At launch, access to Mullvad Leta was restricted to users with a paid Mullvad VPN account, but it is now free and open to all.
Mullvad Leta has been audited by Assured.
Just a heads up, some of the details in the FAQ and Terms of Service seem a bit outdated and might not be accurate anymore.
Some relevant information from their FAQ section is as follows:
What can I do with Leta?
Leta is a search engine. You can use it to return search results from many locations. We provide text search results, currently we do not offer image, news or any other types of search result. Leta acts as a proxy to Google and Brave search results. You can select which backend search engine you wish to use from the homepage of Leta.
Can I use Leta as my default search engine?
Yes, so long as your browser supports changing default search engines.
Navigate to https://leta.mullvad.net in your browser and right-click on the URL bar.
From there you should see Add “Mullvad Leta“ with the Mullvad VPN logo to the left.
If you do not see this, you can attempt to add a custom search engine to your browser with:
- The name set to: Leta
- The URL set to: https://leta.mullvad.net/?q=%s
You can select which backend engine to use as follows:
- Google: https://leta.mullvad.net/?q=%s&engine=google
- Brave: https://leta.mullvad.net/?q=%s&engine=brave
Did you make your own search engine from scratch?
We did not, we made a front end to the Google and Brave Search APIs.
Our search engine performs the searches on behalf of our users. This means that rather than using Google or Brave Search directly, our Leta server makes the requests.
Searching by proxy in other words.
What is the point of Leta?
Leta aims to present a reliable and trustworthy way of searching privately on the internet.
However, Leta is useless as a service if you use the perfect non-logging VPN, a privacy focussed DNS service, a web browser that resists fingerprinting, and correlation attacks from global actors. Leta is also useless if your browser blocks all cookies, tracking pixels and other tracking technologies.
For most people Leta can be useful, as the above conditions cannot ever truly be met by systems that are available today.
What is a cached search?
We store every search in a RAM based cache storage (Redis), which is removed after it reaches over 30 days in age.
Cached searches are fetched from this storage, which means we return a result that can be from 0 to 30 days old. It may be the case that no other user has searched for something during the time that you search, which means you would be shown a stale result.
What happens to everything I search for?
Your searches are performed by proxy, it is the Leta server that makes calls to the Google or Brave Search API.
Each search that has not already been cached is saved in RAM for 30 days. The idea is that the more searches performed, the larger and more substantial the cached results become, therefore aiding with privacy.
All searches will be stored hashed with a secret in a cache. When you perform a search the cache will be checked first, before determining whether a direct call to Google or Brave Search should be made. Each time the Leta application is restarted (due to an upgrade, or new version) server side, a new secret hash is generated, meaning that all previous search queries are no longer visible to Leta
What could potentially be a unique search would become something that many other users would also search for.
What is running on the server side?
We run the Leta servers on STBooted RAM only servers, the same as our VPN servers. These servers run the latest Ubuntu LTS, with our own stripped down custom Mullvad VPN kernel which we tune in-house to remove anything unnecessary for the running system.
The cached search results are stored in an in-memory Redis key / value store.
The Leta service is a NodeJS based application that proxies requests to Google or Brave Search, or returns them from cache.
We gather metrics relating to the number of cached searches, vs direct searches, solely to understand the value of our service.
Additionally we gather information about CPU usage, RAM usage and other such information to keep the service running smoothly.
I’ve been paying for Mullvad for a while and didn’t realize this was even a thing until this announcement.
This is also what Startpage does.
And Searx
If only there were a search index I thought was still good.
I cannot help but respect any organization that has “here are the conditions that make our product useless” in their FAQ.
It’s an effective way to describe what their proxy does, for sure. It’s just nice to read public-facing text that doesn’t feel sanitized by committee.
It’s also underselling what they are providing.
You get to skip all the AI garbage, all the sponsored links, and the “what other people are asking” sections and just go straight to the search results.
Privacy is the primary selling point, but the clean “old school” google interface is what I’m really excited about. I’ve set my default search in the browser to Leta for now.
So SearXNG?
SearXNG
Always wondered how the fuck I’m supposed to say that.
Seeks’nn’jnn?
Sur X N G?
Search engine?I’ve never thought about it until now, so thanks for that…
I’ve said it in my head as “Seer” and then the letters X N G. I didn’t even CONSIDER part of it is supposed to sound like “search”…
Probably the last one, I guess it’s kinda like nginx
Search’ng?
I pronounce it like it’s spelled, searksng.
I just say that as SearchesNG
I’d rather let some EU company like Qwant use my anonymized data, to hopefully someday build their own index, than use Google by proxy (except when neccessary, of course).
Mojeek (UK-based) is trying. I wasn’t super impressed by their index yet, though.
