Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

291–300 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#291

Post by serverQuestion »

warpspin wrote: post #269
dvdkhlng wrote: post #263

Earlier quoted context omitted.

In germany we have the words "Datensparsamkeit" (data parsimony) and "Datenvermeidung" (data prevention) [1]. Which wikipedia merely translates as "Privacy by design" [2]. DDG is unneccessaryly producing (aggregating), transmitting (and collecting?) very sensitive user data here, which is just the opposite of data protection. I can't even understand why they try to justify their actions. It's like omitting the seat-b…

In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Pers…

Wait what? a TCP request already breaks the GDPR rules? Didn't know that...

Any human readable ways of dealing with that?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#292

Post by leowoo91 »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

favicon has fairly enough known meta tags in case favicon.ico url is lacking

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#293

Post by jeltz »

sillysaurusx wrote: post #281
a3n wrote: post #266

Earlier quoted context omitted.

They've already started down that path, judging by all the DDG billboards I see driving my 18 wheeler around the country, and all the DDG ads I hear on NPR-related podcasts. Not that I'm against making money. But there's a tipping point associated with some height value in a pile of cash, and once you cross that point then the pile controls you. DDG probably hasn't crossed that point yet, but self-justification is on…

Are there really DDG ads on billboards and NPR? That’s cool.

There are ads on billboards here in Sweden.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#295

Post by warpspin »

serverQuestion wrote: post #291
warpspin wrote: post #269

Earlier quoted context omitted.

In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Pers…

Wait what? a TCP request already breaks the GDPR rules? Didn't know that... Any human readable ways of dealing with that?

If it is an unnecessary request to another service, yes.

IP-adddresses are considered personally identifying information. TCP requests transmit IP addresses.

Under the strict interpretation of the GDPR, a lot of things which are common outside the EU might be illegal, like e.g. embedding Google Fonts. To be on the safe side, people usually at least list these external dependencies in their privacy policies to construct some kind of "consent", but till we have more actual court rulings, this is a huge problem area.

For the problem at hand, it is pretty clearly illegal, as it's not only an ip address transmitted, it is a combination of ip address plus visited unrelated domain. This allows the creation of profiles. It does not matter for the GDPR, if the profile is ACTUALLY created, the pure possibility of creating it any time is enough to be a problem.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#296

Post by zzo38computer »

oefrha wrote: post #211
Thorrez wrote: post #125

Earlier quoted context omitted.

> is what google and everyone else says. Do Chrome, Firefox, or Safari do this? I would assume they do it on-device.

Chrome, according to my understanding, hardcodes a few favicon URLs for builtin search engines, and caches everything else on site visit. There's SQLite3 database named Favicons in your profile directory (e.g. on macOS it's ~/Library/Application Support/Google/Chrome/ /Favicons). Here's the schema: CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR); CREATE TABLE icon_mapping(id INTEGER…

I would hope that it can also be made to cache 404 and 410 responses to favicon requests too (or at least 410 even if not 404), so that it won't keep trying to access it.

Also, in SQLite, note that LONGVARCHAR is the same as TEXT, and that you don't need to specify both UNIQUE and PRIMARY KEY (it is redundant), and that if it is not a INTEGER PRIMARY KEY and not WITHOUT ROWID, then it isn't the real primary key but just an index (same as UNIQUE); add WITHOUT ROWID if you want to make it a real primary key, but note that the way the data is stored differs then, and WITHOUT ROWID is inefficient with tables storing large blobs.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#297

Post by bluesign »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Sorry but this is not enough reason. There is a simple question you should ask to yourself.

- Would you be ok to use a third party for this with same privacy policy?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#298

Post by dvdkhlng »

serverQuestion wrote: post #291
warpspin wrote: post #269

Earlier quoted context omitted.

In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Pers…

Wait what? a TCP request already breaks the GDPR rules? Didn't know that... Any human readable ways of dealing with that?

> Wait what? a TCP request already breaks the GDPR rules?

If the TCP request carries personal data like the name of a visited website plus the user's IP address, then it "breaks the GDPR rules" in so far as you now have to fullfil your GDPR transparency/consent etc. duties /before/ sending that request.

Maybe not all website names look like sensitive data to you, but some website visits you surely want to be treated as sensitive, personal data (like names of hospitals, doctors, political parties, religion etc.).

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#299

Post by MrGilbert »

ricardo81 wrote: post #275
MrGilbert wrote: post #256

Earlier quoted context omitted.

Maybe I'm too old for this, but wasn't a favicon supposed to be located at "fancy.url/favicon.ico", or alternatively as a " "? Curious to know why this is an issue.

There are variations of it now due to mobile devices, social sharing etc that may prefer a larger icon. An online favicon generator will create these variations Nonetheless, the browser can see this when parsing the page and choose the appropriate path.

Geez, I've been out of the webdev loop for around 10 years. That's insane.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#300

Post by rawoke083600 »

xchaotic wrote: post #244
ehsankia wrote: post #199

Earlier quoted context omitted.

Fourthed, and honestly it's strange that they are willing their promise to privacy on saving 2-3 queries on something as trivial as favicons? Why does no other browser need to do this?

Favicon what a hill to die on

For the want of an icon, the kingdom was lost !
Post reply on HN