PRISM vs StartPage (Vanity)

Ixquick/StartPage ^ | recent | Robert E. G. Beens

[imardmd1]

Here's the tantalizer line on the StartPage splash page:

Take a deep breath. You're safe here.

Click *here* to learn how StartPage protects you from government surveillance.

************

Then, clicking on *here* takes you to this:

---------

No PRISM. No Surveillance. No Government Back Doors. You Have our Word on it.C Giant US government Internet spying scandal revealed

The Washington Post and The Guardian have revealed a US government mass Internet surveillance program code-named "PRISM". They report that the NSA and the FBI have been tapping directly into the servers of nine US service providers, including Facebook, Microsoft, Google, Apple, Yahoo, YouTube, AOL and Skype, and began this surveillance program at least seven years ago. (clarifying slides)

These revelations are shaking up an international debate.

No PRISM. No Surveillance. No Government Back Doors. You Have our Word on it.

Giant US government Internet spying scandal revealed

The Washington Post and The Guardian have revealed a US government mass Internet surveillance program code-named "PRISM". They report that the NSA and the FBI have been tapping directly into the servers of nine US service providers, including Facebook, Microsoft, Google, Apple, Yahoo, YouTube, AOL and Skype, and began this surveillance program at least seven years ago. (clarifying slides)

These revelations are shaking up an international debate.

StartPage has always been very outspoken when it comes to protecting people's Privacy and civil liberties. So it won't surprise you that we are a strong opponent of overreaching, unaccountable spy programs like PRISM. In the past, even government surveillance programs that were begun with good intentions have become tools for abuse, for example tracking civil rights and anti-war protesters.

Programs like PRISM undermine our Privacy, disrupt faith in governments, and are a danger to the free Internet.

StartPage and its sister search engine Ixquick have in their 14-year history never provided a single byte of user data to the US government, or any other government or agency. Not under PRISM, nor under any other program in the US, nor under any program anywhere in the world. We are not like Yahoo, Facebook, Google, Apple, Skype, or the other US companies who got caught up in the web of PRISM surveillance.

Here's how we are different:

o StartPage does not store any user data. We make this perfectly clear to everyone, including any governmental agencies. We do not record the IP addresses of our users and we don't use tracking cookies, so there is literally no data about you on our servers to access. Since we don't even know who our customers are, we can't share anything with Big Brother. In fact, we've never gotten even a single request from a governmental authority to supply user data in the fourteen years we've been in business.

o StartPage uses encryption (HTTPS) by default. Encryption prevents snooping. Your searches are encrypted, so others can't "tap" the Internet connection to snoop what you're searching for. This combination of not storing data together with using strong encryption for the connections is key in protecting your Privacy.

o Our company is based in The Netherlands, Europe. US jurisdiction does not apply to us, at least not directly. Any request or demand from ANY government (including the US) to deliver user data, will be thoroughly checked by our lawyers, and we will not comply unless the law which actually applies to us would undeniably require it from us. And even in that hypothetical situation, we refer to our first point; we don't even have any user data to give. We will never cooperate with voluntary spying programs like PRISM.

o StartPage cannot be forced to start spying. Given the strong protection of the Right to Privacy in Europe, European governments cannot just start forcing service providers like us to implement a blanket spying program on their users. And if that ever changed, we would fight this to the end.

Privacy. It's not just our policy, it's our mission.

Sincerely,

Robert E.G. Beens

CEO StartPage.com and Ixquick.com

StartPage has always been very outspoken when it comes to protecting people's Privacy and civil liberties. So it won't surprise you that we are a strong opponent of overreaching, unaccountable spy programs like PRISM. In the past, even government surveillance programs that were begun with good intentions have become tools for abuse, for example tracking civil rights and anti-war protesters.

Programs like PRISM undermine our Privacy, disrupt faith in governments, and are a danger to the free Internet.

StartPage and its sister search engine Ixquick have in their 14-year history never provided a single byte of user data to the US government, or any other government or agency. Not under PRISM, nor under any other program in the US, nor under any program anywhere in the world. We are not like Yahoo, Facebook, Google, Apple, Skype, or the other US companies who got caught up in the web of PRISM surveillance.

