{"action":"created","issue":{"url":"https://api.github.com/repos/nylira/prism-break/issues/1470","labels_url":"https://api.github.com/repos/nylira/prism-break/issues/1470/labels{/name}","comments_url":"https://api.github.com/repos/nylira/prism-break/issues/1470/comments","events_url":"https://api.github.com/repos/nylira/prism-break/issues/1470/events","html_url":"https://github.com/nylira/prism-break/issues/1470","id":123984068,"number":1470,"title":"Unbubble.eu complaint","user":{"login":"IDKwhattoputhere","id":16030872,"avatar_url":"https://avatars.githubusercontent.com/u/16030872?v=3","gravatar_id":"","url":"https://api.github.com/users/IDKwhattoputhere","html_url":"https://github.com/IDKwhattoputhere","followers_url":"https://api.github.com/users/IDKwhattoputhere/followers","following_url":"https://api.github.com/users/IDKwhattoputhere/following{/other_user}","gists_url":"https://api.github.com/users/IDKwhattoputhere/gists{/gist_id}","starred_url":"https://api.github.com/users/IDKwhattoputhere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IDKwhattoputhere/subscriptions","organizations_url":"https://api.github.com/users/IDKwhattoputhere/orgs","repos_url":"https://api.github.com/users/IDKwhattoputhere/repos","events_url":"https://api.github.com/users/IDKwhattoputhere/events{/privacy}","received_events_url":"https://api.github.com/users/IDKwhattoputhere/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-12-27T15:48:29Z","updated_at":"2016-01-03T11:46:18Z","closed_at":null,"body":"Aside from the ads that sometimes appear on the right side (headed \"Products\" but redirect through a advertising company (tracking.s24.com)) they also redirect some results which are from \"Fastbot\" through fastbot.de. This is problematic in two ways:\r\n\r\n1. Fastbot.de doesn't really have a privacy policy.\r\n2. Fastbot.de is vulnurable to the POODLE attack.\r\n\r\nSome time ago they also had search results which were indistinguishable from regular results but redirected through ZANOX AG's servers (aka disguised ads). I don't see those anymore though.\r\n\r\nThey also redirect all clicks on search results through derefer.unbubble.eu (probably to avoid referer tracking) which doesn't use SSL. I don't know if this or any of these problems are a huge deal though."},"comment":{"url":"https://api.github.com/repos/nylira/prism-break/issues/comments/168491297","html_url":"https://github.com/nylira/prism-break/issues/1470#issuecomment-168491297","issue_url":"https://api.github.com/repos/nylira/prism-break/issues/1470","id":168491297,"user":{"login":"Unbubble","id":8150088,"avatar_url":"https://avatars.githubusercontent.com/u/8150088?v=3","gravatar_id":"","url":"https://api.github.com/users/Unbubble","html_url":"https://github.com/Unbubble","followers_url":"https://api.github.com/users/Unbubble/followers","following_url":"https://api.github.com/users/Unbubble/following{/other_user}","gists_url":"https://api.github.com/users/Unbubble/gists{/gist_id}","starred_url":"https://api.github.com/users/Unbubble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Unbubble/subscriptions","organizations_url":"https://api.github.com/users/Unbubble/orgs","repos_url":"https://api.github.com/users/Unbubble/repos","events_url":"https://api.github.com/users/Unbubble/events{/privacy}","received_events_url":"https://api.github.com/users/Unbubble/received_events","type":"User","site_admin":false},"created_at":"2016-01-03T11:46:17Z","updated_at":"2016-01-03T11:46:17Z","body":"@IDKwhattoputhere \r\n\r\nUS companies can be sentenced in secret trials to collect whatever data the government or agencies want. See the lavabit case. So the question is, who do you trust? This tends to be an irrational discussion. After Snowden revelations many users moved from Google (US) to DDG (US) which can't be more ironic. They've understood nothing. To make this clear, using Tor, VPN providers etc. may heal this, but most users don't.\r\n\r\n> there's for example Startpage or Metager\r\n\r\nThe latter includes Fastbot in the same way as we do. The former redirects users through Googles tracking gateway. It's all the same when leaving the private search environment.\r\n\r\n> There certainly needs to be some kind of information they collect or why else would they require the redirection?\r\n\r\nThey add their referral ID to certain results, receiving a revenue share that way. I've described the concept above and I'd provide an example to @Zegnat in private if required, because it's not my matter to publicly discuss their service and funding method.\r\n\r\n> BTW: Fastbot also offers a toolbar which is getting high detection rates on Virustotal \r\n\r\nI actually didn't want to comment on third party software. Thus the late answer. The Fastbot toolbar (which we btw do not promote in any way) is recognized by Virustotal as \"generic\" or \"searchit\". Frankly spoken: Many toolbars were abusive in the past and so Virustotal in this case recognizes an unknown toolbar and estimates it could be malicious.\r\n\r\n@Zegnat \r\n\r\n> It is totally unclear if Fastbot collects server logs\r\n\r\nThis is always a question of trust. What, if I ask them to add a sentence: \"Fastbot doesn't collect any personal data.\" - would this heal any doubt? The only quite reliable knowledge about Fastbot is: They mustn't collect complete IP addresses as that's forbidden by law. They don't use tracking pixels, cookies, analytics code on their website. They use servers located in Germany. They encrypt the connection and POODLE ist a non-trivial MITM attack.\r\n\r\n> Especially derefer.unbubble.eu not being protected with TLS\r\n\r\nThis is intentionally, since the HTTPS->HTTP step is usefull under some constellations to remove the HTTP referrer reliably and thus hide the query string. Perhaps it's time to revise this concept, but the attack vector still seems to be less critical.\r\n\r\nAll this leads me to the question, if the expectation is realistic for a search engine. We can never create a completely secure environment, protecting reliably against governments, malware, e-commerce tracking and other kinds of \"attacks\". Isn't that the actual reason why prism-break was startet? It's listing pieces of software and websites that help creating a sufficient environment for specific use-cases and needs...\r\n\r\nPerhaps users should be informed, that non-tracking websites still inhere the risk of MITM, malware or tracking of user-behavior off-site. This is always the case, for each and every private search engine. Reliable solutions can be VPN, Tor, Adblockers etc."}}