Provably private search

This is everything The Burrow Project can learn from you using Burrow Search:

1. It has no networking code. The search app is built without any HTTP, TLS or DNS library. The crawler, which does use the network, is a separate program the app never includes. tests/privacy_audit.rs fails if that ever changes.
2. It's tested with no network at all. Searching, installing, verifying and the web interface run in tests/network_isolation.rs inside a sandbox with no network interfaces. If any of them needed the network, the test would fail.
3. There's no telemetry. No analytics, crash reports, remote logging or ads. The web interface doesn't even keep a log on your own machine.
4. The web interface is locked down. It only listens on your own computer, ignores requests sent through other sites (DNS rebinding), loads no JavaScript or outside resources, and doesn't pass your query on to the sites you click.
5. Your searches stay out of the browser's history. By default the web interface doesn't put your query in the address bar, the page title or the search box's autofill, so your browser has nothing to remember it by. If you'd rather have links you can bookmark or share, untick Keep searches out of the address bar under the search box.

Privacy wouldn't help much if someone could slip you a fake index. Every index and update is signed with our Ed25519 key, and the app checks the hash and signature when you install it and again every time you search. A modified, corrupted or cut-off file is refused.

It also refuses an older index on top of a newer one unless you explicitly allow it, and an update that doesn't apply to the version you have.

Unplug and search

Install an index, turn off Wi-Fi or pull the cable, and search. It still works.

Run it with no network

On Linux, this runs the search in a sandbox that has no network interfaces:

$ unshare -rn local-search "anything you like"

Build it and run our tests

The source is open. Build it yourself and run the same privacy tests we do, including the dependency audit and the no-network sandbox tests:

$ cargo build --release --workspace
$ cargo test --workspace

Source on GitHub

Burrow protects one thing very well: the search itself. If your safety depends on more than that, as it can for journalists, activists and whistleblowers, know where it stops:

• Your own device. If it is seized, searched or infected, your searches can be found there. A terminal keeps commands in its history, including local-search "…". The web interface keeps your queries out of the browser's history unless you turn that off, but a search is on screen, and in memory, while you use it. Burrow itself stores no search history.
• Downloading the index. Your network, and our server if you download from us, can see that you use Burrow. Not what you search for.
• Visiting results. Opening a result connects you to that website from your own IP address, as any link does.
• What's in the index. We decide what goes into it, and a signature proves a file came from us, not that our choices are neutral. It is also only as recent as your last update.
• Maturity. Burrow is experimental and has not had an independent security audit. Don't let it be the only thing between you and someone looking for you.

If the limits above matter to you, this closes most of them:

1. Get the index without your name on it. Download it through Tor Browser, from a mirror, or copy it from a colleague's USB stick. The signature proves it's genuine whichever way it arrives.
2. Check our key once, out of band. Compare the key fingerprint with one published somewhere you trust, before you pin it with index trust.
3. Keep searches out of history. Leave Keep searches out of the address bar ticked in the web interface (it is by default), and use a private window too if you can. In the terminal, turn off shell history before searching:

   $ unset HISTFILE
   $ local-search "…"

4. Open results in Tor Browser. Copy the link of a result you want to read into Tor Browser, so the website doesn't see your IP address.
5. Encrypt the disk. Full-disk encryption protects the index and anything else on the machine if it is lost or taken while switched off.

Newsrooms and organisations can also host a mirror of the index on their own network, so staff never contact us at all. Every copy is checked against our signature, so a mirror can't alter what people search.