New incognito search engine

[woodsmoke]

A first go-over looks interesting.

woodsmoke

[GreyGeek]

Registrant:
SURFBOARD HOLDING B.V
ATTN STARTPAGE.COM
care of Network Solutions
PO Box 459
Drums, PA. US 18222



Domain Name: STARTPAGE.COM


------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------


Administrative Contact, Technical Contact:
Beens, Robert dc6tb6y42g3@networksolutionsprivateregistration.co m
Surfboard Holding BV
ATTN STARTPAGE.COM
care of Network Solutions
PO Box 459
Drums, PA 18222
US
570-708-8780



Record expires on 10-Oct-2013.
Record created on 11-Oct-1997.
Database last updated on 19-Apr-2012 19:09:29 EDT.


Domain servers in listed order:


NS1.P27.DYNECT.NET
NS2.P27.DYNECT.NET
NS3.P27.DYNECT.NET
NS4.P27.DYNECT.NET


This listing is a Network Solutions Private Registration. Mail
correspondence to this address must be sent via USPS Express Mail(TM) or
USPS Certified Mail(R); all other mail will not be processed. Be sure to
include the registrant's domain name in the address.

Everything I said about other search engines and vpn services still applies. In this case I would be especially suspicious because typical corporate behavior today is to not provide exactly what they promise to provide. In this case "privacy". As long as your packets carry your IP address as the source you can be identified. An anonymizer like TOR will admit that they cannot guarantee your privacy, and have no doubt about it -- EVERY ISP or portal service keeps logs. Period. Otherwise, how could they track your compliance with the TOS?

[Snowhog]

In this regard, 'Freedom' is an illusion.

[bra|10n]

This led search engine Ixquick in 2006 to become the first to delete privacy details like IP-addresses within 48 hours and abolish the use of ID cookies. Ixquick does not share any personal data of its users with third parties.
"This award sends out a very strong message to our users" said Ixquick's CEO Robert Beens. "It is the ultimate proof that we live up to our promises. If people search with Ixquick - they get the best results - and full privacy."

https://www.startpage.com/au/press/eu-privacy-seal.html

[GreyGeek]

https://www.startpage.com/au/press/eu-privacy-seal.html

Then there is this news: https://help.riseup.net/en/seizure-2012-april

xquick does not share any personal data of its users with third parties

is a plain admission that lxquick DOES store personal data of its users. Obviously the IP address is part of the personal information, otherwise they would not know who was really using the service.

Ergo, when a law enforcement officer arrives with a warrant lxquick has two options: hand over the hardware and information, or go to jail. Which course do you think they will follow? Would you go to jail to protect the privacy of some sleezebags who are spamming email boxes to commit fraud and theft, or to slander?

[woodsmoke]

GG
Your comments remind me of Mr. Holmes' comment to Gregory!

woodsmoke

[Ole Juul]

Then there is this news: https://help.riseup.net/en/seizure-2012-april

is a plain admission that lxquick DOES store personal data of its users. Obviously the IP address is part of the personal information, otherwise they would not know who was really using the service.

I can remember when they first talked about that, and it was clear that they did intend to keep some details, but that they were going to shorten the retention time to as little as they thought was reasonable. The above article actually says:

This led search engine Ixquick in 2006 to become the first to delete privacy details like IP-addresses within 48 hours and abolish the use of ID cookies.

I don't know if they could shorten it even more, presumably so, or if it would generally take a "law" enforcement officer longer than 48 hours to respond.

Also, I always get stumped on this IP thing for identification. I don't doubt that an ISP can identify individual users, it's just a matter of how. With several hundred people using the same IP as I am, the mechanism isn't clear to me.

[bra|10n]

I don't know if they could shorten it even more, presumably so, or if it would generally take a "law" enforcement officer longer than 48 hours to respond.

While I'm not concerned with "law" enforcement, I asked the question regarding the exposure time of 48 hours... is it still considered NOT private after the time has elapsed?

[kubicle]

is a plain admission that lxquick DOES store personal data of its users.

Logically, no. If someone says "I don't sell cars", it doesn't logically follow that he/she has cars to sell (he/she might have, or might not).

IP address is probably logged for abuse/DOS attack protection purposes, but if they delete the logs after 48 hours (as they say), it isn't much of a privacy issue. Of course it's ultimately a game of trust, whether you believe they do what they say they do.

But like I said before, anyone is probably more private than google that we know gathers everything, stores it indefinitely and has the power (by the extensive number of services they provide) to combine data imaginatively from different sources.