Good news, they are doing just that (in cooperation with Ecosia)
Edit: And it is supposed to be released this year (as early as Q1 apparently) https://betterweb.qwant.com/en/2024/11/08/ecosia-and-qwant-join-forces-to-develop-european-search-index/
That is some unexpectedly good news. I’m looking forward to see the results of an EU based search index.
Good moves from Ecosia. They used to get some flack for using Bing and Google.
The entire reason I stopped using them was because they agreed to share more user data with Google and Microsoft in return for being allowed to keep using their search results. If they had an independent index without those kinds of tracking for big tech companies, I’d switch back in a heartbeat.
No images and news categories?
I wonder if they’re using the (paid) Google and Brave APIs, and are running Leta as a loss leader, or if they have some way to get around it
Never gave this much thought. I’ve been considering subscribing for Kagi again, but basically they are paying for a Google API subscription, meaning that Google directly monetizes my Kagi searches?
To be completely honest, I’m less worried about privacy and more worried about what kind of world I’m contributing to with my internet usage. I Mullvad sends money to Google for every search, it’s probably not for me.
Switched to Qwant now - rather Microsoft than Google, and at least they are working on their own engine.
Surely it has to be the paid APIs. You can’t build a service hoping Google won’t notice your bots running searches.
The Leta FAQ confirms this:
Did you make your own search engine from scratch? We did not, we made a front end to the Google and Brave Search APIs.
Our search engine performs the searches on behalf of our users. This means that rather than using Google or Brave Search directly, our Leta server makes the requests.
Searching by proxy in other words.
I guess you would need a lot of proxies. And they probably need to be on Googles good side to keep their VPN extension in Chrome
I guess you would need a lot of proxies
That would be incredibly slow
Maybe that’s why they cache results for 30 days?
Can you please link to the paid Google API you’re talking about? I wasn’t aware they had an API for web search.
search engine
Not a search engine.
Ehhh. I mean, technically yes, but a proxy for search engine requests is probably functionally equivalent to the end user.
Also, if users don’t know that such a thing exists and goes looking for a “search engine”, they likely also want this.
One of my personal pet peeves is power stations — a big lithium-ion battery pack hooked up to a charge controller and inverter and USB power supply and with points to attach solar panels — being called a “solar generator”. It’s not a generator, doesn’t use mechanical energy. But…a lot of people who think “I need electricity in an outage” just go searching for “generator”. I don’t like the practice, but I think that the aim is less to deceive users and more to try to deal with the fact that they functionally act in much the same role and people might not otherwise think of them.
I am less sympathetic to vendors who do the same with calling evaporative coolers “air conditioners”. Those have some level of overlap in use, but are substantially different devices in price and capability.
It’s like saying a passenger rail car is a freight engine
I think it’s more like a travel agent and a passenger rail
I think they just call them trains
Is it really though? To the common person, it is most important thinking about the intent rather than what the word literally means. Like what people think of as AI may really just be a LLM, or VR may really be AR, or the like.
I get what you’re saying, but in that case the google.com interface isn’t a search engine; nor the load balancers and proxies between it and the search application backend. And then, maybe those don’t count because there is some special sauce in database procedures that are the real workhorses.
Pedantry all the way down.
Leta acts as a proxy to Google and Brave search
Great! As much as I love DDG, Google is unfortunately still superior and I had no choice but to suck it up and use the latter from time to time. If I could use Google by way of proxy to preserve privacy, then this is great news!
I think Kagi si better than Google, but under the hood it just mixes results from Google, Bing and Yandex.
Kagi have their own index too.
DDG has been superb for me for a few years now often returning results I prefer over Google. I’m really pleased with it.
It probably depends what you’re looking for, but I find DDG to have fewer up-to-date results than Google.
Aren’t there a lot of engines that already do this
It seems like a good alternative so some of the most popular engines. I think I’ll stick with Ecosia, since on top of being EU based, they also make the world a better place.
Mullvad is Swedish
Your search query, IP address and iirc fingerprint gets shown to Bing everytime you make a search, so it’s not private at all
I don’t see them claiming it is
It is still a good reason not to use Ecosia, however.
But doesn’t Leta use Bing as it’s backend also?
No, it uses Google and Brave search.
I don’t like how it tells you when the results were cached. You can tell if and when a query was searched for by someone else.
I do like it because when I’m trying to find out more information about break8ng events I want to know if I’m getting outdated information. Also, knowing that someone, somewhere in the world entered the same search terms as you within the last 30 days tells you absolutely nothing about that person.
Unless the terms include a name or location. Plus Leta is not widely used.
Suppose you tell someone in secret that you were arrested. You know they use Leta, so you look up “John Doe arrest” later and see that it was just recently cached. You only told one person so it must have been them. You now know what someone searched because they used Leta.
uh-oh
Leta is not widely used.
Please everyone, help click
Unless the terms include a name or location.
This is somewhat valid but it still doesn’t really tell you anything about who searched for that thing. You only know that someone else searched for it and how long ago it happened. You have no idea who they are, where they are, or why they entered that search term.
