News for hackers. Stuff that matters.
Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @09:13AM (#42306213)
I want to use Kagi but the internet has given me such trust issues that creating an account with a service that can log and tie all my search history back to a personal account or credit card is such a high wall for me to mentally overcome but I'm glad Kagi is expanding their offerings. I truly hope they succeed.
Re:Kagi Search API by mossTechnician on Tuesday December 03, 2024 @12:09PM (#42308474)
I'm hesitant too, due to the words of the CEO.

We did not say we maintain anonmity, but privacy, which are two different things. For example. your parents may know everything about you, yet still respect your privacy.

https://www.reddit.com/r/searchengines/comments/m0i869/comme...

Re:Kagi Search API by benhurmarcel on Tuesday December 03, 2024 @02:13PM (#42310033)
This is more recent:

> There is no more incentive to collect, misuse, or otherwise do anything with user data. In fact, for Kagi, user data is a liability. We don’t want it. We have nothing useful to do with it. You have to log in for Kagi and create an account because that’s the nature of a subscription-based business model; you somehow have to tie the payment to an account. But other than that, there is really no incentive for Kagi to ever want to touch your data.

https://blog.1password.com/real-cost-search-engines-intervie...

Re:Kagi Search API by ziddoap on Tuesday December 03, 2024 @03:45PM (#42311159)
I don't think Kagi, at the moment, is doing anything nefarious with the data that they have. But that paragraph you quoted is pure marketing.

>You have to log in for Kagi and create an account because that’s the nature of a subscription-based business model; you somehow have to tie the payment to an account.

If data was really viewed as a liability, they would adopt a data minimization model similar to Mullvad and not tie user accounts and email addresses together at all.

Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @03:52PM (#42311256)
With Mullvad, privacy and anonymization are the goal and with Kagi it is more of a side effect. As such, using email for accounts makes the most sense because it is the default way of doing things and the lowest lift.
Re:Kagi Search API by yurishimo on Tuesday December 03, 2024 @04:15PM (#42311537)
They could offer both. There’s no reason you can’t use some sort of uuid to login to your account. If that uuid was lost, well, tough shit and make a new account I guess?

Then normies can login with email and everyone is happy!

Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @05:15PM (#42312191)
I don't think they verify email so you can do that currently with a fake email. There is nothing stopping you from creating a Kagi account with [email protected] other the possibility of someone actually having that email.
Re:Kagi Search API by ziddoap on Tuesday December 03, 2024 @04:15PM (#42311542)
That's totally fine! But that runs counter to the claim that "[...] data is a liability. We don't want it.".

If they really didn't want it, there are options.

Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @05:34PM (#42312357)
I think the million data breaches with no consequences have shown that email is not a liability.
Re:Kagi Search API by ziddoap on Tuesday December 03, 2024 @05:42PM (#42312453)
"Data breaches don't have consequences" is a new take that I'm not sure how to respond to.

It's not the email alone that is valuable. It is the email paired with your search history that is valuable. If you remove the email, and instead tie to to a uuid, the search history is much less valuable. This is the basics of data minimization.

Which, again, is fine if Kagi doesn't want to do. They just shouldn't pretend that there isn't any other solution other than email, because there is.

Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @05:59PM (#42312608)
> "Data breaches don't have consequences" is a new take that I'm not sure how to respond to.

That is not what I said. Hundreds of data breaches where emails have gotten leaked and there have been no real consequences for the offending company so from a company perspective, email is not data that carries any real liability.

Re:Kagi Search API by ziddoap on Tuesday December 03, 2024 @06:00PM (#42312614)
>email is not data that carries any real liability.

It certainly can be when it is tied to other data. For example, your entire search history.

Re:Kagi Search API by mossTechnician on Tuesday December 03, 2024 @03:20PM (#42310840)
I don't understand their assertion; Kagi has an incentive to collect data... Most companies do. The incentive is money. Kagi would not be the first company to collect data to monetize it later. And Kagi dreams big about all that data:

Instead of being scared to share information with [your search engine], you will chose what data you want it to have and volunteer your data only after knowing its incentives align with yours... The search will be personal and contextual and excitingly so!

https://blog.kagi.com/age-pagerank-over

Re:Kagi Search API by thesuitonym on Tuesday December 03, 2024 @09:47AM (#42306608)
The way I got over it is knowing that even without an account, regular search providers are able to profile me and tie all my search history back to me anyway. And yes, even if I turn off cookies (but who does that anyway?) and block most advertising and tracking servers at the DNS.

And before anyone says it, I know I can use tor and VPNs and every other privacy tool out there to become more anonymous, but that makes doing normal www things more difficult than it needs to be.

