Here’s my review of Uruky, a subscription-based private search engine. I hope it’s useful!
5 Likes
and that customers will be given the source code of Uruky after subscribing for 12 months.
That’s something.
4 Likes
this source code is useless in the privacy context since there is no mechanism to prove there isn’t some logging intermediary or altered software
using tor browser and slapping that new identity button each context you need to search for with a traditional engine is free
3 Likes
This attitude is a breath of fresh air compared to defensive attitudes I’ve experienced in my communications with some other privacy tool developers.
I’d recommend removing this. It distracts from the article.
GrapheneOS is not a paid product. I agree that Micay should significantly improve his communication style, but if technical capability and friendliness are on a spectrum, I will continue using GrapheneOS and won’t try out this European search product that doesn’t accept private payments.
Why continue your feud by taking subtle jabs in unrelated articles?
2 Likes
Blog articles are just opinions, it can be argued that the intended audience is looking exactly for theme connections across privacy and/or security spaces.
6 Likes
Plus you can use e.g. DDG onion service which ensures the search engine doesn’t log even the exit node IP. All connections appear to originate from localhost. This article did not even mention the need to anonymize your searches from your end. It did not discuss Tor or onion services at all so I’m going to assume they do not support it.
99% of user’s won’t pay by mail-in-cash, which means their payment details are tied to the account.
And even if you pay by mail-in-cash, all your searches are tied to one another via your account which allows the company to build a shadow profile that can over time learn enough about you to deanonymize you.
The article reads like a grass roots marketing ad for the service.
6 Likes
I’m a bit sad to read so much negative sentiments here, even though you’re all entitled to your opinions. While The Privacy Dad and I have since deepened our relationship, talking about more than just technology and privacy, I have never asked The Privacy Dad to write anything or change what he’s written. He seems to be following the same pattern he’s followed with other technologies, where he’d write about trying it out, and then a few months later what the “current verdict” was. It’s strange you don’t seem to acknowledge that.
You’re right that you can use free search engines and achieve the level of privacy your threat model requires. You’re also right that we still don’t offer XMR / crypto payments (we’re still in talks with ProxyStore for that and should be providing that option soon). You’re right that you can never prove that the source code we give you is the one running in the server. You’re not right we don’t offer fully private options and methodologies. We have had cash-in-mail payments, and have more than 2000 private searches running per day (the only way we can tell is because of the money we have to give providers for those).
I don’t agree it’s not worth doing those things, still, or that there’s no value in offering a service that aligns incentives and provides much more freedom of choice and control (with all the personalization options you have, and the source code becoming AGPLv3 after 2 years, allowing even competition).
Anyway, I’m not trying to convince you, simply leaving some more information and context for others arriving at this post.
Thanks.
8 Likes
It’s as simple as offering Tor onion service for making maximally anonymous searches without login, and making it so that Tor browser will advertise your onion service
URL when connecting to the clearnet site.
Do that and recommend users to take those steps to enforce privacy on their end, and I have zero issues recommending your engine. Surely you understand how important this is? You addressed my critique indirectly while skating around the onion service stuff. Why is that?
If you’re not doing that, how do you expect to compete with DDG or startpage or PriEco or whatever?
1 Like
Sorry, I didn’t realize you were asking me about offering the Tor onion service. The fact you’re implying I “skated around it” is the kind of negative sentiment I don’t want to engage in, but I’ll give you the benefit of the doubt, here: Since you can’t use Uruky without an account (which has no personal information and is just a random number, like Mullvad), I don’t see how using Tor is beneficial (I also haven’t checked if Hetzner would allow it)? What would be the benefit there in that case?
We’re not planning to compete with DDG or StartPage or PriEco (a search provider option we provide, BTW). All of those are free and ad-supported. At most, we’d be competing with Kagi, though I also think of them as a different product, because they’re offering complementary products and services that we don’t want to do.
5 Likes
It wouldn’t outside circumventing censorship. If you’re requiring sign in for search then you can on technical level you can tie searches together. That’s something you need to make sure the userbase knows. That all they have ensure that doesn’t happen is your word. You could add something to this with remote attestation but I doubt people would like an app for doing web searches.
I just don’t see how you’re going to make this private. You have access to user IP by default so it’s not really anonymous even if user mails in cash.
So here’s some constructive feedback: all you’re doing is fine if you address all of this in your threat model that you ensure users have easy access to. Just make sure they know exactly the tradeoffs they make here. If you don’t think it looks good when presented in clear terms, then that’s a good indication there’s something to improve. If you feel it’s only presentable as legalese or fine print or not at all, then it might get binned as snake oil.
