> “By not storing any useful information, DuckDuckGo simply isn’t useful to these surveillance programs,” says Weinberg. “We literally do not store personally identifiable user data, so if the NSA were to get a hold of all our data, it would not be useful to them since it is all truly anonymous.”
DDG is "unfairly singled out" for good reason, namely that company representatives made an incorrect assertion. DDG is still useful for ongoing surveillance, as the article pondered:
> But what if DuckDuckGo provided a splitter-feed to the NSA? DuckDuckGo can claim without lying that they store no personal information, but that speaks nothing of a collaborating partner storing it.
Obviously, DDG isn't perfect. I'm not naive. But for me there's some value in trying not to succumb to Google's desire to have us all assimilate.
This is ridiculous. It makes no sense why the NSA or any other members of the US Intelligence Community would cause this sort of reputational damage and nationwide outrage to a company when they could simply walk up to them with one of those fancy national security letters with a built in gag order and take the information with much less of a fuss.
Other than that, I agree. Google should buy me a god damn drink if they really want to get to know me. :)
In the context of the history of the CIA and NSA it's standard procedure. And that's just the stuff we know about. Certainly Snowden taught us anything is possible, that they have no restraint.
B
On the other hand, politely asking an outfit like Equifax for (just about) ALL their data with no real reason would be out of character. Why bother? Why go on record?
It's pretty simple. Why would they get via hack? Answer: Because they can.
Snowden, a man who worked from home in Hawaii as an NSA contractor making over $200k a year with his smoking hot girlfriend, who suddenly decided he had a moral compass, was able to download tons of classified files over VPN to his laptops and run off to meet Greenwald et. al. to divulge all this information, then flee to Russia where he sends out anti-Russian tweets.
Meanwhile, nothing has happened. The NSA is still spying. PRISM seems to be something everyone has forgotten about (did it even exist? Most companies denied it). His evidence were all rededicated power point slides.
Question the narratives that are given to you.
If so, poor security contractors (and their apparently less appealing girlfriends) with our cynical assumptions.
Certainly Equifax has other data. Maybe they didn't get what they wanted? Maybe Equifax isn't being transparent? Maybe they don't know?
What do you think the NSA is doing with all that computing (and storage) power? Processing cat photos? :)
I'm not saying i think that's what happened. I'm saying there's a part of me that has good reason it it's possible it could be that. Crazy? Not more than some of things we know the intelligence community has done or tried to do.
We're being tracked. One click/visit at a time.
Not to mention they don't need to provide anything themselves. Unless DDG has their own cables to users homes, after DDG connect to the internet backbone and before the user connects to DDG, the various agencies have all kinds of opportunities to get their feeds. It surely isn't SSL that will prevent them.
3g2upl4pq6kufc4m.onion
If DDG isn't any better than maybe nobody is, so we might as well get used to the lack of privacy. Why switch if you're just going to get worse results, expend more energy, and not actually get increased privacy? You might just as well give up the struggle...
Fortunately, I'm not a conspiracy theorist,
Of course there are nutty conspiracy theories but there are nutty math and physics papers too. I feel like the blanket ridicule of any notion of conspiratorial action is meant to discourage any form of investigative journalism or deeper probing below the surface of the narrative.
Your hypothesis is reasonable and plausible.
If I were in a position of power, and I knew that DDG was more difficult to get user data from, then I'd absolutely find a way to have articles published like this. I imagine that disenfranchised people are less likely to seek alternatives and are more likely to resign themselves to being monitored. It also seems like it would be more politically acceptable as well as offering a layer for plausible deniability.
Were I in charge, and a nefarious actor, I'd be slipping stories like this into the media quite frequently. It's low cost, low risk, and probably has a good chance at success with at least some percentage of the population.
I'm not sure I have the lack of ethics required to really do such a job. I'd like to hope that I'd resign before I helped do those sorts of things.
Since this article I have, which was in the making for some time already, switched from Chrome to Firefox with duckduckgo as my main search engine. Added Disconnect and Ublock origin as well. And yes I realize it doesn't help against NSA tracking of a certian magnitude.
https://www.schneier.com/blog/archives/2013/06/the_psycholog...
I meant to turn that into a standalone essay, too, but forgot about it. Thanks for the reminder.
I checked various dictionaries available online and all of them have a common definition like "a secret plan by a group to do something unlawful or harmful."
It's true, however, that they don't want to share it. It may even be true that they specifically don't want the NSA etc to steal it from them. And indeed, I recall an unofficial Google response to Snowden's leaks:
> Fuck these guys.
