Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

231–240 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#231

Post by pwdisswordfish2 »

couchand wrote: post #171
pwdisswordfish2 wrote: post #117

Earlier quoted context omitted.

To get prefixed result URLs, use GET not POST. Try duckduckgo.com/lite/ and lite.duckduckgo.com/lite/ If I recall correctly there is a way to turn off the prefixed result URLs without having to turn on Javascript, by adding/changing a URL parameter, e.g., kh. However that is not the default setting. Not very friendly toward the privacy-conscious user who has Javascript disabled and does not read HN to find out about…

I'm not sure what you mean by bringing up HTTP method. The two main ways I know to get to the results page are to enter a query into the website or the browser search bar, and both of those seem to issue GET requests. They also both produce real URLs without any intervention. What defaults are different for you than they are for me?

If you navigate to https://duckduckgo.com/lite/ or https://lite.duckduckgo.com/lite/, type your query in the form input field, you are using POST. If, OTOH, you were to type your query into the address bar, e.g., https://duckduckgo.com/lite/?q=xyz then you are using GET.

   curl -Huser-agent= https://duckduckgo.com/lite/?q=xyz|grep result-link

   curl -Huser-agent= -dq=xyz https://duckduckgo.com/lite/|grep result-link

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#232

Post by aronpye »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

The road to hell is paved with good intentions. At the end of the day, your privacy policy is just a bunch of words with nothing to actually prevent you from abusing the data collected. Instead of us relying on DuckDuckGo to act ethically, just don’t collect the data in the first place.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#233

Post by bad-apple »

fulafel wrote: post #173
Stevvo wrote: post #39

Earlier quoted context omitted.

A privacy focused browser shouldn't even have a backend.

I'm not so sure. I think the privacy-functionality trade-off is understood and expected by the users, it woul be used by very few people if it were extremely spartan. (But this instance, the favicon service, is not a good privacy-functionality trade-off)

What would a browser even need a backend for? The only valid use that I can think of is Google's Safe Browsing list, but if ad blocking can be implemented totally on-device, surely that can, too?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#234

Post by reitzensteinm »

hst-m wrote: post #200
st3fan wrote: post #109

Earlier quoted context omitted.

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website yo…

(parent edited comment, can't delete this)

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#235

Post by [deleted] »

hst-m wrote: post #200
st3fan wrote: post #109

Earlier quoted context omitted.

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website yo…

[deleted]

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#236

Post by davidhyde »

Ubiquity did the same thing with their routers. They couldn’t understand why users had such a problem with their phone home feature that was on by default when the purpose of it was to ultimately “improve” the user experience. I didn’t buy their router as a result. I also removed kaspersky from my computer because I didn’t like their phone home feature. Turns out they were selling my data despite holding my trust as a security company. DDG, don’t turn this into a PR nightmare. We don’t trust anyone anymore. Privacy policies are worthless. Nobody cares about favicons anyway.

Source: https://www.theregister.com/2019/11/07/ubiquiti_networks_pho... https://palant.info/2019/08/19/kaspersky-in-the-middle-what-...

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#237

Post by smolder »

hst-m wrote: post #200
st3fan wrote: post #109

Earlier quoted context omitted.

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website yo…

I think you're being downvoted because you chose to piggyback your comment on a seemingly unrelated one at the top, are being vitriolic, and didn't back up your claims with respect to their intent and refusal to change this.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#238

Post by hst-m »

smolder wrote: post #237
hst-m wrote: post #200

Earlier quoted context omitted.

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website yo…

I think you're being downvoted because you chose to piggyback your comment on a seemingly unrelated one at the top, are being vitriolic, and didn't back up your claims with respect to their intent and refusal to change this.

Well it's related because Mozilla actually cares about your privacy vs DuckDuckGo which obviously could care less from their reaction to this issue. Their refusal to change this is all the proof you need to know. I dont even use DDG I use Google I just think its funny they have a "Privacy browser" that sends all the sites you visit back to their servers

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#239

Post by bscphil »

pwdisswordfish2 wrote: post #123
bscphil wrote: post #102

Earlier quoted context omitted.

This is done only for browsers that don't support setting the referrer policy. https://caniuse.com/referrer-policy . It should not be happening with any modern browser, and (like the other reply) I don't see it in mine (Firefox). See here: https://help.duckduckgo.com/results/rduckduckgocom/

Are you saying DDG is forcing you to send a User-Agent header? DDG's privacy policy also goes on about the privacy implications of User-Agent headers combined with IP addresses. So let's say I take what they have put in their privacy policy to heart and I stop sending a User-Agent header. In response DDG sends prefixed result URLs? WTF? Using haproxy, for example, I can use a "modern browser" and send no User-Agent h…

You can disable this on the settings page. Frankly I'd infinitely rather send my request through a redirect served by DDG than send my referer to every site I visit. I think this is a perfectly sensible default for the average user, who both doesn't block / obscure their user agent and doesn't have referer masking software in place.

You're free to disagree, but in that case you can make use of the option to change the default that they provide for you.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#240

Post by franga2000 »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

I'm sorry, but this is bullshit. If the received HTML contains a element, you already only need one request, so this is not an improvement. If that is present, you should NEVER use your API.

If it's not present, then you have options, and yes, using your weird API is an option (which I still don't like, but ok). But sending private information to your servers even when sites follow the standard show either that you're probably not trustworthy, or that your product team is so painfully incompetent that I'd be afraid to use their browser at all.

Post reply on HN