DuckDuckGo Searches Are Not Anonymous

Re:DuckDuckGo Searches Are Not Anonymous by apgwoz on Wednesday May 19, 2010 @05:47PM (#1362475)

all the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you could easily write a script to scrape the actual terms...

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by erikpukinskis on Wednesday May 19, 2010 @08:05PM (#1362813)

What if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by epi0Bauqu on Wednesday May 19, 2010 @10:35PM (#1363102)

That embeds the IP in the process and could theoretically be reverse-engineered.

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by apgwoz on Wednesday May 19, 2010 @11:36PM (#1363185)

Are there session ids? I assume that HMAC(secret + sessionID + ip + search terms) would be fine.

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by epi0Bauqu on Thursday May 20, 2010 @10:25AM (#1364072)

No sessions.

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by apgwoz on Thursday May 20, 2010 @11:06PM (#1366251)

I see you do settings through a cookie or URL params. I'm out of ideas unless you hash the cookie + ip for a session ID fir that purpose.

[ Parent | on HN ]

Re:DuckDuckGo Searches Are Not Anonymous by mike-cardwell on Wednesday May 19, 2010 @06:19PM (#1362568)

Yes, you're right. I didn't think of that.

[ Parent | on HN ]