The concept of YaCy of decentralized web search seems smart. Does anyone see any flaws in its design that may lead to additional exposures of privacy or security compared to the usual alternatives or there are only advantages?

Wikipedia mentions some disadvantages but if I didn't get it wrong they don't seem directly related to privacy, security or anonymity.

  • Some of us can't browse to that site due to traffic restrictions. Care to edit to include a summary of what they do, and what parts of it you feel are unique / problematic? – Polynomial Nov 1 '12 at 8:48
  • The uniqueness is it being decentralized and peer-to-peer, so at least there seems to be no log of your searches. It looks more private. My question is exactly to find out if there is anything problematic in terms of privacy, security and anonymity that I haven't noticed. – Strapakowsky Nov 1 '12 at 8:56
  • 2
    I would be concerned that if you were participating in the crawling some of your identifying information could up in the index due to some pages which display information related to where the connection came from. Being the one that indexes something like IPChicken would add your IP, hostname, ISP, and DNS information to the index as one of the crawlers. Acting as a proxy rather than a crawler would have similar concerns to being a TOR exit node. You wouldn't have control over where others go with your own IP. – Nathan V Nov 30 '12 at 4:48

I would be concerned with search poisoning (as mentioned in the wiki). If search results are coming from peers, you will not know how valid those searches are. This means that a malicious peer could redirect users to non-valid sites for phishing or browser infection.

| improve this answer | |
  • The protocol would have expected this. Wouldn't the search results be automatically verified by more than several different peer nodes before they are displayed to the user? – Pacerier Feb 16 '15 at 8:45
  • I'm not sure why you're linking bitcoin threads to this. As for your question of "Shouldn't an untested algorithm account for corner cases?" I'm sure it would be nice if it did, but I have no evidence to prove anything either way. The RISK remains that a botnet could poison the search with a million erroneous entries. – schroeder Feb 16 '15 at 18:22
  • Bitcoin's communication (getting a search result) with untrusted peers is also exactly what we are doing here. – Pacerier Feb 17 '15 at 2:58
  • "We"? Are you associated with YaCy? – schroeder Feb 17 '15 at 19:06
  • No, I mean if the clients do verification, a botnet couldn't cause search poisoning unless he controls a large percentage of nodes in the entire decentralized network. – Pacerier Feb 22 '15 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.