Here's how we are different:

o StartPage does not store any user data. We make this perfectly clear to everyone, including any governmental agencies. We do not record the IP addresses of our users and we don't use tracking cookies, so there is literally no data about you on our servers to access. Since we don't even know who our customers are, we can't share anything with Big Brother. In fact, we've never gotten even a single request from a governmental authority to supply user data in the fourteen years we've been in business.

o StartPage uses encryption (HTTPS) by default. Encryption prevents snooping. Your searches are encrypted, so others can't "tap" the Internet connection to snoop what you're searching for. This combination of not storing data together with using strong encryption for the connections is key in protecting your Privacy.

o Our company is based in The Netherlands, Europe. US jurisdiction does not apply to us, at least not directly. Any request or demand from ANY government (including the US) to deliver user data, will be thoroughly checked by our lawyers, and we will not comply unless the law which actually applies to us would undeniably require it from us. And even in that hypothetical situation, we refer to our first point; we don't even have any user data to give. We will never cooperate with voluntary spying programs like PRISM.

o StartPage cannot be forced to start spying. Given the strong protection of the Right to Privacy in Europe, European governments cannot just start forcing service providers like us to implement a blanket spying program on their users. And if that ever changed, we would fight this to the end.

Privacy. It's not just our policy, it's our mission.

Sincerely,

Robert E.G. Beens CEO StartPage.com and Ixquick.com

[cynwoody]

One advantage startpage.com has is its secoure (https) connection, unlike bing and google.

Not true. Google has been using SSL for three years now. And, as I point out in #20, Google's HTTPS is superior to that of StartPage, since at least November 2011.

As for Bing, I see a spiral staircase, but no padlock at all. Doesn't matter, since I rarely use them, except for maps once in a while.

[b4its2late]

So No No On Duck Duck Go!

[imardmd1]

Thank you for your observation and comment. The only thing I have been led to believe is that given in the StartPage/Ixquick summary quoted here.

I personally am not presently capable of approaching this rigorously. I was hoping that the posting of this article would draw forth a more detailed analysis, helping to place the StartPage product offering on a scaled to the needs of the ordinary user.

Again. thanks --

[CodeToad]

So long as you are receiving data over the Internet your data can be recorded. It isn’t the distant end that they track. They track exactly what it coming and going from your connection. Yours. Not the website. Not a proxy server. Yours. Directly.

[imardmd1]

Not the website. Not a proxy server. Yours. Directly.

This must certainly be available to my ISP.

[Darnright]

Just curious - why non-unix/linux? Just as an alternative, or is there something inherently insecure with the 2 mentioned above?

[CodeToad]

“This must certainly be available to my ISP. “

This what? Knowledge? Maybe. Maybe not. Your ISP may be leasing some bandwidth from someone else. Regardless, your Internet connection is directly tapped. You have absolutely NO privacy on the Internet. None. Nada. Zip.

There is positively nothing you can do about that. Not encryption, not proxy servers, nothing. You should be pissed that the government is taking your electronic property without a warrant, affirmed by an affidavit that a crime had been committed and you were the person that did it. They simply take ALL of your electronic transmissions. All. That’s what those massive NSA complexes are about: Storing everything you ever transmit.

[caww]

<....”None. Nada. Zip.....There is positively nothing you can do about that. Not encryption, not proxy servers, nothing.”....>

That is my understanding...if they want info. it’s there to get.

However I have heard that there are certain things which raise their interest...they are ‘more’ apt to check proxy’s, encryption etc. because they figure the bad guys want to hide....also odd names ....you’re better off with simple ordinary names then some weird mixture...or odd name not common.

[caww]

I don’t know...just posted what the guy wrote.
As is see it there really isn’t any way t hide your information....just google your name and you see a hosts of companies willing to find you for a price...and all about you as the price increases.

I don’t think there’s anyway the ordinary citizen can be on line and be private...it’s just not how the internet is.

I figure just use them all...from Crome to google to bing to startpage and any other...don’t just stay with one all the time...just seems sensible but then I have no knowledge of computer security in the first place.

[OneWingedShark]

Just curious - why non-unix/linux? Just as an alternative, or is there something inherently insecure with the 2 mentioned above?

