Hot answers tagged

125

I'm the founder of DuckDuckGo. D.W. is right, if we were to violate our privacy policy we could get in a lot of trouble. Additionally, I've tried to be as transparent as possible on how we operate, both in our privacy policy and on my blog. I've thought and explored external verification, from someone like the EFF for instance, but I don't think that really ...


117

There is no proof that DuckDuckGo operates as advertised. (There never is, on the web.) However, that is the wrong question. DuckDuckGo is very clear in its privacy policy. DuckDuckGo says it doesn't track you, it doesn't send your searches to other sites, by default it does not use any cookies, it does not collect personal information, it does not log ...


75

For the purposes of this discussion there are only a couple differences between web signing certificates: Extended vs standard validation (green bar). Number of bits in a certificate request (1024/2048/4096). Certificate chain. It is easier to set up certificates with a shorter trust chain but there are inexpensive certs out there with a direct or ...


63

Tor is better for you than it is for people in countries whose intelligence services run lots of Tor exit nodes and sniff the traffic. However, all you should assume when using Tor is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server. That leaves many, many ...


50

Update 5 The root problem (heh) with the CA model is that in general practice, any CA can issue certs for any domain, so you're vulnerable to the weakest link. As to who you can trust, I doubt that the list is very long at all, since the stakes are high and security is hard. I recommend Christopher Soghoian's post on the subject, which clarifies the ...


29

As Matt Blaze once wrote, CAs protect you from anyone who they are unwilling to take money from. That should tell you something about where the CA's incentives lie, and some potential risks in the arrangement.


29

2013 calling I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project. From the annual report for last year (linked above): However, keep in mind that the US government ...


25

You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet ...


24

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


24

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


23

What D.W. said. But also, You don't have to trust DuckDuckGo. You don't log in, you can clear cookies, you can change your IP address, you can access it via Tor. Not being an appendage of an identity company (e.g., Google) is a big privacy plus to begin with.


23

Good stuff in other answers, let me add some remarks about proper CA behaviour. If the CA has an history of lack of security policy enforcement, of violation of "browser approved CA" agreement, of signing of non DNS names using their official root certificate (like IP addresses, or non existent DNS names f.ex. bosscomputer.private), of lack of ...


23

As Rook pointed out, security theatre is a big part of how consumer perception is exploited to ensure that customers believe that something is safe, without the vendor having to go through all that complicated hassle with actual security. The TSA is a great example, but there are many others: Extended Verification on SSL certificates are largely theatre, ...


19

Specifically for Google, if you use two-factor authentication it is safe to "weaken" your password "from a 16-character password with a search space on the order of 1030 to an 8-character password with a search space on the order of 1014" as long as you use a good 8-character password (i.e. completely random and not re-used across sites). The strength of ...


17

Unfortunately there are no automated scanners to detect all the types of vulnerabilities in modern web applications (I often hear less than 50%). Relying only on automated solutions is fraught with shortcomings. Automated scanners can expose the easy stuff, but you need human intelligence to explore and reveal additional vulnerabilities. With that said, ...


17

It does give you considerably more protection than browsing directly. There are some identified weaknesses which offer potential routes to attack your computer, however these can be mitigated using normal protection on your machine (ie patch/av up to date, run as unprivileged user etc) but the only real weakness in terms of compromising privacy seems to be ...


16

I'm afraid that the short answer to this question is that it's impossible to know, as far as I can see. There are a large number of default CA's installed in most common browsers and assessing how likely they are to be "trustworthy" in terms of giving out certificates to governmental or other organisation is difficult. If a CA became known as untrustworthy ...


15

The official GnuPG documentation regarding this output is rather awkward. The OpenPGP trust model gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model By default, GnuPG uses the OpenPGP trust model. In this, you can put trust on a key, which allows it to validate other keys. Trusted Keys Keys can be trusted. Trust allows keys to validate ...


15

CA does not issue private keys to anybody. CA signs (using its own private key, which is kept very secret) your public key. The CA has no access to your private key at all. If the CA’s private key is leaked to Mallory, Mallory is able to issue valid certificates for any name. That means he can make almost undetectable (well, obviously, you can detect the ...


15

Prove is a strong word, and to be honest, it isn't the word you're looking for. What you really want is trust. You want users (or potential users, in this case) to trust that your software is secure enough for them use to protect their most sensitive data. There are several ways that you can do this. Open source the software. If users have the ...


14

On any Wi-Fi network - encrypted or not, given today's Wi-Fi encryption protocols - any sufficiently skilled and equipped user of the network (and especially the network administrator) could easily access any data you transmit or receive via cleartext protocols. This includes usernames and passwords as well as web pages, documents, and other data sent or ...


14

A weak password + two-factor authentication might still be safer than a strong password alone but it will be less safe than a strong password + two-factor authentication. It all depends on how weak you go: if you go all the way and make the password trivial you effectively end up with one-factor authentication (the Google text message to your phone). But ...


14

Theoretically, X.509 chains are unlimited in length. The Basic Constraints extension can apply a per-chain limit; this is used mostly for CA that agree to issue a sub-CA certificate but want to constraint that sub-CA to issue only end-entity certificates. Implementations may have limitations. In fact, with some carefully crafted certificates, one can make a ...


13

I would assume your reasoning is something like, "If the person constructing the page chose to send some of its images insecurely, then the browser should respect that this decision was done for a reason and allow it without a warning. The page is as secure as the entity providing it wanted it to be." By contrast, the reasoning of the browser developers is ...


13

No. It is not safe to generate passwords online. Don't do it! In theory there are some ways that one could perhaps build a password generator that is not so bad (e.g., run it in Javascript, on your local machine, and so forth). However, in practice, there are too many pitfalls that an average user cannot be expected to detect. Consequently, I do not ...


13

From a technical standpoint, the only thing that matters is browser recognition. And all of the trusted authorities have very nearly 100% coverage. I could say more, but to avoid duplicating effort here's a nearly-identical question with a lot of well-reasoned responses: Are all SSL Certificates equal?


13

Security seals are used on phishing sites, and our tax dollars fund the TSA. Whether we like it or not, "Security Theater" rules us all.


13

There is no technical/specification limit imposed on the length of certificate chains. (However, there are X509v3 attributes which can impose policy-based limits on the length of a certificate chain for a CA; see the pathLenConstraint field of Basic Constraints, RFC 5280, Section 4.2.1.9.) With longer chains, verifying clients need to perform a little more ...


12

I arrive late to this question, but hopefully I can contribute some useful information which will also help others make a more informed decision regarding the trustworthiness of DuckDuckGo. This answer gives a few reasons to believe that DuckDuckGo is putting its privacy policy into practise by investigating the technical aspects of DuckDuckGo as of ...


11

Concrete case of DigiNotar For the concrete case that depends on how deep the vulnerability was: If the attackers were only able to access a program (web frontend) that signs any SSL server certificate, then only those sites are affected. Proper logging mechanisms would allow them to produce a complete list of all affected domains. If they got access to ...



Only top voted, non community-wiki answers of a minimum length are eligible