How "private" are private search engines ? Is private search really a thing?

VPN
1

There’s a lot of confusion out there and “private search” engines that are not so private. Let’s clear this a little bit.

Money making companies want to surf on the new “privacy trend” and trick people into honey pots.

It is not free to run a data center: electric bills, personnel, machines, security costs millions, so how can we pay the bills offering a search engine for free ? By selling something. That something is Metadata.

So they basically promote legitimate anonymous search but make profit with your metadata, like type of phone you use, gps location, browser type, etc…
They use your metadata to sell access to you and give you sponsored content in the search results, technically the advertisers don’t know who you are but the search engine, yes. To store that information or get rid of it is at their discretion.
Some other “private search engines” are state sponsored, because the state loves you and want to give you free privacy (or at least the illusion of it).

How would they do that ?

This is not a rant against Amazon but they are a good exemple and very present in this kind of industry.

Let’s say you want to start a business and host a private search engine on a powerful AWS server:
If you read Amazon’s Servers ToS, they specify “We may monitor the external interfaces (e.g., ports) of Your Content to verify your compliance with the Agreement.”.
The “may” is very important here, it’s a tricky word put there (by an army of trusty lawyers) to fool the user and should be read as “always”. And the “Agreement” part is so vague, with that magic word you can literally open the gates from hell, just don’t read the rest of ToS and click “I Agree” like everyone.

What it means is, whatever how secure your search engine is, Amazon can log the “in” and “out” to their servers and your metadata in the process, one rock, two hits. Everybody has a share, everybody is happy.
No matter how secure is your search engine encryption, if you look at the history of cryptography, every algorithm gets broken eventually, and when it’s done, someone can put an eye into your servers.

Any search engine who store metadata is not safe for privacy. They can sell it to anyone once it’s stored, logged and archived for eternity.
Metadata can show your unique fingerprint even if it is encrypted.
On a darker side, metadata is a powerful tool to track some individuals..

So what we are looking for is to avoid a metadata collecting server, and basically 99.99% of us-based servers.
Even if those so called US companies are hosted in Europe.
To resume, companies that have to comply to the Patriot Act have to be considered suspect. And yeah, sorry, that’s a LOT of people !.

The danger here is not the search engine themselves who are sincere to hide your requests from advertisers, but the machines they are running on are not and must obey the law enforcment, even if they did some oopsies.

Then if you are not paranoid enough, there are external forces that can come into play.. We live in a wild world.

This is NOT a complete list, there is a trend of “private search” engines out there! Here are some of the most famous:

The last two are like the icing on the cake, to give you some hope:

CONCLUSION:

There is a lot of fuckery out there, especially coming from the US govt. Lot of companies have to follow the rules and have to make money. The future of search privacy is definitely not in the hands of big corporations who want to track everything you do just so they can make profit. The future is you, the people, and some are really inspiring.. There is hope.

On a side note:

You cannot block 100% of the metadata that your browser is bleeding online, but some good privacy add-ons exist to limit the damage: Best Private Web Browsers for Most Privacy in 2025

Ways to browse 98% anonymously:

  • TOR is a good option to stay in the shade.

  • I2P is the new kid in the block, basically works on P2P

  • VPN (that is not hosted in the US or even worse, in China) is also a good choice to hide your IP.

  • Hack your neightbour’s Wifi

It is sad to see there is so few privacy focused search engines out there, but people start to get the idea and new stuff are coming out.

Keep on fighting!

2

Duckduckgo.com : (runs on Amazon servers), they do nothing wrong with your privacy, just keep your fingerprints.

Can you please stop spreading this FUD by technically illiterate people who don’t understand the meaning of what CanvasBlocker is and isn’t telling them?

DOMRect has absolutely nothing to do with fingerprinting. All it does is returns the dimensions for a DOM element on a web page. I have used this API a million times in my career to build and lay out user interfaces, and not once to fingerprint or profile a user.

CanvasBlocker blocks or obfuscates the data from API’s that could, in theory, be used to fingerprint a user. For instance, the data returned by DOMRect could be another data point, like your screen resolution. However, the use of these API’s on a web page does not mean that it is trying to fingerprint you, and chances are that 99.99% of such instances are completely harmless.

And you don’t have to take my word for it. Just check this issue: literally every website using jQuery UI (a very popular library) triggers the DOMRect warning. What does the CanvasBlocker author have to say about it?

So in this case the opening of the dialog leads to a domRect API read call. This is completely fine and legit. The notification only tells you that something was faked - not that a fingerprinting was attempted (I’m not able to detect this).

Good fucking God. It is just incredible how people in this community see something they don’t actually understand, and then start screaming bloody murder without any facts.

3

whois startpage.com result also shows that it’s hosted in the US. The CEO of SP doesn’t also have technical knowledge on how things work but he trust his people to fix privacy issues, which is really odd. People may argue that, that was some years ago and things may have been fixed. But again, the metasearch engine is still a proprietary SaaS.

Hack your neightbour’s Wifi

You could maybe say, “Use your neighbour’s WiFi” instead : ) Or there’s also Schneier’s approach where you just let your WiFi open, then basically you will have plausible deniability.

4

Does anyone know why searx.me shows google error when u put the word “legal” in front anything your searching? Like legal herb…

5

DuckDuckGo has a Google Add-On: https://chrome.google.com/webstore/detail/duckduckgo-privacy-essent/bkdgflcldnnnapblkhphbgpggdiikppg
Qwant has a Google Add-On: https://chrome.google.com/webstore/detail/qwant-for-chrome/hnlkiofnhhoahaiimdicppgemmmomijo

Swisscows has a Google Add-On: https://chrome.google.com/webstore/detail/swisscows/ibimaeimnogcdnjmmlpodbhhbejnpaij

Just thought I point this out.

Also, saying DuckDuckGo does “nothing wrong” with your privacy is a bit of of a stretch. It doesn’t have perfect forward secrecy (explained here: https://medium.com/searchencrypt/i-found-this-flaw-in-duckduckgo-9558877ae170 ) like some of the other search engines you’ve mentioned.

6

Reddit seems to have a huge DuckDuckGo community and everyone yells “FUD” mindlessly when they see something hurting their feelings.

This fingerprinting thing was just ONE example among others. I don’t say DuckDuckGo do it, I say it is possible to do so…

Ok, let’s say DuckDuckGo does not fingerprint you. As a company who give people a free search engine ou still have to pay the bills right ?
How you do that: donations, sponsoring and advertising. Sponsors and advertisers want something in return and that is targeting the users to show them relevant information.
You don’t want to sell a box of tampons from a local store in Manille to a man living in Reykjavik, you’ll waste money spending in advertising.

So you need basic informations, gender, location, etc… Metadata, encrypted or not, doesn’t make any difference in the process.

Now lets disable your ad-blocker and try a little experiment:

Type: “restaurant near me” in Duckduckgo

and “restaurant near me” in Searx.me

See any difference ? You can repeat the experience using a VPN if you want.

And that’s the funny part about DuckDuckGo saying “The search engine that doesn’t track you”.

7

I don’t say DuckDuckGo do it, I say it is possible to do so…

You cannot create a site without the possibility of fingerprinting users, so that statement is in no way reasonable.

8

You don’t want to sell a box of tampons from a local store in Manille to a man living in Reykjavik,

Thank you for arguing in good faith.