Well, I personally detest the design-philosophy of Unix/linux. IMO, it contributes greatly to many of the security-errors in addition to user-unfriendliness.
To understand the design-philosophy you really have to understand how deeply tied the C language is with Unix. The ties are so deep that if they were any deeper the C-compiler would be the OS, but that sort of situation actually has advantages. (see Oberon, LispMachines, and Forth)

This is actually the core of the philosophy: do things at a bare-minimum acceptable of completeness and correctness.(See the essay: The Rise of Worse is Better) Indeed, many things are left incomplete (punted on) because they are hard as a result of the details. (This is why IMO POSIX is useless: it makes a lot of demands on certain design-requirements... but those requirements are usually to broad to yield anything productive — I have yet to see anyone document it being a useful standard. Hell, Windows has been POSIX Compliant since Win2000, IIRC, and you still hear people complaining that windows isn't POSIX.) Tasking is one example, and the Unix answer Fork() is anemic and unsuited for the job [fork basically creates an entirely new process and copies the entire executable].
Wikipedia entry on fork:

In computing, when a process forks, it creates a copy of itself. Under Unix-like operating systems, this is created with the fork() system call. The original process that calls fork() is the parent process, and the newly created process is the child process. Both processes return from the system call and execute the next instruction.

The fork operation creates a separate address space for the child. The child process has an exact copy of all the memory segments of the parent process, though if copy-on-write semantics are implemented actual physical memory may not be assigned (i.e., both processes may share the same physical memory segments for a while). Both the parent and child processes possess the same code segments, but execute independently of each other.

Note how the copy-on-write, a valid strategy, is used to patch up the misdesign: the copy of the entire process in the first place!

Another thing that's bit the entire world of computing in the ass is C/C++'s notion of arrays: an address and an offset (for the element). Tn languages designed with some deeper thought an array has bounds associated with it. The Buffer Overflow attacks that you hear about as security vulnerabilities would be impossible in Ada-83, Pascal, COBOL (see TABLE data-type), FORTRAN, and so forth.

Once you get out of I just use my computer for email-style usage, Linux systems are incredibly fragile, in my experience. Especially the permission/ownership scheme for files. Heck, the permissions thing regularly bites even very-experienced users in the ass. Installing new software is a crap-shoot on messing up your permission/ownership.

I always feel like the OS is fighting me when I have to do something remotely technical, though sometimes even the mundane. (The command-line shell is particularly bad; the only thing that I'd at all miss in it vs. Win98's command-line: Tab-expansion. That's it. The only useful thing in 30+ years of development and that's it.)

In short, what I find infuriating about Unix/C's design attitude is that it pretends like it's giving to you liberally, doing great things for you, but in reality is a stingy, niggardly.

---

Another design-flaw is the way it handles termination:

int main( int argc, const char* argv[] )
{
	printf( "\nHello World\n\n" );
	return 0;
}

Now, you might be thinking Return code? That's nothing unusual. And indeed it might have been forgiven in back in the early days of computing before exceptions became common, but what is totally irresponsible here is the definitions of the return codes. Other than the 0, nothing is defined (exaggeration, there's EXIT_FAILURE defined in stdlib.h) — this means that all the utilities/programs are speaking different languages, like a computing tower of babel, when the program reports an error.

A much better solution would be to use exceptions to indicate some failure. Many languages nowadays allow you to tag them with a String indicating the error. Though this combined with Ada's packaging-system (assuming a tight OS/Ada coupling) could have something where exceptions are named by the programs (in those packages) and those packages could be used in the scripting/command-line environment -- imaginary Ada-based script:

With Program_Exceptions;
script Example is
begin
  Run( Some_Program );
exception
  when PROGRAM_ERROR => Put_line( "Something went terribly wrong!" );
  when Program_Exceptions.Deposit_Range_Error => Put_Line( "Someone tried to deposit a negative number in your account!" );
end Example;

[Still Thinking]

Part of it is that many of the DDG guys have a strong love of Ayn Rand, Ron/Rand Paul, and Libertarianism. I know that it's possible for somebody to hold fringe political beliefs and also be honest, but those particular beliefs tend to be held by people who oppose customer protections, and I remember that when I'm doing business with them.

Wait, what? It's your belief that libertarians are more likely to want to spy on you than nannystate authoritarians?? Seriously?

[21stCenturion]

...

[CodeToad]

No one knows what department, manager, investigator, analyst, etc. might decide t do and trigger on what factors. As much as it seems a black hole and mechanical it is very human in nature.

