7 ms·

They do not take security and privacy seriously

by hackideiomat 3y ago

elaus 3y ago
Could you elaborate? I didn't find anything in the change log that made this obvious to me.
- hackideiomat 3y ago
  Ha, exactly! They rarely fix bugs. E.g., XSS / HTML injection in summarizer or discuss document. Or their broken CSP which allows injecting forms to e.g., change settings. They haven't fixed many reported issues in a while, and just to prove I'm not lying: https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fchangelog%3F"><h1>lol https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fcha...
  - deleted 3y ago
    [deleted]
  - tmikaeld 3y ago
    While it doesn't look good, it doesn't inject or execute scripts. Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
    - hackideiomat 3y ago
      Oh yes because of the CSP. The CSP that allows forms that can change your settings... you could easily use the above bug to get some impact with an additional click on a form's submit button. Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security. It's not the only place you can inject HTML and not every page has a CSP...
      - tmikaeld 3y ago
        I don't get why they allow injection of irrelevant url parameters in the first place, it's the first rule of any input - remove what's not used and sanitize what is.
- WhyNotHugo 3y ago
  Regarding privacy: an obvious point is that you need to log in to use the search engine, so each search is tied to a unique user. Given that payment is involved, each user can be tied to a real-world identity.
  - rcMgD2BwE72F 3y ago
    >so each search is tied to a unique user Is it? They say searches aren't tied to account: https://help.kagi.com/kagi/privacy/privacy-protection.html#email-address-collection https://help.kagi.com/kagi/privacy/privacy-protection.html#e...
    - WhyNotHugo 3y ago
      The link says that they do not _log_ the searches tied to accounts, but they do receive enough information to cross reference this data.
mdekkers 3y ago
> They do not take security and privacy seriously Anything specific about the privacy angle?
BOOSTERHIDROGEN 3y ago
Which privacy ?
rcMgD2BwE72F 3y ago
Still far better than all the alternatives, no?
- Nullabillity 3y ago
  The alternatives don't demand your payment details.
  - ulrikrasmussen 3y ago
    You can pay for Kagi using cryptocurrency if you want to pay anonymously. The alternatives demand your data and/or lets you pay an attention fee by showing you ads or irrelevant results.
  - digging 3y ago
    Like Google? Whose entire business model is pilfering that data without asking you? And who also asks you constantly to attach a phone number to your account, etc.?
    - Nullabillity 3y ago
      Google works in an incognito window, DDG even works over Tor. Neither is perfect, but it's hard to do worse than "you have to be logged in with an account associated with your payment details".
- hackideiomat 3y ago
  Don't get me wrong, I do use kagi. but it's not nearly what I wish it'd be.
eitland 3y ago
So which search engine do you recommend that takes privacy seriously and that actually works (i.e. doesn't block me and return correct results) in Norway?
- hackideiomat 3y ago
  Maybe MetaGer if you can live with their quality
  - eitland 3y ago
    That was why I mentioned "return correct results". At the moment I am aware of two search engines available to me that doesn't try to drive me crazy by wasting my time on irrelevant results: - kagi.com - and search.marginalia.nu and the second one, while being honest and high quality, has a rather limited index.
    - marginalia_nu 3y ago
      Marginalia Search's still a bit hit and miss. Haven't really actively been working on the search result quality lately, been too busy with various chores away from the actual search end of the search engine. It's gotten a bit better, but mostly by accident, through fixing bugs that had knock-on effects on quality. A directed effort toward unfucking query understanding and index execution is up next on the list of tasks to tackle though. Hopefully it'll make a decent impact.
      - eitland 3y ago
        Unlike Google you still managed to not pull in a irrelevant pages but instead tell the truth whenever you didn't have any results.

They do not take security and privacy seriously

elaus 3y ago

Could you elaborate? I didn't find anything in the change log that made this obvious to me.

hackideiomat 3y ago
Ha, exactly! They rarely fix bugs. E.g., XSS / HTML injection in summarizer or discuss document. Or their broken CSP which allows injecting forms to e.g., change settings. They haven't fixed many reported issues in a while, and just to prove I'm not lying: https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fchangelog%3F"><h1>lol https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fcha...
- deleted 3y ago
  [deleted]
- tmikaeld 3y ago
  While it doesn't look good, it doesn't inject or execute scripts. Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
  - hackideiomat 3y ago
    Oh yes because of the CSP. The CSP that allows forms that can change your settings... you could easily use the above bug to get some impact with an additional click on a form's submit button. Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security. It's not the only place you can inject HTML and not every page has a CSP...
    - tmikaeld 3y ago
      I don't get why they allow injection of irrelevant url parameters in the first place, it's the first rule of any input - remove what's not used and sanitize what is.
WhyNotHugo 3y ago
Regarding privacy: an obvious point is that you need to log in to use the search engine, so each search is tied to a unique user. Given that payment is involved, each user can be tied to a real-world identity.
- rcMgD2BwE72F 3y ago
  >so each search is tied to a unique user Is it? They say searches aren't tied to account: https://help.kagi.com/kagi/privacy/privacy-protection.html#email-address-collection https://help.kagi.com/kagi/privacy/privacy-protection.html#e...
  - WhyNotHugo 3y ago
    The link says that they do not _log_ the searches tied to accounts, but they do receive enough information to cross reference this data.

mdekkers 3y ago

> They do not take security and privacy seriously Anything specific about the privacy angle?

BOOSTERHIDROGEN 3y ago

Which privacy ?

rcMgD2BwE72F 3y ago

Still far better than all the alternatives, no?

Nullabillity 3y ago
The alternatives don't demand your payment details.
- ulrikrasmussen 3y ago
  You can pay for Kagi using cryptocurrency if you want to pay anonymously. The alternatives demand your data and/or lets you pay an attention fee by showing you ads or irrelevant results.
- digging 3y ago
  Like Google? Whose entire business model is pilfering that data without asking you? And who also asks you constantly to attach a phone number to your account, etc.?
  - Nullabillity 3y ago
    Google works in an incognito window, DDG even works over Tor. Neither is perfect, but it's hard to do worse than "you have to be logged in with an account associated with your payment details".
hackideiomat 3y ago
Don't get me wrong, I do use kagi. but it's not nearly what I wish it'd be.

eitland 3y ago

So which search engine do you recommend that takes privacy seriously and that actually works (i.e. doesn't block me and return correct results) in Norway?

hackideiomat 3y ago
Maybe MetaGer if you can live with their quality
- eitland 3y ago
  That was why I mentioned "return correct results". At the moment I am aware of two search engines available to me that doesn't try to drive me crazy by wasting my time on irrelevant results: - kagi.com - and search.marginalia.nu and the second one, while being honest and high quality, has a rather limited index.
  - marginalia_nu 3y ago
    Marginalia Search's still a bit hit and miss. Haven't really actively been working on the search result quality lately, been too busy with various chores away from the actual search end of the search engine. It's gotten a bit better, but mostly by accident, through fixing bugs that had knock-on effects on quality. A directed effort toward unfucking query understanding and index execution is up next on the list of tasks to tackle though. Hopefully it'll make a decent impact.
    - eitland 3y ago
      Unlike Google you still managed to not pull in a irrelevant pages but instead tell the truth whenever you didn't have any results.