Being logged in while making search queries in search engines poses significant privacy risks. The searches can paint a comprehensive profile of the user, and these data often remain stored for extended periods. There's a chance this information might be shared with third parties. Coupled with other user data, these logged-in searches can pave the way for targeted advertising, sophisticated predictive analysis, and potential exploitation by governments or malicious entities. In the event of data breaches, the user's logged-in search histories can be exposed. Furthermore, users typically don't have clear insight into how their data is utilized when logged in.
I hope Kagi introduces an anonymous access feature. For instance, it could incorporate zero-knowledge proofs (ZKPs). These are cryptographic techniques where one party (the prover) can confirm to another (the verifier) that a claim is accurate without disclosing any additional information. This is especially beneficial for authentication scenarios where it's essential to avoid sharing extra details.
To implement zero-knowledge authentication for quota API access:
1. Token Creation:
- Each month, users receive a token tied to their identity and quota.
- The token can be split for use on multiple devices using cryptographic methods.
2. API Access:
- Clients present a zero-knowledge proof (ZKP) to confirm they have a valid token and haven't used up their quota. The server verifies this without seeing the exact details.
3. Client Synchronization:
- Each client tracks its quota usage.
- Synchronization can be peer-to-peer or through a centralized, encrypted server to prevent double spending of the quota.
4. Quota Renewal:
- Monthly, old tokens expire, and new tokens are issued.
Challenges:
- ZKPs can be resource-intensive.
- Token security is crucial; there should be a way to handle lost or compromised tokens.
- The system should prevent quota "double-spending" across devices.
- If a centralized server is used for synchronization, it should operate with encrypted data.
This way Kagi would only know who their customers are but not what kind of searches they make.
I hope Kagi introduces an anonymous access feature. For instance, it could incorporate zero-knowledge proofs (ZKPs). These are cryptographic techniques where one party (the prover) can confirm to another (the verifier) that a claim is accurate without disclosing any additional information. This is especially beneficial for authentication scenarios where it's essential to avoid sharing extra details.
To implement zero-knowledge authentication for quota API access:
1. Token Creation:
- Each month, users receive a token tied to their identity and quota.
- The token can be split for use on multiple devices using cryptographic methods.
2. API Access:
- Clients present a zero-knowledge proof (ZKP) to confirm they have a valid token and haven't used up their quota. The server verifies this without seeing the exact details.
3. Client Synchronization:
- Each client tracks its quota usage.
- Synchronization can be peer-to-peer or through a centralized, encrypted server to prevent double spending of the quota.
4. Quota Renewal:
- Monthly, old tokens expire, and new tokens are issued.
Challenges:
- ZKPs can be resource-intensive.
- Token security is crucial; there should be a way to handle lost or compromised tokens.
- The system should prevent quota "double-spending" across devices.
- If a centralized server is used for synchronization, it should operate with encrypted data.
This way Kagi would only know who their customers are but not what kind of searches they make.