DuckDuckGo browser seemingly sends domains a user visits to DDG servers • Hacker News Board

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#461

Post by retpirato » Thu, Jul 02, 2020, 1:53 PM UTC

fooqux wrote: post #453

jsnell wrote: post #421

Earlier quoted context omitted.

Oh, please. There's a million threads on HN complaining about Google and Facebook. Doesn't even matter if they did something, any post will still have those comments. You can't consider the proportionality of the response by just one thread. It's really quite amazing that when a company that's hitched it's brand entirely to privacy first commits a big privacy faux pas, hides it for a year, and then doubles down on it…

>hides it for a year Huh? It's an open source project. Maybe you consider them closing the issue on GH to be "hiding it" but I don't. And the plenty of people talking about it in that thread still apparently don't, either. IMHO their response made sense. You're already trusting DDG with your search history which for most people might as well be a list of 99% of the domains they visit. If you trust their privacy polic…

The point is DDG has insisted that they put privacy first, & don't collect user data, then (supposedly) in the interest of a small performance increase they introduce code that — wait for it — COLLECTS USER DATA. All they would need to do is use {URL}/favicon.ico which most if not sites have. From what I understand according to posts on the github page this could be done on-device so no need for sending anything to a server. Then when the issue was opened it was closed without the issue being fixed.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#462

Post by chrispauley » Thu, Jul 02, 2020, 1:54 PM UTC

MfromB123456 wrote: post #402

chrispauley wrote: post #365

Earlier quoted context omitted.

This response validates my trust in DDG as has happened so many times before. Seriously cool company you've built here.

Really, just a response, saying everything is ok, validates your trust? Bought some wirecard stocks latly?

I will of course be keeping an eye on whether or not they follow through, but the admission of this being a problem and committing to fix it is -far- more than we see from most companies these days. Is it everything I ever could have wanted out of the company? no. However it is a positive direction I would like to see more of so displaying my appreciation is hopefully validation for the company to continue in that direction.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#463

Post by mthoms » Thu, Jul 02, 2020, 2:10 PM UTC

warpspin wrote: post #376

_hl_ wrote: post #369

Earlier quoted context omitted.

I've already posted this somewhere else, but I'll copy it here again as well: It's not immediately obvious whether it is more privacy preserving if the client automatically makes a request to each site in the search results while scrolling through the results, especially since you're already trusting DDG when performing the search. Maybe this should be an opt-in rather than an opt-out feature? All in all its really n…

This was not about search results, where their favicon webservice is in fact privacy increasing, but about the privacy browser and the favicons it displays, where it is privacy decreasing as it involved sending information about visited sites to a central authority while you are not on the DDG search engine. For example the TabRenderer will fetch the favicons from DDG instead of from the site you are actually visitin…

Thanks for pointing out that the service was already in use on their search results pages. To me, this goes a long way toward explaining how this could have happened:

Scenario #1 - "We need to show favicons in our browser tabs. Lets develop an API that requires every domain be sent to us!"

Scenario #2 - "We need to show favicons in our browser tabs. Hey look, we've already got a service that provides this. We know it collects no PII and our users trust it already."

Obviously the second scenario is flawed thinking, because (of course) it's better to not send that info at all. However, I can easily see how their developer(s) may have arrived at the conclusion that this is still compliant with their privacy ethos.

The fact that the favicon service already existed (and was trusted by users) before this was implemented, makes it much easier to understand how this could have been a legitimate mistake and thus, they deserve the benefit of the doubt.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#464

Post by phire » Thu, Jul 02, 2020, 2:13 PM UTC

MfromB123456 wrote: post #399

yegg wrote: post #340

Hi all, Founder and CEO of DuckDuckGo here. I’m literally just waking up and reading the comments here. I’m new to this issue and happy to commit us to move to doing this locally in the browser and will have us move on that ASAP. That said, I want to be clear that we did not and have not collected any personal information here. As other staff have referenced, our services are encrypted and throw away PII like IP addr…

Why do you develop features without considering privacy in the first place? Every developer on earth could have told you, that your favicon service is potentially violating users privacy. One could guess you don't know much about how to keep users privacy. Other guess would be, you implemented this service that way deliberately.

Looks like they developed the favicon service for their search engine so they could show favicons in search results.

It actually increases privacy there, DDG already know what domains your search returnedy and the alternative would be fetching favicons directly from websites, leaking information to them before even clicking.

