DuckDuckGo browser seemingly sends domains a user visits to DDG servers • Hacker News Board

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#511

Post by chownie » Thu, Jul 02, 2020, 8:22 PM UTC

jiofih wrote: post #497

chownie wrote: post #494

Earlier quoted context omitted.

This is a really strange take. Once people have gone down the avenue of earnestly reporting private information leakage, the correct answer is to investigate. DDG decided not to do this and instead dismissed the problem completely out of hand and ignored it for almost a year without taking any action. No one asked for an apology, they asked DDG to admit fault and then to fix the problem. ie "we shouldn't have done th…

You’re absolutely ignoring the possibility of an argument where there is no fault and this is being blown out of proportion. You just assume your opinion is correct and they owe you to fix it. That is in itself the problem OP was exposing.

Great! Can you provide that argument or am I supposed to think it up myself?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#512

Post by olyjohn » Thu, Jul 02, 2020, 8:38 PM UTC

MfromB123456 wrote: post #402

chrispauley wrote: post #365

Earlier quoted context omitted.

This response validates my trust in DDG as has happened so many times before. Seriously cool company you've built here.

Really, just a response, saying everything is ok, validates your trust? Bought some wirecard stocks latly?

Did you even read the post you replied to?

"...as has happened so many times before."

Clearly it's not just the response.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#513

Post by dng88 » Thu, Jul 02, 2020, 8:51 PM UTC

Is it possible to double check some basic interaction of the searching engine so this kind of mistakes can be avoided. Not just favicon?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#514

Post by ViViDboarder » Thu, Jul 02, 2020, 9:11 PM UTC

NegativeLatency wrote: post #490

pelliphant wrote: post #354

Earlier quoted context omitted.

Thank you, this is the response people here want to hear. And if this gets fixed in a reasonable timeframe, this is just one of those "everyone makes a mistake one in a while"-things, no big deal.

It's fixed: https://github.com/duckduckgo/Android/pull/878/files

Wow. That was really not very complex at all... Did they leave off some capabilities that the server side version performed, it was the complexity overstated?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#515

Post by bangonkeyboard » Thu, Jul 02, 2020, 9:30 PM UTC

ViViDboarder wrote: post #514

NegativeLatency wrote: post #490

Earlier quoted context omitted.

It's fixed: https://github.com/duckduckgo/Android/pull/878/files

Wow. That was really not very complex at all... Did they leave off some capabilities that the server side version performed, it was the complexity overstated?

> Did they leave off some capabilities that the server side version performed, it was the complexity overstated?

The former. This is a quick initial fix that will fail on many sites.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#516

Post by heavyset_go » Thu, Jul 02, 2020, 11:03 PM UTC

slenk wrote: post #505

yoavm wrote: post #302

Earlier quoted context omitted.

Yeah, I would just have to worry about losing all my passwords ever.

It's really easy to back up the server and never lose passwords.

I can attest to this.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#517

Post by seba_dos1 » Thu, Jul 02, 2020, 11:17 PM UTC

sam0x17 wrote: post #504

jiofih wrote: post #500

Earlier quoted context omitted.

Correct me if I’m wrong, but by default DDG uses redirects to prevent leaking your search queries through the referrer, so they already can technically see every URL you visit. Except their whole product and system is designed around protecting privacy and not storing that data. If the favicon endpoint respects the same rules (which it obviously does), it is no different.

Except the favicon thing applies not just to searches on DDG, but every page you visit if you use this browser

Every domain. Still not good, but there's a huge difference.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#518

Post by pkursawe » Fri, Jul 03, 2020, 12:55 AM UTC

MrGilbert wrote: post #299

ricardo81 wrote: post #275

Earlier quoted context omitted.

There are variations of it now due to mobile devices, social sharing etc that may prefer a larger icon. An online favicon generator will create these variations Nonetheless, the browser can see this when parsing the page and choose the appropriate path.

Geez, I've been out of the webdev loop for around 10 years. That's insane.

favicons should be SVGs and done with it. This is really insane!

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#519

Post by taneq » Fri, Jul 03, 2020, 1:55 AM UTC

bluesign wrote: post #371

azalemeth wrote: post #356

Earlier quoted context omitted.

If anything, it's much better than 'no big deal'. It's "We made this design decision, thought you would like it -- we've learnt, changed, and will avoid it later". Can you imagine Google doing something similar? Heck, they're just about to throw the Android rooting community under a hardware-attestation DRM-filled bus.

More like we made a design decision, than someone warned us this is bad for privacy, we ignored, after 1 year it blew up on HN, now we are fixing it.

Could have been quicker but it's still far better than some smarmy non-apology and continuing as usual, which is sadly what we've come to accept. I don't think they've done too poorly.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#520

Post by joveian » Fri, Jul 03, 2020, 2:20 AM UTC

bad_user wrote: post #264

Nextgrid wrote: post #226

Earlier quoted context omitted.

Because it's the easiest (and sometimes only) way to get this functionality on major browsers and browser developers have no plans to implement this functionality natively.

Both Firefox and Chrome have custom search keywords: https://support.mozilla.org/en-US/kb/how-search-from-address... I maintain a set of such keywords in my Firefox, that I use on iOS and Android too. The easiest would be to just use Google btw, as it does a reasonable job to give you the website you're thinking of just by mentioning it in the search query, e.g "Frozen imdb" (though it does a perfect job in this case…

The main issue for me is that they only work in the url bar not the search bar. For the same reason people are upset about the favicon thing I don't want anything (mis)typed in the urlbar to be sent to a search engine. I've failed to find the correct setting to make this happen a few times before but just looked again and setting keyword.enabled to false prevents it from searching from the url bar (the setting is confusing and not related to the search keywords feature).

I did try firefox search keyword anyway once a while ago but it isn't that easy to configure and the setting were lost not too long after I started using it (I don't remember the details but I think my profile was corrupted by ecryptfs and the keywords didn't import to a new profile or something like that). Not importing them isn't a horrible choice (if that is what actually happened) considering there doesn't seem to be an easy way to even list them, but there should at least be a distinct import/export for keywords. The search page of preferences has a keyword field next to search engines but it doesn't seem to actually list them nor can you add a keyword from that page. All in all, it doesn't seem like a feature Mozilla cares about at all, although it would be a nice feature with a bit more work. Use from right click search on text selection would be another thing that would make it much more useful.

I tend to use ! in two circumstances, one as others mentioned when a DDG search didn't return what I wanted (and I am fine with letting DDG know that since it is the exact same search I just searched DDG) and secondly when I am looking for something on a particular site. Some of the second case would be best done via Firefox keyword search but the advantage of DDG is that they have a lot of obvious names going to the obvious place so rare specific searches are much more convenient than doing anything to set up a list. Since I very rarely use such searches, there isn't anything DDG could learn about me from avoiding just those searches going to DDG. OTOH, using site searches more frequently would be a win for privacy.