Suppose you tell someone in secret that you were arrested. You know they use Leta, so you look up “John Doe arrest” later and see that it was just recently cached. You only told one person so it must have been them. You now know what someone searched because they used Leta.
No, you don’t know that. You are assuming it.
You don’t have a comprehensive list of Leta users and you aren’t the only person who knows about your arrest. There’s at very least the cops, whatever support staff they have around at the time, and anyone they talked to. Then there’s any witnesses to the arrest, everyone who could have seen you in the back of a cop car, and everyone they talked to. Even if you were somehow arrested and processed by a single officer in total secret and then he killed himself in front of you before he could tell anyone else, there’s still the possibility that your friend betrayed your confidence and told other people about your arrest.
It was just an example but ok, let’s fix it.
You want to see if someone is nosy so you lie and tell them you were arrested in 2006. You check and see “John Doe arrest 2006” or “John Doe 2006 arrest” is cached.
You get the idea.
Ok, cool. You successfully proved that a person you suspect of being nosy actually is. You probably could have figured that out based on their reaction to you telling them about the fake arrest. Also, your nosy fake friend is a real idiot. They are apparently privacy focused enough to be using Leta but ignorant of the fact that this search is going to be cached and the time logged. The arrest is from 2006 so it’s unlikely anyone else would have searched it. Leta isn’t widely used so the smart play is to use literally any other search engine for this one search because the only person they need to keep it a secret from is you. Or maybe they just don’t care if you know that they searched for more info on your arrest because everyone already knows they are nosy.
All of this is besides the point though because none of these super specific scenarios are what we’re talking about when we discuss privacy on this level. This is meant for keeping Google from harvesting your data. If you decide to use it for baiting people into searching specific things so you can have a weird little gotcha moment that’s on you.
A privacy-focused search should not potentially reveal to others that you searched something. My examples prove the possibility that it can do that. I’m sure there’s other examples that are less “weird”.
So name one…
Someone explain to be why this is better than using DDG or Qwant or SearX?
It’s not, but it is better than using google
Honest question: how can it be better to search Google through a proxy than using Google? You’re still feeding the beast?
The beast eats personal data and sells it as ad revenue. If you are searching via proxy they can still collect general interest stats but not link it to an individual. It is not as profitable for them.
The Beast is fed by collecting data about you and then serving you back ads accordingly. This strips the data and the ads, so you feed them nothing.
I genuinely feel that Google’s search results have gotten really bad, over the last years especially. I find DDG results to be much better generally. If Mullvad Leta also proxied DDG for another layer of privacy then I’d use it, but not even it’s only search engines are Google and Brave.
When you search google it fingerprints your browser then attachs that to the other information it amasses from tracking your other activities from other websites.
By not giving them the search content you reduce what they know.
Scenario a) you search up particular health issues on google, for the US say “how do I know I’m pregnant” then you go to an online pharmacy (Walgreen is the big US one I think) and order “plan b” (anti pregnancy drug). Google doesnt even need to know from walgreens what you ordered it will infer a pregnancy test and/or plan b then from later activity
Scenario b) you use proxy and thus google knows nothing of your search, then you go to walgreens, for all google knows you ordered makeup or hayfever tablets.
Scenario a is or will be illegal in some US states - best not to leak it.
Not a perfect example, i can poke holes in it. The point is searches are usually sensitive info, keeping them out of the hands of the most egregious activity collator keeps more privacy then if you don’t. The proxy buries your senstive search in with thousands of others that can’t be attached to you
Searx can provide a much better experience.
For example, on the instance I’m using if a search result is a Google thread, the link will direct you to a redlib reddit proxy.
And do you reveal which instance you are using? Or is it a private one?
sorry its: https://searx.perennialte.ch/
‘Better’ is relative :) is it better than using something like SearXNG? No. But for those people who insist on using Google, its better to do a proxied search than a first-hand one. Mullvad are European, are one of the very few orgs I personally think are trustable and have shown no signs of enshittification, Leta has been audited by a 3rd party - for those looking for a private Google experience this is about the best there is.
Finding a searxng instance and entering a random search term, the first 10 pages of results all came from google.
Checking the preferences, there were 4 search, and 6 of the other toggles enabled.
Even enabling all engines and rerunning the search, the first 13 results were listed as google
Is it meaningfully different from this offering if all the results it picks seemingly come from Google?
If I disable all but mojeek and qwant, all the results came from mojeek
So is it like DDG but with EU GDPR ?
I think that would be Qwant. This is a search engine proxy.
Now I’m getting confused. Are DDG and Qwant not proxies for Bing?
Not exactly, they are search engines in their own right that have their own crawlers, but also use the Bing API. Leta is literally a proxy, it searches on the google (or brave) search website on your behalf and serves you the results. That way the only data Google gets is Mullvad’s.
paste url has an extra 25 in it. thx for the info tho!
