76
Kagi Blog - Education Shouldn't Be Held for Ransom (blog.kagi.com)
submitted 2 days ago by to c/privacy@lemmy.ml
19 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 day ago (3 children)

I've been using Kagi off and on for about 6 months and overall I've enjoyed the experience. That being said, while they have a way to browse anonymously/privately, it's hard to take their word for it when you have to sign in to use their product. I'll probably continue to use it, but if I really need some privacy, I'm just going to fire up that onion and wade through DDG results, which are still alright.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 1 point 1 day ago (2 children)

    You seem to be misinformed. Kagi's privacy pass cryptographically proves that you're allowed to search, without having anything link back to your account. It doesn't get more anonymous than that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 day ago (1 child)

    No, what they said is technically accurate.

    The whole point of their architecture is that they don’t have to look up your account — but that does nothing to guarantee that they don’t decide to look up your account.

    Since you have to auth in order to generate the anonymized tokens, Kagi could (in principle) track which account generated the tokens and query that relationship when you go to use a token.

    Ultimately, if you’re not fabricating your own silicon and hand-writing your own assemblers and compilers, you gotta trust someone, so it’s good enough for my risk profile, but I can understand if that’s not good enough for some people.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 day ago

    That is factually incorrect.

    Help page from Kagi (I'd understand if you don't trust it), fit for non-techie consumption. https://help.kagi.com/kagi/privacy/how-does-privacy-pass-work.html

    So here's the RFC, which defined the protocol in the first place (Kagi didn't invent it, just implements it) https://www.rfc-editor.org/info/rfc9576/

    As such they have absolutely no way of 'deciding' to look up a searchers account based on the token used.

    That ofcourse does not reduce other ways anyone can track you like fingerprinting.

  • permalink
  • fedilink
  • source
  • parent