Hacker News Reader

Comment by tamimio | Hacker News Reader

Kagi is one of the few services that I will never use, it’s a privacy nightmare. Imagine all your search history are tied to one account, an account that id you with your payment information, and is hosted in the US? Google is better at this point, at least you can use it without an account.

View on HN

Here ya go:

https://help.kagi.com/kagi/privacy/privacy-pass.html

Is it open source? Audited? It is like back to how vpn services try to establish some sort of a trust relationship, which imo is more dangerous to have a false sense of trust than none, I prefer no trust at all, zero trust, especially when the service is SaaS in the US.

Man, if only the article I had posted had answered those questions. That sure would be nice

https://blog.kagi.com/kagi-privacy-pass

https://github.com/kagisearch/privacypass-extension

https://news.ycombinator.com/item?id=43040521

Yes and yes, since you you apparently aren't capable of reading for yourself

-edit- I decided I didn't like the tenor of the comments I made. This tone serves nothing but to degrade the quality of online discourse so I will say this:

I don't personally have the technical chops to verify the claims that Kagi is making. And no one should blindly trust the statements of faceless companies. For me personally, the claims, discussion in the linked hacker news post, and the direction of Kagi's economic incentives are enough to satisfy me personally. Nothing says that someone else must be satisfied by that level of evidence, which is definitely not proof positive. However, I also very strongly believe that the level of paranoia that it takes to decide that all of that is not enough would also 100% disbar one from using google, even without an account. I do not think that one can honestly say that, with the evidence we have on hand, that Kagi is less privacy protecting that google. They may not be privacy protecting enough, whatever standard that is for someone, but they are absolutely doing more than google.

Great, Can I host it? A memory injection server side exploit can leak/track/ID any person of interest. This is Signal server way all over again. If I can host it, AND the payments in something like monero for the server that aggregates the queries, we have the foundation of privacy, not perfect as there are a lot of other stuff to go through, but good starting point.

So you think being logged out of Google will keep you more anonymous than this Kagi Privacy Pass setup?

Do I think using a search engine that doesn’t require an account and I can get the queries through an aggregator is more private than another that has an account/token linked back to you? Yes.

Just curious, with this privacy pass setup, how do I know that the server generated "auth token" is not actually linked to my account somehow?

It should also work with the Cloudflare privacy pass extension [0] FWIW, since Kagi just implemented RFC 9576 [1]

[0]: https://blog.cloudflare.com/privacy-pass-standard/

[1]: https://www.rfc-editor.org/rfc/rfc9576

Here‘s an in-depth review from 03/2025 where Kagi and Metager are compared by german IT-Sec expert Mike Kuketz and his team.

No privacy-related concerns were raised back then.

It is a german blog (sorry, couldn’t find an EN-version), and a very trustworthy source for me.

https://www.kuketz-blog.de/besser-als-google-bezahlsuchmasch...

They don’t store search history linked to accounts. Logs are only retained for 7-90 days[0].

You can pay anonymously[1]. You can also authenticate anonymously, as someone else already mentioned.

Meanwhile Google retains everything forever and does everything in their power to track everything you do across the web and tie it back to you, logged in or not. This is their entire business model.

[0] https://help.kagi.com/kagi/faq/faq.html#why-trust

[1] https://blog.kagi.com/accepting-paypal-bitcoin

You must be joking. Google ties all of your searches to you wether you log in or not.

I’m certainly not joking. Google when it started it wasn’t as evil as now, but the bigger it gets the more evil it becomes, who knows what kagi will turn into if they got as big as google. But again on principle, can you use google search in the library without an account? Yes. Can you use kagi in the library without an account? No. So whenever and whatever you do, your queries are logged and tracked back to you, only waiting for xyz to be pulled out.

Google still lets you do some things without logging in but that doesn’t mean that they don’t build profiles or try to link them with other activity sources. Most of their revenue comes from advertisers paying for targeting.

The paranoia but also the naïveté of internet tracking is a bit of a rare combination I think. Shadow profiles have been a thing for 15 years or more and they have only gotten more sophisticated. Browser fingerprints are surprisingly unique. Unless this guy is rotating machines / vpns / using qubes / etc Google can very likely pinpoint within a degree of certainly which searches are theirs.

It isn’t paranoia when there are clear facts in here, the first fact is your queries are linked to your account, period. Second fact, you don’t control the server in any way or shape. Third, your identity is linked through your payment information, aka full legal details, not just through an IP. Comparing between all that and browsers fingerprinting is muddying the water, you can use searxng in the middle and anonymize the query, with no profiling cookies etc., adding few extra steps and it’s private for most people unless you are a person of interest, in kagi, this doesn’t exist! Even the anonymizer is ran by the same company, so much trust!

I am not paid to design kagi architecture nor I know the internals, but let’s say I can host that mentioned anonymizer myself (say in Canary Islands), and it pulls the queries from kagi who you have paid for by monero, then the company knows nothing about the user, no profiling, no tracking, nothing, that’s a great starting point.

If this doesn’t exist, using something like searxng is far better (privacy wise), not just as mentioned on how it’s more anonymous, but also it gives you the ability to blend in, rather than looking like a sore thumb in the logs.

Let me get this straight. Your privacy plan is to alternate library computers while searching logged off Google? I'm impressed with your dedication.

> Can you use kagi in the library without an account? No.

https://kagi.com/libraries

So make a new account every once in a while if you are that paranoid. The whole value proposition of kagi is that it moves you from being the product(eyeballs for ads) to the customer of a product(search results) This flips the incentive of the search provider from abusing you to serving you. Hard to say if it actually will work. But I applaud kagi for trying.

And it is not like you marry kagi and once you sign up you can never use another search engine again.

Reply on news.ycombinator.com