the rest of the search results.
I have to give you points for a rather interesting troll post, but I'm gonna have to deduct a few for the lack of inherent humor as well as the lack of a specific target.
Jesus was all right but his disciples were thick and ordinary. -John Lennon