Can someone please explain like I'm five how this line of code sends the domain a user visited to DDG's servers?
DuckDuckGo browser seemingly sends domains a user visits to DDG servers
401–410 of 531 posts
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#402Hi all, Founder and CEO of DuckDuckGo here. I’m literally just waking up and reading the comments here. I’m new to this issue and happy to commit us to move to doing this locally in the browser and will have us move on that ASAP. That said, I want to be clear that we did not and have not collected any personal information here. As other staff have referenced, our services are encrypted and throw away PII like IP addr…
This response validates my trust in DDG as has happened so many times before. Seriously cool company you've built here.
Really, just a response, saying everything is ok, validates your trust? Bought some wirecard stocks latly?
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#403There's an interesting disease showing up here in the responses. I accept DDG's statement that this is about a favicon and that they "do not collect or share any personal information", and despite that, I also agree with others that DDG should be on the safe side and just stop doing this small thing. It's just the safer and more moral thing to do (So DDG, as many are suggesting, plz stop doing it. Today is good). But…
Many argue that "other things are worse". This argument is invalid in my opinion. We're talking about this special case and if people feel like they need to openly show their opinion about it this is okay. Even if the response is big in numbers.
That just shows how much also the small things matter.
If you only care about "the biggest" or "the worst" you'll never get anywhere...
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#404Hi all, Founder and CEO of DuckDuckGo here. I’m literally just waking up and reading the comments here. I’m new to this issue and happy to commit us to move to doing this locally in the browser and will have us move on that ASAP. That said, I want to be clear that we did not and have not collected any personal information here. As other staff have referenced, our services are encrypted and throw away PII like IP addr…
To be more clear, your staff, and you, have said PII ‘like IP addresses’, and have said ‘thrown away’ some places and ‘not collected’ others.
Contrary to this framing, it’s not possible to not incidentally become aware of every single browser users’ usage timing and user IP addresses if the browsers are phoning home this way — a colloquial understanding of ‘collect’, not the James Clapper NSA dodge definition of ‘collect’. Most normals think of collect as become known not as permanently store. You knowing it means others can know it if you break trust or are required to comply with authorities.
And regardless of end-to-end encryption, that this user is phoning home to your fave icon endpoint, when, and from what IP, is revealed to every ISP in the chain. You’re leaking browser usage telemetry to every single party to that traffic — the source IP address PII you mention is in unencrypted metadata.
The fact this browser connects to that endpoint reveals demographics (choice of privacy browser) and behaviors (when and how much web surfing) to e.g. ISP or nation state firewall operators who are certainly not bound by your ‘just trust us’ privacy policy.
Privacy policies are a patch for insufficient privacy engineering.
To be a strong privacy browser you could consider what it would take to be “NSL proof” such that if handed a national security letter with gag order, you cannot comply. That is not the case with this faveicon telemetry endpoint.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#405Earlier quoted context omitted.
Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS
I wonder how many lines of code from big open source applications are generic enough to be reused in other projects. Firefox and Google Chrome probably have the equivalent of many small high quality libraries embedded in them, implementing 'business' logic or protocols, that could be reused in more places. I guess a large scale study on github could be done, with a graph analysis to show potential "cut off" points in…
This is one of the goals of our Android-components project. Take a peek. Many components are reusable across browsers/applications.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#406Earlier quoted context omitted.
but.. that is obvious?!? If I don't want ddg to know what I google, ofc I won't do it by typing in !g in ddg... I actually use bang functions because I want to help ddg out by informing them when I'm unhappy with the results I got from them.
So ... you're expecting them to log your searches for later analysis, or at least meta data about your searches. That's what they promise to not do and the whole point behind many people's decision to use them. And it might be obvious for some, but it still makes no sense :-) given the browser is capable of doing it.
well, this isn't something that I have given that much thought...
But yes, when I go to ddg and type in "!g " after having typed in "", I'm on some level hoping that this is somehow informing ddg that their search results for could be better.
Now, if they have somewhere stated that they are not going to do this, then yes, it would be bad.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#407Earlier quoted context omitted.
Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS
It's not immediately obvious whether it is more privacy preserving if the client automatically makes a request to each site in the search results while scrolling through the results, especially since you're already trusting DDG when performing the search. Maybe this should be an opt-in rather than an opt-out feature? Edit: as pointed out by warpspin in another comment, this is about the DDG Browser, not search result…
Scrolling through results is not a good place to ping websites for their icon. Not from a technical perspective but also not from a privacy perspective.
This is mostly a UX issue IMO.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#408Earlier quoted context omitted.
I think you're being downvoted because you chose to piggyback your comment on a seemingly unrelated one at the top, are being vitriolic, and didn't back up your claims with respect to their intent and refusal to change this.
Well it's related because Mozilla actually cares about your privacy vs DuckDuckGo which obviously could care less from their reaction to this issue. Their refusal to change this is all the proof you need to know. I dont even use DDG I use Google I just think its funny they have a "Privacy browser" that sends all the sites you visit back to their servers
This is nonsense. DDG cares deeply.
We all, including Mozilla!, have made design decisions that in hindsight could have been better.
The important thing here is dialogue and change. And both are happening.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#409Earlier quoted context omitted.
Yeah... the gesture is nice, but good luck extracting any code from a massive project. Might as well say “Here’s some free oil; all you have to do is dig for it.” Unlike oil, this might not be worth the excavation. It’s a bit telling that they linked to the GitHub repositories rather than specific lines of code they were talking about.
Here's their kotlin implemenation, looks fairly straightforward/self-contained: https://github.com/mozilla-mobile/android-components/tree/ma...
Android components is a foundational technology for our browser products on Android but also for many other applications. We’ve designed things in such a way that you can pull in just those things that you need. If that is not the case, file an issue and we will take a look at how to improve things.
Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers
#410Earlier quoted context omitted.
In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Pers…
I think you are being downvoted because your interpretation of GDPR is extremely broad and people disagree with that. I also don't think it's in line with the way it is being applied in practice. Nothing to do with DDG.
I guess I might be one of the few people here who actually have been regulated under the GDPR by a supervising authority.
When that happens, you have to do insanely stupid seeming stuff like explaining in your privacy policy even, why your application, which is clearly for accessing a webservice, actually needs the Android permission to access the internet at all, true story. So I am pretty sure, an app sending visited domains to a central server outside the EU without even a mention of that fact in the privacy policy will cause problems with them, should they ever check the app. Of course, other countries might handle this differently, as Ireland shows.
So whoever thinks my interpretation is overly broad should first have the decency to step forward and actually explain why, instead of hammering a button and second, talk to me again after he had a meeting with the responsible authority and listen to THEIR interpretation of the GDPR ;-)
People should not mistake my interpretation with endorsement of the overly broad text of the GDPR itself.