As a governmental spy organization, why wouldn't you just put surveillance on the search engine that is used by people that have "something to hide" (in their mind) and also put a gag order on the operators of that service?
I started out thinking "theory and reality", but, even in theory, adding a ton of very slow, latent, and unreliable data sources to your query doesn't produce a fast result.
I encourage people interested to look at "Peer-to-Peer Information Retrieval: An Overview" in order to get a better understanding on what technical challenges distributed search engines like Yacy have yet to overcome and the paths researchers are taking to overcome them.
On the other hand, there is a lot we can do to protect our privacy from corporations. I do simple things like using duckduckgo, using a private email service that I trust, only using chrome for social media access, and setting Firefox to be as secure as possible and drop all cookies every time I close it.
I read the comment prior to the username and thought your description of browser use sounded familiar, then checked the name and wasn't surprised that it was your blog where I saw this recommendation.
Do you still use Ghostery with Firefox and Fastmail for email?
I really enjoy your blog btw.
Most have servers in data centers in 10+ different countries, so I doubt they are all closely monitored nor capable of keeping their keys closely guarded.
Most VPNs like to advertise the 'military grade encryption' or 'no logs' nonsense, I'd rather see them post results of security audits, ideally conducted by outside firms.
It probably doesn't matter because 99.999% only want to access Netflix in another country. Out of the remaining 0.001%, most are just people from repressive countries dodging their country's porn filters.
If they are giving people the service they want then how is it a scam?
There are loads of trash VPN providers, but there are a lot of genuine ones that really care about privacy activism and provide an honest service.
However, an adversary can also fingerprint your OS/patch level based on packet structure[1][2] - which can't be easily changed. This will add more identifying bits.
1.http://nmap.org/book/osdetect-fingerprint-format.html
2.http://www.windowsecurity.com/articles-tutorials/intrusion_d...
https://panopticlick.eff.org/browser-uniqueness.pdf
All in all it's pretty scary though. My browser is unique among 5.3 million or something. And then there's the algorithm they mention that can detect fingerprint changes with 99.1% accuracy, and be used to do things like recreate cookies that you deleted.