Tuesday, December 2, 2008

What is Scroogle?

Did you know that you can delete most spam and blogs by adding -com to your search terms? Scroogle does. No cookies. No search-term records. Access log deleted within 48 hours.

Scroogle, a proxy search engine, is a self proclaimed Google arch-nemesis. Campaigning for internet search freedom and liberty, Scroogle allows surfs to search minus the Big Brother Monkey on your back. Scroogle enables Wi-Fi internet user to surf securely. Scroogle cuts down on the profiling of service providers. If you use the internet while at work, Scroogle will eliminate your employer's ability to monitor your web surfing. This stealth-mode search leader is a big hit among youngsters who use public computers.

For Scroogle, SSL is used to hide your search terms from anyone who might be monitoring traffic between your browser and Scroogle's servers. This encryption happens when you send your search terms to Scroogle, and it also happens when Scroogle sends the results of your search back to you. No one snooping between your browser and Scroogle can figure out what you were looking for, because the information is encrypted and looks like gibberish. The connection between Scroogle and Google, which still must happen for every search, is not encrypted because Google doesn't use SSL. However, this connection is not associated with you at that point, and only Scroogle knows who entered those search terms. Your IP address is dropped before your search terms are sent to Google.

Most employers monitor the websites visited by their employees. There are impressive "employer spyware" packages such as Websense that they use to do this. Because the GET method is preferred by almost all search engines (see this page), even if the employer sees only the web address that you used to arrive at Google, he already knows the search terms you requested. With a record of all the search terms you've used while you were at work, each with a date and time recorded in his log, your employer has a pretty good idea of what you've been thinking. There are no laws that prevent employers from doing this sort of snooping.

If you use Wi-Fi and you haven't set up your router for secure operation, your neighbors could see what you are doing on the web. Again, your search terms might be interesting to them.

In some countries, the government could be monitoring your web activity by requiring your service provider to log the sites you visit, and make the logs available on demand. In fact, most governments wouldn't even have to ask the service provider for this information. They could tap the line upstream of the provider, and just look for packets containing www.google.com/search. Next to this are your search terms in plain text, with your IP address in the same packet. Government spies salivate at the thought of data-mining this information. With your search terms revealing what you are thinking, and the email you send revealing your network of associates, that's almost everything they need to know about you.

Besides encrypting everything between your browser and Scroogle, there are other details that may interest you about SSL. We prefer the POST method over the GET method, but if you use SSL, even the GET method is secure. You will see the Scroogle address and the search terms in your browser address bar with the GET method only because the browser displays this before it starts the SSL negotiation with Scroogle. Those search terms don't go any further than your browser. The SSL in your browser strips off the portion of the URL after the question mark, and then provides this information to Scroogle only after the secure connection has been established.

When the Scroogle results come back from an SSL search, and you click on any of the links shown on that secure page, there is another advantage. SSL does not allow the browser to record the address where that secure page came from, and attach it to any outgoing links on that page. Normally all browsers do this, and it's called the "referrer" address. But SSL blanks out the referrer, so that any site you click on from a Scroogle SSL page won't even know that you arrived at their site from Scroogle. The referrer will be blank, and your log entry will look like any of the hundreds of bots that crawl the web all day and night with similar blank referrers.

All of these are good reasons to use Scroogle's SSL option. It increases the load on our servers because the encryption handshaking is complex, but so far it hasn't been a problem for us. If it does become a problem, we hope to get more donations so that we can add more servers.

Reblog this post [with Zemanta]

No comments: