Hacker News Reader

Comment by mortehu | Hacker News Reader

Note that DuckDuckGo doesn't use Diffie-Hellman for its key exchange, so if someone gets ahold of their private keys once, they can decrypt all previously captured traffic as well as all future traffic. It seems they use the same certificates for a year at a time.

View on HN

I just noticed their HTTPS termination point is hosted on Amazon EC2, so the only thing required for extracting the private key or logging the data is a contact at Amazon. No reason to involve DuckDuckGo at all. Since Amazon EC2 hosts are virtual machines, you can just read the machine's RAM and disk from the physical machine it's running on.

eta: I don't believe Amazon would agree to do that, or that there is a law allowing anyone to require them to do that.

> Note that DuckDuckGo doesn't use Diffie-Hellman for its key exchange,

Source?

Open https://duckduckgo.com/ in your web browser and click on the green padlock. Note that the certificate is from 2012, and that the key exchange method is RSA.

I never heard about that's a problem. I checked several popular sites, Google, Amazon, Apple, Bank of America. They all use RSA.

Do you have examples for secure site (under this aspect) and background info?

Are you sure? google.com uses ECDHE_RSA here.

eta: You also asked for background info. It's been discussed on Hacker News recently: http://en.wikipedia.org/wiki/Perfect_forward_secrecy

> Are you sure? google.com uses ECDHE_RSA here.

You are right about google.com, the others still use RSA.

Thanks for the background info. Maybe SSLLabs should take this into account when doing their tests. Until now they make no difference between DH and RSA.

You miss the point: DDG offers just search and doesn't log much. Google for example has another 10 (?) or more data points to connect you with that search, logs as much as they can and they hold it for ages. On Google NSA has to just ask for it, not worry about decrypting it.

My point is that you can't have privacy without security.

As I mentioned in a past comment[1] you can opt out of having your search history stored, and delete what's currently stored by Google.

1. https://news.ycombinator.com/item?id=5842670

Does that actually delete all traces of the search history, or does it only delete a user's view of their "web history?" In other words, if a Google user is later involved in a court case, would a subpoena or a warrant be able to reveal their search history, even if they deleted their "web history"?

It would be my expectation that Google still stores all of your search queries, even if you don't have web history enabled.

Due to techniques like garbage collection, debug logs and full backups, I think it's difficult for huge litigation targets to make blanket statements about deleting user data.

edit: Redacted part of the comment to avoid quoting policy out of context.

That says nothing about search history, and "stored" could only refer to the "Web History" feature itself.

Is it really deleted? Or are you simply opting out of having it displayed in your account's page? According to the FAQ, "If you remove items, they will be removed from the service and will not be used to improve your Google experience". Words are important. Your history is removed from the service, not the servers. It won't be used to improve your experience, but nothing says it won't be used for something else

What makes you think that stops google logging what you're doing? They explicitly reserve the right to continue to do so.

Reply on news.ycombinator.com