> I've spent the last ten years of my life trying to keep Google's users safe and secure from the many diverse threats Google faces… But after spending all that time helping in my tiny way to protect Google -- one of the greatest things to arise from the internet -- seeing this, well, it's just a little like coming home from War with Sauron, destroying the One Ring, only to discover the NSA is on the front porch of the Shire chopping down the Party Tree and outsourcing all the hobbit farmers with half-orcs and whips.
https://www.theverge.com/2013/11/6/5072924/google-engineers-...
So anyway, DDG arguably gives users some privacy from Google. But neither has a better claim to providing privacy from the NSA etc. Indeed, maybe it's Google that does, given their greater resources.
If you want more than that, use some mix of VPNs and Tor. Or if you're not feeling lucky, stay off the Internet ;)
According to the State of California Department of Justice [0], the last publicly acknowledged data breach from Google was March 9th, 2017. Before that it was August 10th, 2016, and before that March 29th, 2016.
Here's a quote from one of them:
"We recently learned that certain hotel reservations made for Google business travel were among the many reservations affected by a security incident impacting a third-party provider’s electronic reservation system that serves thousands of travel agencies and hotels. This did not affect Google’s systems. However, this incident impacted one of the travel providers used by Googlers, Carlson Wagonlit Travel (CWT)."
Many users are paranoid about ToS and how companies (esp the big guys) make money either by learning your behaviors (search preference, sites you visited) or selling your data to a partner (Foursquare, although they claim to only sell location data which are anonymous). We have a blind-trust with service providers. We let service providers to collect everything about ourselves, but internally they can decide whether to discard "sensitive data" early on or not during data processing (but web logs would have the trace).
Has anyone every inspect the traffic, or reverse the API in <your wearable device> (e.g. Fitbit?) What about file sharing companies? Are they storing your data in a secure way and without reading what's in your file? What about sites that let you compare prices across multiple stores? What about medtech startups? What about when the company is acquired?
Because the giants are more eye-catching, we don't see the smaller guys; but we are willing to give away sensitive and private data to the smaller guys because? If the argument is "well the big guys should have known better and have more resources to do the right thing", then I argue that by 2017 the new startups are doing the right things (not making the same well-known security flaws for example). I have doubt; I doubt many achieve 50% of what is on the imaginary checklist. The claim "we build MVP" is the equivalent of the big guys saying "we know what we are doing, don't worry."
No, we don't know better. No, your MVP should be secure enough so users can trust you. I almost never try a newly launched service because I really don't want to be a lab rat. I am sorry if that sounds cynical, but I don't trust myself doing everything right. If you let me choose between a new file sharing startup vs others, I'd go with either Dropbox, Google Drive or OneDrive (FWIW, Google is replacing Drive with a new service). Why? Because if the big guy is compromised, well, shit, thousands or millions will be affected. The least cynical version is, well, they are too big to do stupid things (of course not true in reality).
Our biases create illusions.
I think it is less about who you should trust to do the right thing and more of how much you trust an individual group to be able and willing to maintain the security of the data they have.
That is to say: it is more about the ratio of <stored data>/<security of stored data> rather than either of those values.
Google stores more data than I personally trust anybody to be able to store. Largely because they make themselves a huge target.
Equifax is a great example of storing WAY too much data. Sure, their practices are to blame, but I'd argue that them storing half the information they do is better than doubling their security (whatever that means). This is due to the compounding effect of being a smaller target.
DDG at least claims to not store as much of that information.
> When was the last time Google leaked your data.
If Google has one major leak, does the historical quantity of leaks matter?
EDIT: more thoughts.
That Google has your search or email data and that they can always sell it, or that the NSA has a direct link to them, those are separate discussions.
I don't care about "NSA has decided to invest $10 million to make me personally miserable." At that point, they will simply fabricate the evidence they need.
If someone at the NSA wants to come after me, I simply want someone to actually have to sign a piece of paper--cut a check, file a warrant, send a human being, etc.--rather than just write a script in Python.
If someone in a bureaucracy has to sign their name and take responsibility, I'm fairly safe. Simply the possibility that something might cause political fallout will stop 99.9% of all such actions.
If your threat model includes actors within the US Federal Government (especially the intelligence community), run. Yesterday. That's a statement about our times, not about any particular company.
The solution ought to be browbeating the US Government for unethical practices, not browbeating a company that does privacy better than most, and not as well as would be necessary to stand toe-to-toe with some of the most powerful and far reaching organizations in the world.