DuckDuckGo privacy: A search engine that doesn’t track its users | Hacker News Reader

DuckDuckGo privacy: A search engine that doesn’t track its users

slate.com

57 pointsrpm432119 comments

Note that DuckDuckGo doesn't use Diffie-Hellman for its key exchange, so if someone gets ahold of their private keys once, they can decrypt all previously captured traffic as well as all future traffic. It seems they use the same certificates for a year at a time.

You miss the point: DDG offers just search and doesn't log much. Google for example has another 10 (?) or more data points to connect you with that search, logs as much as they can and they hold it for ages. On Google NSA has to just ask for it, not worry about decrypting it.

My point is that you can't have privacy without security.

As I mentioned in a past comment[1] you can opt out of having your search history stored, and delete what's currently stored by Google.

1. https://news.ycombinator.com/item?id=5842670

Does that actually delete all traces of the search history, or does it only delete a user's view of their "web history?" In other words, if a Google user is later involved in a court case, would a subpoena or a warrant be able to reveal their search history, even if they deleted their "web history"?

It would be my expectation that Google still stores all of your search queries, even if you don't have web history enabled.

Due to techniques like garbage collection, debug logs and full backups, I think it's difficult for huge litigation targets to make blanket statements about deleting user data.

edit: Redacted part of the comment to avoid quoting policy out of context.

That says nothing about search history, and "stored" could only refer to the "Web History" feature itself.

Is it really deleted? Or are you simply opting out of having it displayed in your account's page? According to the FAQ, "If you remove items, they will be removed from the service and will not be used to improve your Google experience". Words are important. Your history is removed from the service, not the servers. It won't be used to improve your experience, but nothing says it won't be used for something else

What makes you think that stops google logging what you're doing? They explicitly reserve the right to continue to do so.

> Note that DuckDuckGo doesn't use Diffie-Hellman for its key exchange,

Source?

Open https://duckduckgo.com/ in your web browser and click on the green padlock. Note that the certificate is from 2012, and that the key exchange method is RSA.

I never heard about that's a problem. I checked several popular sites, Google, Amazon, Apple, Bank of America. They all use RSA.

Do you have examples for secure site (under this aspect) and background info?

Are you sure? google.com uses ECDHE_RSA here.

eta: You also asked for background info. It's been discussed on Hacker News recently: http://en.wikipedia.org/wiki/Perfect_forward_secrecy

> Are you sure? google.com uses ECDHE_RSA here.

You are right about google.com, the others still use RSA.

Thanks for the background info. Maybe SSLLabs should take this into account when doing their tests. Until now they make no difference between DH and RSA.

I just noticed their HTTPS termination point is hosted on Amazon EC2, so the only thing required for extracting the private key or logging the data is a contact at Amazon. No reason to involve DuckDuckGo at all. Since Amazon EC2 hosts are virtual machines, you can just read the machine's RAM and disk from the physical machine it's running on.

eta: I don't believe Amazon would agree to do that, or that there is a law allowing anyone to require them to do that.

Has anyone independently verified their claim? What better way to identify "people of interest" than to advertise a site that doesn't track you and then see which people use it and then track them. Talk about solving finding the needle in the hay, let people self-flag themselves.

Their main feature is privacy, so if news came out that they were actually tracking users, it would pretty much destroy the business. Given that, it would make @yegg really vulnerable to blackmail by employees.

Again, I advertise I'm not sharing data and everyone buys up into it without verifying. I have asked friends at Facebook about sharing data with NSA, their response is FB is very transparent and someone would have seen it. So it's very possible they share data and their employees don't know. I hate to use this phrase, trust but verify

Every time I've thought about using ddg instead of google, I last about on day because its not very good :(

A search engine that claims it doesn't track its users.

Reply on news.ycombinator.com