Live data from Hacker News

Use DuckDuckGo to improve your privacy online (2018)

spreadprivacy.com

131–140 of 182 posts

Re: Use DuckDuckGo to improve your privacy online (2018)

#131
post #121
post #120

If the user submits a GET request to DDG from the commandline with Javascript disabled, then all results links are prefixed with the address of a DDG server, e.g., https://example.com becomes https://duckduckgo.com/l/uddg=https%3A%2F%2Fexample.com Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a priv…

> Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a privacy improvement in that regard. It's meant so that the sites you click on can't see your search queries via the Referer HTTP header. You can turn that off in DDG's settings[1] under the privacy tab. It's the "Redirect" switch. They explain more a…

Here is another perspective from a non-developer user on those reasons and the resulting tradeoff (of allowing DDG to trivially track which result links are followed):

1.

Privacy conscious users can control whether a Referer header is sent and if so, the content of that header.

They might choose to use a browser that does not make it easy to control the Referer header.

But DDG does not account for those privacy conscious users who may be using browsers that do allow this control. (Bias discosure: I use one and not for privacy reasons.)

The DDG decision seems to encourage users to choose browsers that have privacy-unfriendly default settings or that do not make it easy or even possible to control what if any Referer is sent.

At the very least, it tries to resolve an issue that is a clearly client-side one and is best resolved there.

2.

Correct me if I am wrong but storing "settings" with DDG requires a cookie and/or Javascript to be enabled.

If this is true, then again this is not an improvement in privacy. Privacy users may prefer to keep these browser "features" disabled wherever possible.

Users can of course control whether they send GET or POST by using a client such as curl or the like, or sending requests from a local copy of a DDG html search page with the method changed from GET to POST.

One might wonder why DDG cannot provide an alternative search page with its form method set to POST. Users can then choose which search page they prefer. No cookie needed.

Instead it sets the default method on its search pages to GET (perhaps leaking the query in the URL).

How many users will bother to change the default? A minority of them, no doubt.

There is an opportunity to let users turn off cookies and Javascript and let them perform searches using POST, the method usuaully advocated by those advancing internet privacy.

I cannot see that it would cost DDG anything substantial to provide it, except not promoting GET as a method by default, not requiring users who want to change defaults to enable cookies or javascript to "keep state" and reliquinshing the ability to easily track which result links users follow.

To reiterate, control over the Referer header is easily done by the http client. Clients that do not allow easy user control over this are not improving internet privacy.

In my experience sending Referer headers is almost never necessary. It is very rare that I find a site that requires a Referer header, let alone a specific one.

Sending gratuitous information seems like a clear departure from the internet privacy playbook. Then again, I am not a privacy expert and perhaps the experts have decided there must be a carve-out for the Referer header and users should err on the side of sending too much information rather than too little.

The only reason I am aware of this stuff is because I use the web heavily without javascript or cookies and I take an active role in what headers I send. I generally do not do this for privacy, but for speed and control. I can strip out the prefix client-side if I must use GET.

Re: Use DuckDuckGo to improve your privacy online (2018)

#133
post #125
post #120

If the user submits a GET request to DDG from the commandline with Javascript disabled, then all results links are prefixed with the address of a DDG server, e.g., https://example.com becomes https://duckduckgo.com/l/uddg=https%3A%2F%2Fexample.com Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a priv…

Here it is with piping so you don't have to litter your working directory: curl -s https://duckduckgo.com/lite/?q=example.com | grep -m1 "'result-link'" curl -sd "q=example.com" https://duckduckgo.com/lite/ | grep -m1 "'result-link'"

Then you cannot do

   diff a.htm b.htm
Send the output to /tmp or some directory mounted as tmpfs.

My working directory is always mounted tmpfs. This is how I keep things fast and clean.

Re: Use DuckDuckGo to improve your privacy online (2018)

#134

Earlier quoted context omitted.

If you feel like Google is excluding certain keywords you very much like to include, you can wrap the word/sentence in double quotes, this tells Google to show results that certainly include these keywords. For example, searching: "word x" "sentence a" would prompt Google to show only pages that include both the word and the sentence in the same page.

If only. It's a bit more fuzzy than that now.

Nope! :)

Its actually part of the syntax of search queries for google. That said, it still isn't always the best results.

Re: Use DuckDuckGo to improve your privacy online (2018)

#135
post #117

Earlier quoted context omitted.

> Go, OpenStreetMap!! Didn’t DuckDuckGo switch off of OpenStreetMap to Apple Maps recently?

Correct. I wish they stuck it out with OSM, that project needs more support.

I also wish they stuck with OSM. It was far more functional on the non-Apple products I use. Don't know how well it works on Apple, but I can't seem to figure out zoom and pan in Firefox.

Re: Use DuckDuckGo to improve your privacy online (2018)

#136

I first tried DDG in its early years and it just didn't yield the results I needed, I tried it again a couple of years ago and have stuck with it ever since as it has must better results these days.

My main problem with Google was that the entire first screen (above the fold) was full of advertising and included no actual search results, in the majority of my searches. DuckDuckGo is better at that, for now, so I made the switch about a year ago.

Re: Use DuckDuckGo to improve your privacy online (2018)

#138
post #131
post #121

Earlier quoted context omitted.

> Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a privacy improvement in that regard. It's meant so that the sites you click on can't see your search queries via the Referer HTTP header. You can turn that off in DDG's settings[1] under the privacy tab. It's the "Redirect" switch. They explain more a…

Here is another perspective from a non-developer user on those reasons and the resulting tradeoff (of allowing DDG to trivially track which result links are followed): 1. Privacy conscious users can control whether a Referer header is sent and if so, the content of that header. They might choose to use a browser that does not make it easy to control the Referer header. But DDG does not account for those privacy consc…

Correction: When I suggested alternative search page set to POST, that was a mistake. I actually meant alternative endpoint that accepts GET and returns clean (=unprefixed) result links. Sorry for the inadevrtence.

Re: Use DuckDuckGo to improve your privacy online (2018)

#139
post #120

If the user submits a GET request to DDG from the commandline with Javascript disabled, then all results links are prefixed with the address of a DDG server, e.g., https://example.com becomes https://duckduckgo.com/l/uddg=https%3A%2F%2Fexample.com Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a priv…

Try adding &kd=-1 to the end of your search URL.

For example:

https://duckduckgo.com/lite/?q=test&kd=-1

Post reply on HN