Re:Kagi Search API by sillyfluke on Tuesday December 03, 2024 @07:14PM (#42313203)
The way I got over eating 15 cinnabons every morning was by going to the city zoo and listening to a zoologist explain that they don't give fruit to animals in the zoo because the animals just end up getting diabetes. I figured if regular fruit from the grocery store is already that fucked, cutting 15 cinnabons out of the equation is not gonna save me.

/s

There's a simpler argument to use instead of trying to bend over backwards justifying this thing you really want to do but deep down know that it's bad for you. In fact, it's already become mainstream lingo. It's called You Only Live Once!

Those are the only four words you have to utter and everyone who was about to start arguing with you will back way instantly and you'll save yourself these strained self-serving justifications. The beauty is there is no counter argument to such pristine nihilistic capitulation.

Once Kagi, a startup, breaks the precedent with this credit card requirement crap and actually starts getting significant marketshare everyone else will say, "these guys just normalized requiring a credit card upfront for this type of service. That's great, we can now open another front in the enshittification of the internet and tie highly revealing information to real people more directly." And yes, some of these people will undoubtedly be less savory types and of more questionable moral character than the Kagi crew. And I dare say in all likelihood, so will the late stage Kagi crew as well.

On the other hand, if you do a little good faith research you'll find some email and vpn providers do allow you to send cash (gasp) via postal service to activate your account. It doesn't matter if only one customer uses that option. It is the existence of that option that creates trust.

Unless there is such an option or something nearly identical in ease and function, all these aspirational cross-my-heart-hope-to-die assurances are just ridiculous.

Re:Kagi Search API by solardev on Tuesday December 03, 2024 @09:56AM (#42306739)
You can sign up with a burner email and pay with Bitcoin. Does that help? https://blog.kagi.com/accepting-paypal-bitcoin
Re:Kagi Search API by smithcoin on Tuesday December 03, 2024 @09:58AM (#42306773)
But then the bitcoin could be traced back to Coinbase, where they probably used their bank information to buy it.
Re:Kagi Search API by solardev on Tuesday December 03, 2024 @10:00AM (#42306798)
Yeah, it's not meant for absolute security, just additional obscurity.
Re:Kagi Search API by parkaboy on Tuesday December 03, 2024 @10:12AM (#42306936)
I wish they supported Monero!
Re:Kagi Search API by pbronez on Tuesday December 03, 2024 @10:31AM (#42307192)
The most effective way to advocate for Monero support is probably to contact OpenNode[1], Kagi's cryptocurrency payment processor. You can also chime in on Kagi's Feedback site [2]. Their founder specifically addressed Monero there [3]

""" Just to acknowledge that Kagi already implements with OpenNode to accept crypto payments so this is specifically about Monero.

> I understand the technical issues with implementing Monero, but given the number of users that will be attracted to Kagi specifically because if its privacy, it seems quite inconsistent to only offer non-anonymised payment formats.

We heard the same argument before implementing crypto, and the reality is it attracted very small number of users (less than 0.3% Kagi users pay with crypto). Since this was extremely hard to implement, and there are already ways to convert Monero to Bitcoin so there is path to payment, and based on our previous experience we expect the impact of implementing Monero directly to be minimal, we have decided to focus our very limited resources elsewhere (eg. make search better). Thanks for understanding. """

[0] https://kagi.com/privacy

[1] https://opennode.com/contact/

[2] https://kagifeedback.org/d/493-enable-anonymous-payments-ala...

[3] https://kagifeedback.org/d/493-enable-anonymous-payments-ala...

Re:Kagi Search API by garrtt on Tuesday December 03, 2024 @09:41AM (#42306546)
This is the same reason I still haven't become a paying customer. If Kagi had a similar account creation / payment processing setup as Mullvad VPN I would be all in.
Re:Kagi Search API by do_not_redeem on Tuesday December 03, 2024 @09:53AM (#42306705)
You can pay with bitcoin if you want. Bitcoin is not fully anonymous (but for that matter, neither is cash-in-the-mail since TLAs store photos of the outside of envelopes, but I digress). Kagi itself doesn't have the data needed to de-anonymize the transaction, so it's as anonymous as you can reasonably expect.
Re:Kagi Search API by diggan on Tuesday December 03, 2024 @10:32AM (#42307206)
> Bitcoin is not fully anonymous

Bitcoin is not anonymous at all, a public ledger is the opposite of anonymous if anything. At best it's pseudonymous.

I think parent used Mullvad as an example as they actually support creation of accounts 100% anonymously, as you can literally mail them an envelope with cash.

