Hacker News Reader

Comment by latch | Hacker News Reader

DDG logs very litte information...so while NSA can subpoena DDG, there's no data to get.

Developers should read "Playing chicken with cat.jpg" [1] which was a response from cperciva [2] to the 37 Signals privacy blunder. It was discussed quite a bit on HN [3] and for me it was a perspective-changing read on privacy.

[1] http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...

[2] https://news.ycombinator.com/user?id=cperciva

[3] https://news.ycombinator.com/item?id=3484284

View on HN

Why bother asking DDG itself when traffic can be intercepted and logged at their ISP?

IIRC HTTPS would encrypt your data from your ISP.

Until PRISM subpoenas DDG and gets their private keys -- after which they can decrypt the SSL traffic.

Not necessarily possible even with the private keys. If you use an SSL cipher with ephemeral keys, such as the DHE_* or ECDHE_* family of ciphers, then an eavesdropper with a recorded but not MITMed conversation cannot decrypt it even with the server's private SSL key.

See http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se... for example.

What's preventing the government from coercing DDG to start log collections at their end, and then sealing it with a gag order?

Which of course they do not. Google uses ECDHE_RSA. DDG uses RSA. ixquick, "the world's most private search engine", uses RSA. Bing does not even offer https.

Google does pin their keys in Chrome though, so they know if there is a MITM (and they have, Chrome's certificate pinning led to DigiNotar's downfall). It's a non-scalable hack, but definitely a good one for the largest search engine and a leading email provider to be able to provide.

Your ISP probably has these installed on every one of their racks:

http://www.wired.com/threatlevel/2010/03/packet-forensics/

That's why you should https everywhere.

https://www.eff.org/https-everywhere

Don't forget link owners. NSA and other bastards can force data centers and link providers without knowledge of DDG. They can split, sniff and store all that data, even if they atm don't know how to decrypt some traffic. One day they will know. It's friking 1984^2

Reply on news.ycombinator.com