Then they re-used the favicon service for their browser without rechecking the privacy issue and realising that browsers have different privacy needs.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#465

Post by koheripbal » Thu, Jul 02, 2020, 2:28 PM UTC

warpspin wrote: post #319

throwaway_pdp09 wrote: post #313

There's an interesting disease showing up here in the responses. I accept DDG's statement that this is about a favicon and that they "do not collect or share any personal information", and despite that, I also agree with others that DDG should be on the safe side and just stop doing this small thing. It's just the safer and more moral thing to do (So DDG, as many are suggesting, plz stop doing it. Today is good). But…

I think what angered people was actually that a company saying to hold privacy high was simply refusing to change something after a mistake was pointed out and instead kept on defending it with a technical argument, which makes no sense at all. The reaction would have been actually a lot different if someone from the company admitted the mistake and promised it will be changed. Update: Gabriel Weinberg has promised t…

Read your comment again.

You are faulting someone for defending thier own argument. You suggest that people who do not cow and apologize to the mob deserve the anger and retribution the mob has to offer.

People have a right to think differently and express themselves without threats, bullying, or shaming.

The mob does not deserve apologies. The comment above is spot on - we've lost all sense of proportionality.

It is an indication of the modern online mob sickness that they always demand others beg for forgiveness.

What emotional void are mob participants trying to fill with the apologies of others?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#466

Post by afiori » Thu, Jul 02, 2020, 2:29 PM UTC

marcinzm wrote: post #435

afiori wrote: post #387

Earlier quoted context omitted.

Part of the point is that likely this has zero privacy implications (except potentially disclosing to someone monitoring your traffic that you are using their browser). The mistake is rather an area of improvement where they can change something that respect privacy by policy to something that respect privacy by design.

>Part of the point is that likely this has zero privacy implications (except potentially disclosing to someone monitoring your traffic that you are using their browser). It has zero implications if you trust DDG and good privacy is not based on blind trust. Keep in mind that you also need to trust the government under which DDG acts to not require them to disclose this data, trust the government to not put black boxe…

I agree, I still think it is relevant to treat actual privacy violations differently from engineering choices that might make privacy violations easier in the future.

My opinion is that DDG should have never made this choice in the first place, but as far as I am concerned this is at the level of an implementation detail that can be improved, not as if DDG was intentionally using user data in some non-private way.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#467

Post by niftylettuce » Thu, Jul 02, 2020, 2:31 PM UTC

Gigablah wrote: post #380

niftylettuce wrote: post #80

Earlier quoted context omitted.

Thanks! I'm rolling out the following within probably the next 7 days: - All new load balanced infrastructure - Browser extension + API wrapper - Support for pixel tracking blocker (opt-in checkbox or TXT setting) - Smart alerting - Globby/regex support If you follow my Twitter or the GitHub releases you will get updates.

Do you plan to have an SMTP relay?

Yes, 100%. It is in the works.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#468

Post by marcinzm » Thu, Jul 02, 2020, 2:33 PM UTC

afiori wrote: post #466

marcinzm wrote: post #435

Earlier quoted context omitted.

>Part of the point is that likely this has zero privacy implications (except potentially disclosing to someone monitoring your traffic that you are using their browser). It has zero implications if you trust DDG and good privacy is not based on blind trust. Keep in mind that you also need to trust the government under which DDG acts to not require them to disclose this data, trust the government to not put black boxe…

I agree, I still think it is relevant to treat actual privacy violations differently from engineering choices that might make privacy violations easier in the future. My opinion is that DDG should have never made this choice in the first place, but as far as I am concerned this is at the level of an implementation detail that can be improved, not as if DDG was intentionally using user data in some non-private way.

The concern as I see it is that this issue and the initial DDG response to it shows a lack of understanding of technical privacy controls. What they are and why they matter so much. DDG's backend is not audited and so one wonders if that same lack of understanding applies to the backend as well. DDG cites privacy policies but, in my experience, the best policies are backed with strict technical controls as humans never follow policies perfectly on their own.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#469

Post by WillPostForFood » Thu, Jul 02, 2020, 2:36 PM UTC

marcinzm wrote: post #432

asjw wrote: post #338

Earlier quoted context omitted.

Yeah people burnt witches in the past ... If they are confident that this feature has no privacy implications they are right to defend the point, despite what people say or think People don't run DDG, the company People can use another search engine if they want I'll keep using DDG anyway

DDG can do what they want and people can as a result publicly state their opinions on it. Freedom goes both ways.

You’ve described the race to the bottom we live in. Can we please try and break the cycle?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#470

Post by ajani » Thu, Jul 02, 2020, 2:37 PM UTC

bluesign wrote: post #371

azalemeth wrote: post #356

Earlier quoted context omitted.

If anything, it's much better than 'no big deal'. It's "We made this design decision, thought you would like it -- we've learnt, changed, and will avoid it later". Can you imagine Google doing something similar? Heck, they're just about to throw the Android rooting community under a hardware-attestation DRM-filled bus.

More like we made a design decision, than someone warned us this is bad for privacy, we ignored, after 1 year it blew up on HN, now we are fixing it.

That's exactly right. Don't know why I can't upvote this