Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

41–50 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#41

Post by dmitrygr »

bangonkeyboard wrote: post #10

EDIT: I didn't notice that this topic was about the DDG browser (which I didn't know existed) and responded assuming this was about the site/extension. For a browser, yes, a client-side solution is possible and probably preferable. Please check and upvote other comment trees. This makes sense to me and is not alarming. Getting favicons actually is difficult to do robustly; many applications and websites use Google's…

> Putting this logic in the client is not feasible

Wait, what? Why?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#42

Post by detaro »

ghewgill wrote: post #29
tananaev wrote: post #2

Very weak argument for why they do it. Using a service to retrieve a favicon? Surely there's a way to implement the same logic locally.

So if favicons were gathered locally, then you would prefer that your own browser would reach out and make multiple requests to every (potentially dodgy) site listed on the search result page? Note also that these are favicons for results that DDG has already given you . This isn't tracking your clicks. The list of sites that appear on the search result page is not new information to the search engine that just gave…

What about the issue linked suggests to you that it is about search results in any way?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#43

Post by FalcorTheDog »

jakejarvis wrote: post #26
fiddlerwoaroof wrote: post #18

Earlier quoted context omitted.

The standard way involves a meta tag, right?

That's my understanding of how it's worked for decades... 1. Check for tag(s) 2. Check for /favicon.ico 3. ...give up? Someone correct me if I'm wrong!

One major issue is that the "standard" favicon size has historically been 16x16 pixels... which, in the age of high density displays will render either comically small or comically blurry. There are other meta tags like Apple's "apple-touch-icon" which has some higher resolution options. But already you can see the logic here isn't trivial.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#44

Post by detaro »

bangonkeyboard wrote: post #10

EDIT: I didn't notice that this topic was about the DDG browser (which I didn't know existed) and responded assuming this was about the site/extension. For a browser, yes, a client-side solution is possible and probably preferable. Please check and upvote other comment trees. This makes sense to me and is not alarming. Getting favicons actually is difficult to do robustly; many applications and websites use Google's…

Which other browser doesn't fetch favicons locally?

And I have no clue how search results come into this? Of course the browser isn't fetching favicons on search result pages, that's the servers job, but that's not what this is about.

It's really odd that this is the top comment right now, given that even the headline makes it clear its about the browser, not the search results.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#45

Post by stan_rogers »

coronadisaster wrote: post #6

I don't really trust DuckDuckGo, but I use their search service because I trust Google less... I still trust Firefox more for a browser although it won't take much at this point to make me switch.

There's always Startpage. You use Startpage; Startpage uses Google for you, with their own user agent - no history, no tracking.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#46

Post by niftylettuce »

Formerly worked with DuckDuckGo

My advice:

Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium

Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS

There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store

Set duckduckgo.com as your default search engine with a blank home page. But you could also use @pkrumins home pages of https://techurls.com or https://finurls.com as nice home pages.

Use Mullvad VPN: https://mullvad.net/ (They are EVEN available on F-Droid now, which is AMAZING)

Security harden your Android device: https://niftylettuce.com/posts/google-free-android-setup/

Security harden your Mac: https://gist.github.com/niftylettuce/39597a7b3bc0660ffe1e09d...

P.S. If you need email forwarding for your domain name, you can use something I made. https://forwardemail.net - it is 100% open source.

Follow me @niftylettuce on GitHub and Twitter for more

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#47

Post by mdoms »

bangonkeyboard wrote: post #10

EDIT: I didn't notice that this topic was about the DDG browser (which I didn't know existed) and responded assuming this was about the site/extension. For a browser, yes, a client-side solution is possible and probably preferable. Please check and upvote other comment trees. This makes sense to me and is not alarming. Getting favicons actually is difficult to do robustly; many applications and websites use Google's…

> Putting this logic in the client is not feasible. You want to send requests directly to every shady site that shows up in your search results, load their pages in the background, work through network delays and HTTP errors, and parse out the location/format of the favicon files?

I don't see why not. Browsers are constantly dealing with these very issues. It's one of their core competencies.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#48

Post by RandomBacon »

niftylettuce wrote: post #46

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

Why ungoogled-chromium over Firefox?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#49

Post by akersten »

FalcorTheDog wrote: post #43
jakejarvis wrote: post #26

Earlier quoted context omitted.

That's my understanding of how it's worked for decades... 1. Check for tag(s) 2. Check for /favicon.ico 3. ...give up? Someone correct me if I'm wrong!

One major issue is that the "standard" favicon size has historically been 16x16 pixels... which, in the age of high density displays will render either comically small or comically blurry. There are other meta tags like Apple's "apple-touch-icon" which has some higher resolution options. But already you can see the logic here isn't trivial.

It still seems trivial to me. Parse all meta icon tags, prefer one that matches exact client resolution of current display (don't even have to download the icons - the sizes are defined as part of the meta tag), else use the largest-resolution one, else in desperate bid try site/favicon.ico, otherwise give up.

Really shouldn't be complicated enough to need a special service to handle "edge cases".

Another comment mentions web manifest - I guess try those first before meta tags, or whatever order the standard says to use. I mean, we're talking a web browser here, it's designed to do these kind of tasks.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#50

Post by tomtomtom777 »

I have a hard time understanding the problem.

The favicon is acquired from DDG servers for the result you've just retrieved from DDG servers.

How is this leaking anything? What additional privacy would you gain from getting the favicons from the domains directly of search results delivered by DDG?

Post reply on HN