[Ole Juul]

While I'm not concerned with "law" enforcement, I asked the question regarding the exposure time of 48 hours... is it still considered NOT private after the time has elapsed?

I'm guessing that if they don't have it, then it's not private. In fact it isn't anything. Anyway, what did they say?

[GreyGeek]

.....
Also, I always get stumped on this IP thing for identification. I don't doubt that an ISP can identify individual users, it's just a matter of how. With several hundred people using the same IP as I am, the mechanism isn't clear to me.

All this search engine is PROMISING to do is delete the link between users IDs and their IP addresses. Because of the current situation with ALL legal entities I don't trust any of them. As far as several hundred people using the same IP as you are, they really don't. When an IP packet leaves your router, heading for your ISP's gateway, each packet has your IP address, the one your ISP assigned to you (static or dynamic) beginning at bit offset 96, for 32 bits. Network Address Translation protocols (NAT) can change that IP address in route. In the case of the search engine in question that is not necessary, since they are not acting as a 3rd party intermediary, like an anonymous server is. But, anonymous servers do use NAT to switch the "source IP address" information to another IP address associated with THEIR server. They take your packets, and who knows how many from how many other users, and replace the source IP address info with their IP address. Meanwhile, using higher level info in the packet itself, or TCP./UDP port translation, they keep translation tables which link your real IP address to the returning packets usiing that higher level information. So, in the anonymizing server's RAM, or on their HD, is a table linking some integer value with your real IP address. That integer value was packaged with the outgoing IP packet containing the anonymizer's IP address. To that Anonymizer that Integer value is YOUR IP address.

There are other methods to do this as well.

When IPv6 takes over all they'll do is keep a look up table on their servers with your IP address and the IP address they give your outgoing packets. No TCP/UDP or port translation will be necessary.

[SteveRiley]

When IPv6 takes over all they'll do is keep a look up table on their servers with your IP address and the IP address they give your outgoing packets. No TCP/UDP or port translation will be necessary.

The original design of IPv6 used MAC addresses to generate IP addresses, thus guaranteeing uniqueness and eliminating the need for NAT. Eventually it became apparent that this approach results in a loss of privacy, which RFC 4941 seeks to solve and has been implemented in all modern IPv6 stacks.

(I, uh, would like to call your attention to the authors. I'm not one, but I have been affiliated with the employer of one. )

[GreyGeek]

So, according to all the prognostications, we were supposed to run out of IPv4 addresses sometime last fall. What happened? It seems like VERY FEW sites, or hardware, is ready for IPv6. I know my wifi isn't, nor is my ISP.

[SteveRiley]

IANA handed out the last of its available blocks to regional numbering authorities about a year ago. ARIN, the numbering authority for the Americas, has exhausted its block. APNIC, the authority for Asia, has changed its allocation policies and is restricting what remains. RIPE, the authority for Europe, will likely run out in 2013.

Why aren't we seeing an explosion of IPv6? Pure economics. While IPv6 support is appearing in many products, it's still cheaper to apply that stupid band-aid called NAT. This will, of course, come to bite us all in the ass of complexity soon, because NAT is dumb. Oh, and it appears there's money to be made selling unused IPv4, too.

[Ole Juul]

As far as several hundred people using the same IP as you are, they really don't.

I figured they'd have a way to get back to me, otherwise things could get pretty lonely here. So really, those IP reporting sites that are (in my case) off by a hundred miles (and several IPs) are really just deceiving people by making it look like that's all there is to it.

When an IP packet leaves your router, heading for your ISP's gateway, each packet has your IP address, the one your ISP assigned to you (static or dynamic) beginning at bit offset 96, for 32 bits. Network Address Translation protocols (NAT) can change that IP address in route. In the case of the search engine in question that is not necessary, since they are not acting as a 3rd party intermediary, like an anonymous server is. But, anonymous servers do use NAT to switch the "source IP address" information to another IP address associated with THEIR server. They take your packets, and who knows how many from how many other users, and replace the source IP address info with their IP address. Meanwhile, using higher level info in the packet itself, or TCP./UDP port translation, they keep translation tables which link your real IP address to the returning packets usiing that higher level information. So, in the anonymizing server's RAM, or on their HD, is a table linking some integer value with your real IP address. That integer value was packaged with the outgoing IP packet containing the anonymizer's IP address. To that Anonymizer that Integer value is YOUR IP address.

There are other methods to do this as well.

Thanks for the explanation GG. I realize now that a single IP is not the defining identity it is often made out to be. Of course there have to be other records generated along the way. Now, I too am suspicious about just how much anonymity one can achieve.