added

q3-privacy-assessment/privacy-report.md

@@ -0,0 +1,138 @@
+# Privacy Assessment Report — mithal.space
+
+> mithal.space is a privacy-focused search engine built on SearXNG, hosted on Ghaymah infrastructure.
+
+---
+
+## 1. HTTPS & Certificate
+
+| Check | Result |
+|---|---|
+| HTTPS enforced | ✅ Yes — HTTP redirects to HTTPS |
+| TLS Version | TLS 1.2 / 1.3 |
+| Certificate Issuer | Let's Encrypt (intermediate: `YR1`) |
+| Certificate Valid | ✅ Yes (valid 2026-06-17 → 2026-09-15) |
+| HSTS Header | ❌ Not observed — missing `Strict-Transport-Security` |
+
+**Finding:** The site correctly enforces HTTPS with a valid Let's Encrypt certificate. The absence of HSTS means browsers will not remember to always use HTTPS on the first visit, leaving a narrow window for SSL-stripping attacks.
+
+**Screenshot:** `screenshots/https-certificate.png`
+
+---
+
+## 2. HTTP Security Headers
+
+Inspected via DevTools → Network → Response Headers on the main document request:
+
+| Header | Present | Observed Value |
+|---|---|---|
+| `Content-Security-Policy` | ✅ Yes | `default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: http:; connect-src 'self' [ghaymah internal services]; frame-ancestors 'none';` |
+| `X-Frame-Options` | ✅ Yes | `DENY` |
+| `X-Content-Type-Options` | ✅ Yes | `nosniff` |
+| `X-XSS-Protection` | ✅ Yes | `1; mode=block` |
+| `Referrer-Policy` | ✅ Yes | `strict-origin-when-cross-origin` |
+| `Permissions-Policy` | ✅ Yes | `geolocation=(), microphone=(), camera=()` |
+| `Strict-Transport-Security` | ❌ Missing | Not present in any observed response |
+
+**Finding:** Security headers are well-configured overall. The CSP policy allows `'unsafe-inline'` for scripts and styles (necessary for SearXNG), which slightly weakens XSS protection. HSTS is the main missing control.
+
+---
+
+## 3. Cookies
+
+Inspected via DevTools → Application → Cookies → `https://mithal.space`:
+
+**No cookies were observed.**
+
+The site sets no tracking, session, or analytics cookies. This is consistent with a privacy-focused search engine — user state is not persisted between sessions.
+
+---
+
+## 4. Third-Party Network Requests
+
+Inspected via DevTools → Network tab, filtering for third-party domains:
+
+| Domain | Purpose | Privacy Risk |
+|---|---|---|
+| `fonts.googleapis.com` | Google Fonts CSS | Low — IP address may be logged by Google |
+| `fonts.gstatic.com` | Google Fonts files | Low — same as above |
+| `t0/t1/t2.gstatic.com` | Search result favicons | Low — loaded only for displayed results |
+| `img.youtube.com` | Video thumbnails in results | Low — loaded only when results include videos |
+
+**Finding:** No behavioral tracking services (e.g., Google Analytics, Facebook Pixel, or similar) were detected. The only third-party connections are to Google for web fonts and result thumbnails — both are functional rather than tracking in nature. However, Google Fonts requests do expose the user's IP address to Google servers.
+
+---
+
+## 5. Privacy Risk Summary
+
+| Category | Score | Notes |
+|---|---|---|
+| HTTPS & Transport Security | Good | Certificate valid; HSTS missing |
+| Cookie Privacy | Excellent | No cookies at all |
+| Tracker Exposure | Excellent | No analytics or tracking scripts |
+| Security Headers | Good | CSP, X-Frame-Options, Permissions-Policy all present |
+| Third-Party Exposure | Low Risk | Google Fonts exposes IP to Google |
+
+Based on the performed checks, mithal.space does not appear to use tracking cookies or analytics services. The site has several security headers enabled, with HSTS being the main missing header.
+
+---
+
+## 6. Comparison to Two Other Sites
+
+| Feature | mithal.space | DuckDuckGo (duckduckgo.com) | Google Search (google.com) |
+|---|---|---|---|
+| HTTPS | ✅ Yes | ✅ Yes | ✅ Yes |
+| Third-Party Trackers | None detected | None | Uses Google-owned services and cookies that may be associated with personalization and advertising features |
+| Cookies | ❌ None | Minimal (theme/settings only) | Multiple Google ecosystem cookies |
+| Content-Security-Policy | ✅ Present | ✅ Strict | ✅ Present |
+| Permissions-Policy | ✅ Present | ✅ Present | ✅ Present |
+| HSTS | ❌ Missing | ✅ Full with preload | ✅ Full with preload |
+| Data Sharing with 3rd Parties | Google Fonts (IP only) | None | Data collected may be used for personalization and targeting |
+| Open Source | ✅ Yes (SearXNG) | ❌ No | ❌ No |
+
+**Summary:** `mithal.space` is significantly more privacy-respecting than Google Search and comparable to DuckDuckGo. Its advantage over DuckDuckGo is being open-source and self-hosted on Ghaymah infrastructure. Its disadvantage is the missing HSTS header and Google Fonts dependency.
+
+---
+
+## 7. Three Security Improvements
+
+### Improvement 1: Add HSTS Header
+**Problem:** Without `Strict-Transport-Security`, browsers do not remember to always use HTTPS on the first visit, leaving a small window for SSL downgrade attacks.  
+**Solution:**
+```
+Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+```
+Add to the Nginx or application server response headers. Then submit the domain to the [HSTS preload list](https://hstspreload.org).  
+**Benefit:** Forces all future connections to use HTTPS from the first visit.
+
+### Improvement 2: Self-Host Web Fonts
+**Problem:** `fonts.googleapis.com` and `fonts.gstatic.com` requests expose the user's IP address to Google, even if no tracking cookies are set.  
+**Solution:** Download the required fonts and serve them directly from `mithal.space`:
+```nginx
+location /fonts/ {
+    alias /var/www/fonts/;
+    add_header Cache-Control "public, max-age=31536000";
+}
+```
+Update the CSP to remove `googleapis.com` and `gstatic.com` from allowed sources.  
+**Benefit:** Eliminates all third-party IP exposure to Google.
+
+### Improvement 3: Tighten CSP to Remove `'unsafe-inline'`
+**Problem:** The current CSP allows `'unsafe-inline'` for scripts and styles. This weakens protection against XSS attacks.  
+**Solution:** Replace inline styles/scripts with external files and use CSP nonces for any remaining inline code:
+```
+Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; ...
+```
+**Benefit:** Significantly reduces the attack surface for cross-site scripting.
+
+---
+
+## Screenshots
+
+![mithal.space homepage](screenshots/homepage.png)
+
+![SSL certificate verified via crt.sh](screenshots/https-certificate.png)
+
+![Search results page](screenshots/search-results.png)
+
+> Additional DevTools screenshots (Cookies panel empty, Response Headers, Network requests) can be captured manually in Chrome/Firefox via F12 and saved to the `screenshots/` folder.