Re:Kagi Search API by mmh0000 on Tuesday December 03, 2024 @12:19PM (#42308591)
> Bitcoin is not anonymous at all

Well, acktshually…

BTC can be anonymous through careful wallet management combined with methods such as CoinJoins[1].

[1] https://en.bitcoin.it/wiki/CoinJoin

Re:Kagi Search API by freehorse on Tuesday December 03, 2024 @10:37AM (#42307278)
I cannot find where now, but pretty sure I read recently somewhere that they are working in a kind of anonymous token that can be used to not link the searches with one's account. But I cannot seem to find details, but it would be indeed cool if that happened and it would make some things much easier.
Re:Kagi Search API by jazzyjackson on Tuesday December 03, 2024 @12:17PM (#42308559)
Sounds like Cloudflare Privacy Pass, invented in part to allow Tor users to move around without being stuck in captcha hell [0], I heard about them from someone who wanted to sell anonymous access to a service by handing out these tokens that can be redeemed but not tied back to the point of distribution, but I've never actually seen it implemented this way.

  In short, the extension receives blindly signed ‘passes’ for each authentication and these passes can be used to bypass future challenge solutions using an anonymous redemption procedure. For example, Privacy Pass is supported by Cloudflare to enable users to redeem passes instead of having to solve CAPTCHAs to visit Cloudflare-protected websites.
[0] https://privacypass.github.io/
Re:Kagi Search API by contagiousflow on Tuesday December 03, 2024 @09:21AM (#42306298)
Can I ask what search engine you use then?
Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @09:22AM (#42306313)
Most of them. Duckduckgo, Startpage, Google, Mojeek, a few others. Depends on what I need at the time.
Re:Kagi Search API by bayindirh on Tuesday December 03, 2024 @09:36AM (#42306470)
Kagi doesn't store your search history currently.
Re:Kagi Search API by guappa on Tuesday December 03, 2024 @09:37AM (#42306479)
They say they don't, we can't know if it's true or not.
Re:Kagi Search API by bayindirh on Tuesday December 03, 2024 @09:40AM (#42306530)
You're right, but you can't be sure of anything in a greater sense.

The only thing we can do is vote with our wallet if we see that they have lied all the way.

This will only lead us to Russel's teapot [0].

BTW, their current privacy policy is at [1].

[0]: https://en.wikipedia.org/wiki/Russell%27s_teapot

[1]: https://kagi.com/privacy

Re:Kagi Search API by guappa on Tuesday December 03, 2024 @10:31AM (#42307193)
Voting with our wallet doesn't work, because we can't know if they lie or not.
Re:Kagi Search API by hgomersall on Tuesday December 03, 2024 @09:49AM (#42306640)
Have they made a Ulysses Pact to enforce their position?
Re:Kagi Search API by hiddencost on Tuesday December 03, 2024 @09:42AM (#42306564)
We could of course also enact a robust regulatory state with the ability to audit and enforce these things, but we've decided against that it seems.
Re:Kagi Search API by bayindirh on Tuesday December 03, 2024 @09:44AM (#42306588)
I don't know where you're from, but on this side of the pond we have GPDR.
Re:Kagi Search API by echoangle on Tuesday December 03, 2024 @10:17AM (#42307011)
How is GDPR enforced though? With enough disregard for the law, the service provider can just lie about the data they have. I don’t know of a mechanism where you can actually force an audit to confirm that. You can basically ask the provider for all the data they have about you, but you can’t find out if they’re lying.
Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @09:49AM (#42306638)
In the US, we don't.
Re:Kagi Search API by 1oooqooq on Tuesday December 03, 2024 @09:54AM (#42306711)
the teapot analogy actually falls on kagi to provide proof.

and i doubt mean a non biding privacy policy. heck metabook and google both always had one saying the same thing

Re:Kagi Search API by bayindirh on Tuesday December 03, 2024 @10:04AM (#42306843)
Google was showing my search history since forever, and they never claimed to not storing it?
Re:Kagi Search API by 1oooqooq on Thursday December 05, 2024 @04:16AM (#42326412)
what google have to do with this?
Re:Kagi Search API by nicce on Tuesday December 03, 2024 @10:00AM (#42306802)
Everything is based on trust. How do you know that your phone is not sending your browser history once per month at random time at night, along with random legitimate-looking service?
Re:Kagi Search API by guappa on Tuesday December 03, 2024 @10:32AM (#42307212)
My phone's software is open source, kagi (and the others) aren't.
Re:Kagi Search API by aniviacat on Tuesday December 03, 2024 @10:04AM (#42306839)
By running an open source OS for which I can confirm the contents of all outgoing connections.
Re:Kagi Search API by nicce on Tuesday December 03, 2024 @10:10AM (#42306907)
You can hope, but even then processor microcode is likely closed source.