I’m not against you, I knew exactly nothing about you an hour ago. I’m just vehemently pro users 
3 Likes
Thanks for clarifying. The source code access is a way to help mitigate that (and you can use the service with VPNs to mask the IP), but even with Tor, you can’t be certain you’re not hopping through compromised nodes logging your traffic (mostly the exit node), right? Or am I missing something? Obviously you should be able to more easily trust a big entity than a smaller one, that’s not what I’m getting at, just the technical aspect.
2 Likes
In any case, I’ll make sure to write a dedicated article/entry in /docs to explain that and give people alternatives, thanks. So you’d recommend a free (no account needed) engine like Ecosia/Qwant/Mojeek/PriEco/DDG used with the Tor browser to protect against the IP leak and grouping of queries for a person/device? Not a VPN as a faster alternative to Tor?
1 Like
Well yes and no. This isn’t an app that the user can study to verify what it does, compile to verify the binary they run does what they studied, and that runs on their device that you have no control over.
Uruky is a service where the source code at most tells the user what you claim to be running. By default they can’t verify what’s happening in the backend. I mentioned remote attestation which is mostly available as Intel’s proprietary technology where the client can verify the code running inside the enclave because the CPU signs it with embedded key. That can be done but AFAIK browsers don’t natively support verifying such enclaves and web apps would be susceptible to tampering. Thus going this extra mile would require a native app.
Yeah user will have to be smart about using VPNs and Tor, they bear some of the responsibility. But a good service not obstruct it (like Google does with it’s never ending captcha wall), but recommend and support it (like DDG/Startpage do). Malicious exit nodes are mainly dealt with TLS-certificates. Tor handles rest when the two first nodes of the proxy chain hide user’s identity and IP. If the exit node can learn anything more than the IP of the middle node, it falls to you. Offering an Onion Service means there is no exit node. With Onion Services, your server will choose some Tor nodes (1 or more depending on performance setting) and form a longer, 4-5 node long chain where traffic never exits the Tor network.
So here’s the ideal user experience on Tor Browser.
When navigating to the website with Tor Browser, it should show the .onion available message. Then clicking that should redirect to the onion service.
The feature is called Onion-Location, here’s the official instructions for to how to add it.
(Note: The image above is a partial mockup, these guys seem to have uptime issues with their Onion Service for change.)
For anonymity, it should indeed not require signing in to an account. Otherwise the data linkability will allow shadow profiles.
I get that free service won’t be cheap, but clearly marked ads based on search term alone (anyone making the search gets the same ads) are IMO fine.
The VPN is a can of worms I don’t have the energy to analyze in depth. Users will have to research those and decide if the VPN provider is a better ISP than their own. It has so many “it depends” variables I’d rather not go there. But IMO it’s not something you have to necessarily recommend. Supporting Tor in a safe way for those who need it, and making it easy with Onion-Location and maybe some instruction “To maximize the privacy of your searches we recommend you visit our Onion Service”. That’s enough and puts you straight to the A+ tier in my eyes.
5 Likes
Thank you so much for all these details. I’ll investigate more deeply providing an Onion Service and Onion-Location.
7 Likes
This was covered a bit in another thread but Privacy Pass would enable you to authenticate as a paid user without tying your searches to an account or static identifier. There’s currently a proposal for a browser feature called Private Access Control Tokens that would allow support for this built into browsers. Not available yet but something to watch in the future.
3 Likes
Yes, that was mentioned in the past. Since our accounts are just random numbers and don’t have any personal info, there’s no big added benefit to using Privacy Pass (unlike with services like Kagi, where there is an email), though we’ll still consider implementing it once the browser built-in support becomes available.
2 Likes
There is a big add because the number is the same over time. Famously, when AOL released search logs with “anonymous” user IDs, individual users were able to be identified in real life just from their searches despite the searches not being tied directly to their real info.
This is why tying your activity to a static identifier is a problem. A proper Privacy Pass implementation would ensure that you couldn’t tie any individual search back to any account identifiers or payment info.
7 Likes
Although I tend to look for DDG and Kagi according to my needs, I wish Uruky a success.
Uruky and I have the same concerns that Kagi is going too far so they are building an ecosystem for people to shift the trust (one monopoly to another), which is not the way to fix the so-called broken web.
That’s what I am facing when using privacy-oriented apps. Most developers have very high ethical standards by attacking other competitors in the same category. They may be better than Google but their apps can’t address normal people’s basic needs and even discourage them from using.
2 Likes
Gotcha. To be clear, since Uruky doesn’t have a subscription, you can buy multiple vouchers and easily rotate through account numbers without anyone knowing anything, but I also understand that’s not something you can verify it’s true, and it’s harder to do than just having Privacy Pass implemented seamlessly.
7 Likes
Which indexes does Uruky use?
1 Like