Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

81–90 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#81

Post by tagawa »

fiddlerwoaroof wrote: post #56
tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site.

The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#82

Post by baby »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

I think people here are more interested to know if you’re going to fix it.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#83

Post by richdougherty »

bangonkeyboard wrote: post #10

EDIT: I didn't notice that this topic was about the DDG browser (which I didn't know existed) and responded assuming this was about the site/extension. For a browser, yes, a client-side solution is possible and probably preferable. Please check and upvote other comment trees. This makes sense to me and is not alarming. Getting favicons actually is difficult to do robustly; many applications and websites use Google's…

> Putting this logic in the client is not feasible.

> You want to send requests directly to every shady site that shows up in your search results, load their pages in the background, work through network delays and HTTP errors, and parse out the location/format of the favicon files?

Looking at DuckDuckGo search results and visiting a page that you navigate to are two different things.

1. DuckDuckGo search results:

DDG already returns the search results so there's no privacy violation to return the favicon or the URL for the favicon in the list.

2. Any page that isn't a DDG search results page:

Use client side logic to locate the favicon. This means worse performance but better privacy - which aligns with DDG's goals.

If you want to optimise this then DDG could send the client some precalculated Bloom filters with info about known sites. The client could use these to try certain methods of favicon retrieval first.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#84

Post by niftylettuce »

verandaguy wrote: post #74
_5vzs wrote: post #51

Earlier quoted context omitted.

Faster + less bloat

Disagree on most points, actually: >Faster, less bloat Stock Firefox doesn't actually have that much bloat, and it's not noticeably slower than Chrome on reasonably modern hardware (i.e.: most page loads are near-instant, same as in Chrome on a good connection). >Extension support for Chromium is way better too Until Google decides that your extension is unworthy of being in their store. This notably happened with Pu…

As I said in other another comment, I'm a power user. And by power user I mean probably 10x the normal standard of what a 10x power user means. Tooling is everything to me; which is why I prefer this over anything else. I'm very biased.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#85

Post by sidibe »

Nextgrid wrote: post #62
stan_rogers wrote: post #45

Earlier quoted context omitted.

There's always Startpage. You use Startpage; Startpage uses Google for you, with their own user agent - no history, no tracking.

How does that work? What does Google have to gain from it? Google has pretty aggressive anti-scraping protections to protect against this exact behavior, so why would they allow Startpage to get away with it? What does Startpage have to gain from it? Unlike DDG, they don't seem to have any core product, so they fully depend on Google's goodwill which is very shaky grounds when it comes to a long-term business.

> Unlike DDG, they don't seem to have any core product, so they fully depend on Google's goodwill which is very shaky grounds when it comes to a long-term business.

Isn't that exactly like DDG but Google instead of Bing?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#86

Post by systemvoltage »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

It seems like DDG just doesn't want to do more work to make the browser do the sensible thing and instead piggy back on their existing favicon service, and then going to make the argument that it is safe with us. The domain of browser is totally different from reaching out to the website and rendering favicons server side. Do you not see this as a problem? I think it is acceptable to say "We agree this is a problem, and we are gonna look into fixing this" instead of pushing back on an obvious problem.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#88

Post by ancarda »

SimeVidas wrote: post #64
tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

How can users turn this off?

https://duckduckgo.com/settings#appearance

Uncheck the very last option "Site Icons"

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#89

Post by ajnin »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

You really can't use "we promise we won't misuse the information" as an argument, that's what everyone says whether it's true or not, and the whole point of using a privacy-centric browser is that as a user you can't trust those kinds of promises.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#90

Post by chris_f »

stan_rogers wrote: post #45
coronadisaster wrote: post #6

I don't really trust DuckDuckGo, but I use their search service because I trust Google less... I still trust Firefox more for a browser although it won't take much at this point to make me switch.

There's always Startpage. You use Startpage; Startpage uses Google for you, with their own user agent - no history, no tracking.

Runnaroo is also a search engine that is Google based (for organic results). IMO it has an advantage over Startpage because of its integration of vertical search sources, like Stack Overflow [0]. I'm the creator.

Mojeek [1] is also a good privacy option that doesn't get talked about as much as DDG. They distinguish themselves by having their own search index.

[0] https://www.runnaroo.com/search?term=python+unit+testing

[1] https://www.mojeek.com/

Post reply on HN