Their tunnel uses TLS termination. When we use TLS/SSL certificates on a server, we want the data to be encrypted between your server and the clients connecting to it. When you use Cloudflare’s tunnel, that TLS connection is terminated, that is, decrypted on their servers and then it is re-encrypted and sent to your client. So, theoretically, they can look at all the data going through. But do they sniff in to your data, that is upto what you believe.
If you are self-hosting for privacy, this is a bad idea. Free solutions like Cloudflare and Tailscale all do TLS termination. What you want is TLS pass through. You can rent a small VPS and set up TLS pass through using something very simple, like HAProxy, NGINX Proxy etc.
Cloudflare is one of the biggest privacy violators. They effectively act as a MITM which has your SSL keys and can read all the traffic between your browser and a website. Now imagine a single entity having the SSL keys to read the traffic of an important portion of the internet.
What does “censorship” mean? The entire purpose of a search engine is to “censor” bad results so I would argue that they all have censorship. And if they don’t they’re probably a bad search engine.
Yes, the term censorship in this context is particularly infuriating to me. It’s not censorship since these are privately owned websites that can link to whatever they like, and users can choose whether or not to use them. When DuckDuckGo launched, before privacy concerns were such a pressing issue the fact that they filtered poor quality sources was one of their most advertised selling points: technologyreview.com/…/the-search-engine-backlash…
Isn’t it just enough to use Google with Firefox in a Google container (and uBlockOrigin and Canvas locker)? In this way no search can be tied up to me.
P.s. I also have the plugin Google search link fix, but I’m not sure it’s needed with the Google container
Maybe someone can ELI5 how Kagi works then. Yes, I read all their documentation, but I’m still not convinced on the “100% privacy-respecting”. In our world of proprietary back ends with peepers, cloud backdoors along with home assistants and cars that say “we don’t listen”, but suddenly have evidence when they need it - How can we trust Kagi? They say;
no telemetry, ads, or collection of private information
and
we do not log searches or in any way tie them to an account
But there’s “plans” that count your searches per month, so that is attributed to your account. They can tell if you use a bang, so they do have the ability to see what you search for. They also see if you reload the same search, so it knows exactly what you searched for. They can tell the difference between images and news and whether you’re loading more content, and attribute that to your account.
What I’m hearing is that we’re supposed to trust them when they say “hey guys, we don’t look even though we can/could see everything”? Is that it?
It’s most likely an API linked to your logged in account that counts each search performed and logs it against your account. You don’t need to see a user’s search to track that information.
That sounds reasonable and likely the method. Would you indulge a few more relevant questions? Could that API also know your search term without sharing it? How can we know that the API is not being abused? And, can access to an API like that be shared, or hacked? Are we still at “we don’t look even though we could”?
My favourite search engine, Ecosia, is listed. I’d prefer if they didn’t log IPs, but their cause is so good and effective that it’s worth it to me. I can use a VPN if it bothers me.
That should definitely be linked for context of this “data”
Edit: That article directly calls 4get “the best search engine”, and the diagram implies that to be the case as well. Given that 4get has existed for 4 days I just find everything else from the author to be very suspect. This should at least have the author’s context added or more of a heads-up that this isn’t exactly rigorous data. 4get’s current audit status is just trust me bro, which I find difficult when the entire rest of the about page is filled with immaturity.
I found someone on 4chan that wouldn’t stop announcing this engine on /g/, most likely the owner as well. And seeing that the name is 4get, it probably started there
Publicly existed. It was announced 4 days ago. The author said they have been working on it for a full year now, but until they release it there’s really no way for third parties to be using it and forming opinions.
Add comment