DuckDuckGo browser seemingly sends domains a user visits to DDG servers • Hacker News Board

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#191

Post by livre » Thu, Jul 02, 2020, 4:52 AM UTC

niftylettuce wrote: post #46

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

> Security harden your Android device: https://niftylettuce.com/posts/google-free-android-setup/

I haven't checked all links but some things need to be updated, for example Skimmer Scanner is gone from the Play Store and Yalp Store is abandoned and doesn't work anymore, you should be using Aurora Store. I'd also recommend Aegis or FreeOTP+ over FreeOTP for 2FA. NewPipe is better installed from this[1] repository until this[2] issue is solved.

[1] https://archive.newpipe.net/fdroid/repo/

[2] https://github.com/TeamNewPipe/NewPipe/issues/1981

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#192

Post by Igelau » Thu, Jul 02, 2020, 4:53 AM UTC

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

At this point we're all well aware why the app phones home. Continuing to spout that like it's some ward against the fact that this is a very real vulnerability is an insult. Trust me, your target audience doesn't give a crap if favicons work; they care that DDG acknowledges the risk of a glaringly obvious vulnerability. Who do you even think you're arguing with on HN and GitHub? My children can't multiply yet but they'd be able to understand why this is bad practice.

The repeated handwaving that no one in your company is ever going to do something bad or stupid when the browser phones home for what amounts to a cute sticker is extremely suspicious.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#193

Post by jacquesm » Thu, Jul 02, 2020, 4:53 AM UTC

Geee wrote: post #144

I guess they collect statistics of the sites that people visit. This is anonymous but valuable information.

Your guesses are both wrong (see upthread) and irrelevant.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#194

Post by niftylettuce » Thu, Jul 02, 2020, 4:54 AM UTC

livre wrote: post #191

niftylettuce wrote: post #46

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

> Security harden your Android device: https://niftylettuce.com/posts/google-free-android-setup/ I haven't checked all links but some things need to be updated, for example Skimmer Scanner is gone from the Play Store and Yalp Store is abandoned and doesn't work anymore, you should be using Aurora Store. I'd also recommend Aegis or FreeOTP+ over FreeOTP for 2FA. NewPipe is better installed from this[1] repository unti…

Yeah, I do use Aurora Store. No longer use Skimmer Scanner. I have to update that post. Working on a new blog/site and a book (eventually). Thanks for heads up.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#195

Post by Igelau » Thu, Jul 02, 2020, 4:59 AM UTC

tagawa wrote: post #81

fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

It's alright, folks. We got E2EE and a pinky-swear.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#196

Post by niftylettuce » Thu, Jul 02, 2020, 4:59 AM UTC

livre wrote: post #183

niftylettuce wrote: post #142

Earlier quoted context omitted.

https://reddit.com/r/privacytoolsIO/comments/5qnq6j/time_to_...

That's outdated information. Nowadays you can enable Encrypt All Sites Eligible and the extension will force HTTPS everywhere skipping the whitelist. It'll also prompt you to continue to the HTTP version if HTTPS fails to load.

Thanks for the heads up

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#197

Post by austhrow743 » Thu, Jul 02, 2020, 5:02 AM UTC

the_duke wrote: post #158

niftylettuce wrote: post #46

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

Seems a bit off-topic for the concrete issue. Advertising your Twitter for the advice of "switch to somewhat well-known browser X, install these very common extensions and use a VPN" is also a bit ... odd.

An ex DuckDuckGo employee recommending people use an alternative browser over the DuckDuckGo browser, in a post about the DuckDuckGo browser spying on its users, is about as on topic as you can get; after the current employee giving an explanation.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#198

Post by Igelau » Thu, Jul 02, 2020, 5:04 AM UTC

jacquesm wrote: post #190

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Does Gabriel know about this? If not could you please clue him in and get some guidance because you are absolutely getting roasted here and are wrecking DDG's carefully built up reputation. I can easily see how this might seem to be a good idea to you and other DDG engineers but it goes 180 degrees against DDG's stated mission. In other words: you may be well outside your paygrade on this.

> this might seem to be a good idea to you and other DDG engineers

If that's true, then I am so glad they ghosted me when I applied there.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#199

Post by ehsankia » Thu, Jul 02, 2020, 5:08 AM UTC

asdfk-12 wrote: post #186

abnercoimbre wrote: post #112

Earlier quoted context omitted.

Seconded. Day in and day out we're given empty promises we can never audit -- now it's being done DuckDuckGo staff too?

thirded. an inconsequential token is not a suitable reason to engage in this kind of data collection, especially for a search tool that prides itself on 'not tracking' users..

Fourthed, and honestly it's strange that they are willing their promise to privacy on saving 2-3 queries on something as trivial as favicons? Why does no other browser need to do this?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#200

Post by hst-m » Thu, Jul 02, 2020, 5:10 AM UTC

st3fan wrote: post #109

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website you visit is being sent back to our servers, don't worry it's just for data collection purposes, no personal information, just every website you visit (LOL)"

For those of you who don't understand, Yes they are saving data on all your search terms, and Yes they are saving data on these favicon requests, don't be so naive, they admit it themselves. They are not going to turn this feature off because it is too valuable to have all your information on all the sites you visit