Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

521–530 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#521

Post by TheSpiceIsLife »

epi0Bauqu wrote: post #428
worble wrote: post #427

Earlier quoted context omitted.

It's a little confusing to see 2 accounts, with very different usernames (epi0Bauqu and yegg), that appear to be posting as Gabriel Weinberg . Are these both legitimate? And if they are, what's the reason for two of them?

Yeah that's my bad. epi0Bauqu is my original account, but since no one knew who I was under that account I, some years later, made the yegg account and I try to post from there. The issue here is I logged in to post the comment, and then switched to my laptop where I was already logged in this other account.

Have you considered noting this in the user profile data of this HN account, then logging out of this one on your laptop.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#522

Post by warpspin »

mthoms wrote: post #463
warpspin wrote: post #376

Earlier quoted context omitted.

This was not about search results, where their favicon webservice is in fact privacy increasing, but about the privacy browser and the favicons it displays, where it is privacy decreasing as it involved sending information about visited sites to a central authority while you are not on the DDG search engine. For example the TabRenderer will fetch the favicons from DDG instead of from the site you are actually visitin…

Thanks for pointing out that the service was already in use on their search results pages. To me, this goes a long way toward explaining how this could have happened: Scenario #1 - "We need to show favicons in our browser tabs. Lets develop an API that requires every domain be sent to us!" Scenario #2 - "We need to show favicons in our browser tabs. Hey look, we've already got a service that provides this. We know it…

Yes, it is a totally plausible mistake. The fault was "only" ignoring it after it was reported.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#523

Post by [deleted] »

Agentlien wrote: post #363
niftylettuce wrote: post #84

Earlier quoted context omitted.

As I said in other another comment, I'm a power user. And by power user I mean probably 10x the normal standard of what a 10x power user means. Tooling is everything to me; which is why I prefer this over anything else. I'm very biased.

This comment made me smile because it gives me the same absurd vibes as "Impossible Is Nothing". https://en.wikipedia.org/wiki/Impossible_Is_Nothing_(video_r... https://www.youtube.com/watch?v=UGMaVC1YVlQ

[deleted]

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#524

Post by Terretta »

0xfate wrote: post #475
Terretta wrote: post #404

Earlier quoted context omitted.

To be more clear, your staff, and you, have said PII ‘like IP addresses’, and have said ‘thrown away’ some places and ‘not collected’ others. Contrary to this framing, it’s not possible to not incidentally become aware of every single browser users’ usage timing and user IP addresses if the browsers are phoning home this way — a colloquial understanding of ‘collect’, not the James Clapper NSA dodge definition of ‘col…

Just to be fair, as a matter of fact, you surfing that site is revealing you, surfing that site to your ISP and state actors, in the first place. A change, where to get the icon from (origin vs ddg), will not change this fact. It is all about ddg not getting to know, which sites you are surfing, when not searching for it on ddg. Which should, indeed, be a no-brainer.

"You surfing that site" not adding a single surveillance point for every user of a particular browser, it's not compromising your other privacy measures (e.g, VPN that prevents your ISP from knowing) by sending your site surfing data out to that surveillance point, etc.

Getting the icon from each site means surveillance would have to be at origin or every site, while telemetry going to DDG gives a single surveillance point.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#525

Post by boogies »

fredoliveira wrote: post #415
MfromB123456 wrote: post #402

Earlier quoted context omitted.

Really, just a response, saying everything is ok, validates your trust? Bought some wirecard stocks latly?

Creating a throwaway account to disparage a particular point of view is also questionable, no? At what point did we stop taking people's word and commitment as valid? Sure, I too want to see proof that they are doing the right thing here (because I don't understand the design decisions that led to the creation of that service in the first place), but because these changes are not immediate, this statement does at lea…

> At what point did we stop taking people's word and commitment as valid?

At the point that they where caught violating privacy while claiming to respect it, and standing to make a profit off of violating it.

If I trusted people as blindly as people seem to trust DuckDuckGo, I would have trusted Google to not be evil and never have switched to DDG in the first place. This breach of trust destroys the whole point of using it, so I switched my default search to Searx between reading this submission and writing this (had been procrastinating the switch for a while and this was exactly the motivation I needed).

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#526

Post by Angeo34 »

Whoever ever put their trust into American for profit companies which use slogans like "private secure and fast" should not be surprised at leaking all their data.

I never got how people trust companies like ddg or Brave. If you don't trust Google and Apple why would you trust a smaller company in the same jurisdiction. They will be forced to hand out all data as well regardless what they say.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#527

Post by abc-xyz »

kjaftaedi wrote: post #419
abc-xyz wrote: post #203

Earlier quoted context omitted.

Also worth mentioning they're closed-source, US-based and for-profit. Why exactly do people trust them? Simply because they write a few articles/ads saying "privacy is important"? If you're willing to sacrifice search quality for privacy, as in switching from Google to DuckDuckGo, then you might as well take a step further and switch from Google to Searx/Ask.Moe.

Never heard of searx .. attempted to use it. I couldn't figure out which searx instance to use and found no good way of knowing who to trust, most of the engines i used were broken and telling me to find another searx engine. It looks like it's pulling most of its info from duckduckgo anyway. Personally I'd rather trust a known entity than an unknown entity anyday, especially when the unknown entity is slow, complica…

They’re pulling info from all the other search engines, not just DuckDuckGo. FYI DuckDuckGo is also pulling their results from other search engines, the only difference is that DuckDuckGo aren’t being blocked/rate-limited by them, presumably because they’re paying for API access.

If you hosted your own instance then it would be a lot more reliable since the IP wouldn’t send a suspiciously high amount of requests.

As for your trust argument, I couldn’t disagree more. You choose to trust DuckDuckGo, who happens to be closed source, because of their branding. The same way people trust/trusted Google/Apple/etc. because of theirs. This thread is a perfect example why being open source is the most important thing for any privacy service (because otherwise this privacy leak likely wouldn’t have been discovered, and people wouldn’t have known that the company so carelessly violate people’s privacy and fail to correct it when people point it out.. it should really make you wonder what’s happening in the search engines codebase).

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#528

Post by abc-xyz »

leereeves wrote: post #506
abc-xyz wrote: post #252

Earlier quoted context omitted.

Ask.Moe also support bangs (I know !g and !gt works, not sure about scholar). Searx doesn’t but I imagine they’d gladly accept a pull request for it.

I don't know much about those search engines. What's the advantage of Ask.Moe or Searx?

For me the fact that they’re open source. This thread is a prime example of why it’s so important. We really have no idea what DuckDuckGo is doing because they’re closed source. For all we know they could be forwarding users’ IP to Microsoft/Yandex/etc.

If you want to market yourself as a champion of privacy, then the absolute minimum criteria should in my opinion be that your codebase is open source.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#529

Post by wizzwizz4 »

dTal wrote: post #335
st3fan wrote: post #109

Earlier quoted context omitted.

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

Why don't they just take the code from their "internal favicon service"? The whole thing smells.

It's probably not written in Java.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#530

Post by wizzwizz4 »

dvdkhlng wrote: post #285
warpspin wrote: post #269

Earlier quoted context omitted.

In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Pers…

Yes it does not look very GDPR conformant. They may try to argue that the transmission of visited domain names serves a purpose (browser performance) and that the user agreed to that transmission by accepting the TOS etc. However, I think they may be in trouble as consent for data processing under GDPR needs to be given "freely" [1]: "When assessing whether consent is freely given, utmost account shall be taken of wh…

> DDG would need to give users the option to opt-out of the favicon-retrieval,

Wouldn't they need to give users the option to opt-in, under GDPR?

Post reply on HN