And you cannot really confirm the above use case very well. What if it is so sophisticated that it knows when it is being monitored, or it is so random or well hidden, that it might take years to spot.

Re:Kagi Search API by mldbk on Tuesday December 03, 2024 @10:13AM (#42306960)
What is that? Even your custom android build will have some binary blobs for your SoC.

We are just doomed.

Re:Kagi Search API by toss1 on Tuesday December 03, 2024 @09:55AM (#42306723)
"currently" is doing some heavy lifting there (right proper to state it that way).

Is there an enforceable claim that Kagi will never store such info?

The making an account for searching linked to govt-verifiable payment and ID data, however ephemerally, is also a high bar for me (and for women in the US with the incoming administration's focus on over-regulating pregnancy outcomes, holy fork NO)

Re:Kagi Search API by solardev on Tuesday December 03, 2024 @09:59AM (#42306777)
You can pay with crypto, if that helps.

If the government really wanted to, they can just get SSL private keys from CAs and decrypt all the traffic no matter who you search with, anyway. It's probably only a matter of time...

[dead]
Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @09:27AM (#42306372)
I don't use or trust Kagi but based on what I know about them from my research, this isn't true and sounds like thinly veiled racism because the founder is Russian.

Edit: I was corrected. The founder is Serbian. My apologies.

Re:Kagi Search API by axegon_ on Tuesday December 03, 2024 @09:43AM (#42306577)
> thinly veiled racism because the founder is Russian

thanks for the laugh. As far as yandex goes, you are on the right track though: my grandad used to say, "If a russian ever says good morning to you, you have learned two things: it's not good and it's not morning". For the record, the founder is Serbian, As for the claim, sure, they aren't really hiding it: https://kagi.com/changelog#5340

Re:Kagi Search API by widowlark on Tuesday December 03, 2024 @10:08AM (#42306887)
so you're saying because they integrate other services to improve their search, that makes them an 'alternative UI' for that integration?

Fascinating perspective, thanks!

Re:Kagi Search API by tome on Tuesday December 03, 2024 @09:42AM (#42306568)
The founder isn't Russian: https://vladimir.prelovac.com/
Re:Kagi Search API by BadHumans on Tuesday December 03, 2024 @09:44AM (#42306595)
That's my fault. Thanks for the correction. I edited my post.
Re:Kagi Search API by kylecazar on Tuesday December 03, 2024 @09:43AM (#42306575)
I don't have an opinion either way, but they were perhaps referring to the announcement that they are integrating yandex as a source for images. I didn't follow it all closely, but there was some controversy about it.
Re:Kagi Search API by dooglius on Tuesday December 03, 2024 @09:56AM (#42306744)
Even if that were true, it wouldn't mean that Yandex would have the ability to tie queries to accounts.
Re:Kagi Search API by widowlark on Tuesday December 03, 2024 @09:26AM (#42306358)
citation needed?
Re:Kagi Search API by oidar on Tuesday December 03, 2024 @09:34AM (#42306446)
Do you have any evidence of this?
Re:Kagi Search API by bayindirh on Tuesday December 03, 2024 @09:36AM (#42306478)
This is just wrong. Kagi has its own index and uses many other indexes to augment theirs if theirs do not provide enough coverage for a search.
Re:Kagi Search API by jnsaff2 on Tuesday December 03, 2024 @09:34AM (#42306449)
> "In their most recent blog post, Kagi announced the integration of Yandex for image search—a company based in Russia. During a discussion, Vlad (Kagi’s founder) stated, “We do not discriminate based on current geopolitical issues.”

EDIT: this is what I found during a search. I did not claim they are fully backed by yandex.

Re:Kagi Search API by simonw on Tuesday December 03, 2024 @09:36AM (#42306477)
That's not the same thing as being "an alternative UI for Yandex" - that's a partnership for one subset of the overall functionality.
Re:Kagi Search API by jnsaff2 on Tuesday December 03, 2024 @04:38PM (#42311821)
More context https://kagifeedback.org/d/5445-reconsider-yandex-integratio...

Apparently they have been using yandex for 5 years as one of the search backends.

Re:Kagi Search API by bradgessler on Wednesday December 04, 2024 @11:54PM (#42325094)
Kagi would benefit from offering the same account provisioning as Mullvad VPN. Generate a random number, collect payment for it with cash, crypto, or credit card, and leave it at that.