Hacker News Reader

Comment by belorn | Hacker News Reader

Most of the points is arguing that NSA could compel the company Duck Duck Go, Inc to install equipment and then forbidding the company from disclosing that fact.

Doing so does carry quite a bit of political risk. There have been quite a few lawsuits from EFF and ACLU in regard to do so, and as the comment from CEO of Duck Duck Go says in the comment thread, all existing cases has been about turning over records. Going the extra step of compelling people to install hardware and keeping the operation going would be a further step.

I doubt ddg is currently worth the political risk. There is likely much easier targets to attack first in order to get 100% of the worlds search data.

*down votes? Explanation?

View on HN

I'm not sure if they really need to compel DDG in the first place.

I know if I was a three letter agency, I'd start a "secure" service like DDG myself as kind of a honeypot.

Not that I'm saying that such an agency is actually behind DDG -- I have no way of knowing. But I would be very surprised if a large number of services promising "security" and "privacy" weren't run by such agencies or their agents.

That's why I believe that frequent, independent third-party auditing (by multiple trusted groups like the EFF) would be necessary to gain any kind of confidence in such services. Even then, it'll be no guarantee that they're not compromised, but it would just make such compromise significantly more difficult and less likely to be effective.

While that is always possible, I think its more plausible that they then simply buy out key companies rather than found a bunch of new companies in hope that one will succeed. The question then is, what is the likelihood that NSA is the secret owner and operator of Microsoft, Apple or Yahoo, which each would likely be the cost effective choice if one wanted access to all search queries done on the Internet.

Independent third-party auditing is useful. There is the occasional fund raising for auditing of software (Truecrypt comes in mind), but I don't recall hearing one about search engines.

"I think its more plausible that they then simply buy out key companies rather than found a bunch of new companies in hope that one will succeed."

How many new search engines were focusing on privacy and security as their main differentiator from the competition?

I know of only one: DDG

Here is a meta article with the clicky 5 best search engines that respect your privacy with the lesser clicky official title: Privacy Search Engines 2017 Group Review. :"https://www.bestvpn.com/privacy-search-engines/

https://en.wikipedia.org/wiki/List_of_search_engines

That list is long and show that there has been quite a few people have tried to get momentum in the search engine space. Would be interesting if anyone did a meta study to see how many uses the words "security" and "privacy" as marketing to gain users.

I think we should also include open source search engines and p2p, since if NSA developed them they could build backdoors in them. Most of them seems to have "privacy and security" as explicit goals.

The hard part of being a search company isn't starting the company, it's attracting users. Which is almost completely a crapshoot.

Far more viable to let someone else take those risks, then provide a compelling case for them to assist you in your inquries and/or interests.

With DDG's focus on privacy, I wonder why they never had any warrant canaries setup?

>Most of the points is arguing that NSA could compel the company Duck Duck Go, Inc to install equipment and then forbidding the company from disclosing that fact.

You don't need to do anything like that. DDG doesn't crawl the web itself, it uses API providers like Bing (Microsoft/NSA) and Yandex (Russian/FSB). They're legally required to disclose that on their site.

It's possible to identify people solely through anonymised credit card transactions[0] so doing the same for search results is pretty much the same.

DDG isn't private, it just gives the illusion of privacy, same as TOR. That said though if you're a high profile target then there's much more direct means to track what you're searching.

[0]http://www.sciencemag.org/lookup/doi/10.1126/science.1256297

Reply on news.ycombinator.com