According to law, and their own statements, none of which I believe in the slightest, they only target those for which they have warrants. We also know that to be a lie.

[caww]

My belief is clear......there is no safety on line and to think otherwise is nieve.

Who does the spying is as much unknown as known. I say this because there is a host of sub-hackers/computer nerds outside the mainstream, both single and in groups, throughout the world who connect with each other via the Interent.

Any of these can target an individual, company ,whatever at will. ...some will sell their information others will use it to affect events or situations.

BTW...if you re-read the post you will see I was quoting another person making that comment, it was not my own, rather something to consider with the topic of this thread.

[quimby]

Not true. Google has been using SSL for three years now. And, as I point out in #20, Google's HTTPS is superior to that of StartPage,

This is interesting, but who uses googles https? Not the average user who goes to goole.com-

[cynwoody]

who uses googles https? Not the average user who goes to goole.com-

That's an interesting point.

I've never noticed a problem with that. If I go to http://www.google.com/, it redirects to the HTTPS URL. In fact, I just noticed my Firefox homepage is configured as http://www.google.com/, but I always see the padlock when I go there. In fact, I never type https: when visiting Google.

Actually, any site that really needs to be secure, such as a bank or broker, should be redirecting you if you arrive over an unencrypted connection. So, you could ask whether search engines fall into the category of really needing to be secure. I suppose that would tend to depend on what you are searching for ...

Further investigation: It turns out Google's automatic HTTPS redirection occurs because I'm signed into Google. If I sign out, the redirect doesn't happen, and I have to specify HTTPS deliberately if I want an encrypted connection. However, if I'm signed out and I use the Firefox search box, then my connection is still encrypted. This turns out to be a feature Mozilla added to the search box as of Firefox 14.

So, the question, how many of the low-information crowd are signed in or use the Firefox search box?

Encrypted searching turns out to have an impact on e-commerce sites. When a visitor arrives from an unencrypted search engine search, the headers usually include the referrer URL, from which the e-commerce site can mine and tabulate and analyze the keywords on which the visitor was searching. However, referrals from an encrypted site (the search engine) to an unencrypted site (the e-commerce company) do not include the Referer header, thus blacking out an important source of marketing intelligence.

[quimby]

Do you suppose the limitation of referral info is why google.com is unencrypted ?

[cynwoody]

I doubt it. The denial of referral info makes e-commerce outfits even more dependent on the search engines for their marketing intelligence (e.g., Google Analytics).

One estimate last March put the proportion of encrypted searches at 46%.

[txhurl]

Hey cynwood, OT but I was going to ask your opinion on something:

Wouldn’t ‘rumors’ that Snowden was on the Bolivian plane have to start up because he all of a sudden wasn’t in the terminal anymore?

When Austria let Morales refuel, they wanted a search but only got to walk to the back of the plane and turn around, no searching. So we know Snowden COULD have been on the plane. Why Morales apologized for offering asylum today in indecipherable for me....

BUT, Snowden’s either still in the terminal, on ice in Moscow, or anywhere in the world if he did stowaway with Morales.

My current theory is he’s dead and intel needs to explain his absence (stowaway with Morales) or he’s out of the terminal via SOMEBODY’s plane. I mean, there ARE maids in the hotel he’s staying, there is now way intel CAN’T know if he’s there.

What do you think? Thank you, Sir.

[cynwoody]

As far as I know, Snowden's still staying at that hotel located in the "transit area" of Sheremetyevo, technically outside Russian territory, waiting to get travel docs from some friendly country. It's worth noting that Evo Morales took off from Vnukovo Airport, which on the other side of Moscow from Sheremetyevo, about a 34-mile drive down the outer ring road. So, if Snowden was on board, presumably, the FSB would have needed to give him a lift.

In 2006, Zahra Kamalfar and her two kids wound up spending ten months in Sheremetyevo while the Russians decided whether to send them back to Iran or let them continue to Canada. It was not a good time.

Snowden may get better treatment. Yesterday morning, Anna Chapman (remember her?) tweeted a marriage proposal to Snowden. Her daddy was serious KGB and a friend of Putin.

Meanwhile, Evo Morales is pissed off. Nice work, Mr Secretary of State!