Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

241–250 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#241
post #79
post #2

Very weak argument for why they do it. Using a service to retrieve a favicon? Surely there's a way to implement the same logic locally.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

Good privacy is not based on trust. Even so, this incident is even less reason to trust you.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#242
post #88

Earlier quoted context omitted.

https://duckduckgo.com/settings#appearance Uncheck the very last option "Site Icons"

This should be the top response. Just under it should be a DDG staffer telling us they will be turning this config option off by default starting with the the next release.

No, since it's incorrect. We're talking about the browser, not the search engine results.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#243
post #200

Earlier quoted context omitted.

They call it the "DuckDuckGo Privacy Browser" yet it sends data back to their servers on every site you visit. Collecting all your search terms and saving them wasn't enough, now they want data on all the sites you visit outside of the DDG search page. That they refuse to turn it off tells you they are just as data-focused as every other company. They should update their app description: "By the way, every website yo…

(parent edited comment, can't delete this)

That bit was unnecessary, and pretty tone-deaf given the current socio-political climate.

So let’s call them out on that, briefly, then get on with the argument.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#244

Earlier quoted context omitted.

thirded. an inconsequential token is not a suitable reason to engage in this kind of data collection, especially for a search tool that prides itself on 'not tracking' users..

Fourthed, and honestly it's strange that they are willing their promise to privacy on saving 2-3 queries on something as trivial as favicons? Why does no other browser need to do this?

Favicon what a hill to die on

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#245
post #79
post #2

Very weak argument for why they do it. Using a service to retrieve a favicon? Surely there's a way to implement the same logic locally.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

I personally believe you, but this approach adds multiple unnecessary trust boundaries. Just thinking about how many separate logs are triggered outside of DDG is troublesome. And what happens when you guys think everything is secure, but one day find out it isn't?

I understand utilizing a single service/feature to accommodate multiple platforms is a big win from a programming standpoint. But if it carries the risk of losing the trust of your user-base while at the same time risks breaking the core mission statement of the business (privacy), it's probably not worth it.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#246
post #7

Nevermind privacy. How are favicons so complicated that they need a special service that understands edge cases. Just do it one standard way and if a minority of websites don't work, then exclude them. We've been through this mess before with all kinds of web standards devolving into mess.

Agreed, creating work arounds for non-standards compliant websites just eliminates the motivation and incentives to be standards compliant in the first place.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#247

Earlier quoted context omitted.

There's always Startpage. You use Startpage; Startpage uses Google for you, with their own user agent - no history, no tracking.

How does that work? What does Google have to gain from it? Google has pretty aggressive anti-scraping protections to protect against this exact behavior, so why would they allow Startpage to get away with it? What does Startpage have to gain from it? Unlike DDG, they don't seem to have any core product, so they fully depend on Google's goodwill which is very shaky grounds when it comes to a long-term business.

What's DDG core product?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#248
post #85

Earlier quoted context omitted.

> Unlike DDG, they don't seem to have any core product, so they fully depend on Google's goodwill which is very shaky grounds when it comes to a long-term business. Isn't that exactly like DDG but Google instead of Bing?

My understanding is that DDG is using Bing results as well as their own. Whether their in-house results can stand on their own is another matter, but at least they're trying to reduce their dependency on Bing, where as Startpage is not.

No, their own crawler is just used for Instant Answers and other widgets.

https://help.duckduckgo.com/duckduckgo-help-pages/results/so...

> We also of course have more traditional links in the search results, which we also source from multiple partners, though most commonly from Bing (and none from Google).

So basically it's all Bing and I see no effort to reduce that dependency as you claim.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#249

Earlier quoted context omitted.

When it comes to a browser, I'm curious as well. I often end up with 100+ tabs in firefox before I close them all. I don't think think I'd consider that being a power user, but would a 10x power user simply mean someone with over 1,000 tabs open? I haven't used Chrome regularly in the last year or so, but it would get noticeably slow by the time I had 3-4 windows with 10-20 tabs each. Firefox hasn't really had that i…

I use Firefox day to day, but if I was a “power user” and picking apart web traffic everyday I’d probably use Chromium. The dev tools in it are way better than the ones built in Firefox.

That's just pure muscle memory. I personally dislike the chrome tools.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#250
post #81

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

> We had already had created this anonymous favicon service for our private search engine.

Which presumably means you've already created the logic for determining favicons. I'm not sure why this couldn't be implemented in the browser.

Post reply on HN