Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

171–180 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#171

Post by couchand »

pwdisswordfish2 wrote: post #117
couchand wrote: post #76

Earlier quoted context omitted.

Unable to reproduce. Links appear to be plain links and no JS intercepts clicks.

To get prefixed result URLs, use GET not POST. Try duckduckgo.com/lite/ and lite.duckduckgo.com/lite/ If I recall correctly there is a way to turn off the prefixed result URLs without having to turn on Javascript, by adding/changing a URL parameter, e.g., kh. However that is not the default setting. Not very friendly toward the privacy-conscious user who has Javascript disabled and does not read HN to find out about…

I'm not sure what you mean by bringing up HTTP method. The two main ways I know to get to the results page are to enter a query into the website or the browser search bar, and both of those seem to issue GET requests. They also both produce real URLs without any intervention. What defaults are different for you than they are for me?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#172

Post by awinter-py »

LeoNatan25 wrote: post #107
awinter-py wrote: post #71

seems like the ticket author found this by reading code (presumably was grepping for duckduckgo.com URLs) this would never happen with a consumer-facing product from apple or google; someone would have to MITM their whole OS to discover phone-home

It actually happens very often. People monitor their networks often, and pay close attention to such problems. Just search for “Apple phone home” and you’ll find many cases where people complain about Apple’s various services making worrying requests.

right sorry -- didn't mean to say that they'd never get caught, rather that you can't read source

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#173

Post by fulafel »

Stevvo wrote: post #39
marcinzm wrote: post #3

This is concerning because it indicates a lack of care in terms of privacy and understanding that the best privacy is achieved by knowing the least. Does this approach permeate their backend as well?

A privacy focused browser shouldn't even have a backend.

I'm not so sure. I think the privacy-functionality trade-off is understood and expected by the users, it woul be used by very few people if it were extremely spartan.

(But this instance, the favicon service, is not a good privacy-functionality trade-off)

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#175

Post by franky47 »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

Is this service open-source and publicly auditable ? Because we've learned not to trust one's word of "don't be evil", only facts matter.

If you say the service is anonymous and does not leak data, prove it.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#176

Post by dabbernaught420 »

hunter2_ wrote: post #147
Thorrez wrote: post #129

Earlier quoted context omitted.

I don't really think is an ad hominem fallacy. An ad homihem fallacy is when you attack the person making an argument rather than the argument. But no one here is attacking the people making the argument. The argument is "Trust DDG". That argument is being attacked as "DDG's founder has done bad stuff in the past, it's likely DDG will do bad stuff, so I won't trust it". That seems to be attacking the argument to me,…

I'm fairly sure that "[you are] a bit silly" is the ad hominem attack, not that calling out the founder is an ad hominem attack.

I meant my comment to read like this:

[My opinion on trusting DDG] - [Reason for my opinion on trusting DDG].[More information about the reason]

In this case, because I don't use the "personal attack" to reach my conclusion that the person was wrong, I don't think it would be a case of argument ad hominem.

But if someone read it like this:

[One reason for my opinion on trusting DDG] - [Another reason for my opinion on trusting DDG].[More information about the second reason]

Then I am using the "personal attack" to reach my conclusion that the person was wrong, so I think it would be a case of argument ad hominem.

My comment wasn't written very well, and I'll try to write better comments in the future. Not that adding an ad hominem to a valid argument makes it invalid, I guess?. But it's still good to avoid fallacies, and to write one's comments so they're likely to be understood the way one meant them.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#177

Post by Thorrez »

hunter2_ wrote: post #147
Thorrez wrote: post #129

Earlier quoted context omitted.

I don't really think is an ad hominem fallacy. An ad homihem fallacy is when you attack the person making an argument rather than the argument. But no one here is attacking the people making the argument. The argument is "Trust DDG". That argument is being attacked as "DDG's founder has done bad stuff in the past, it's likely DDG will do bad stuff, so I won't trust it". That seems to be attacking the argument to me,…

I'm fairly sure that "[you are] a bit silly" is the ad hominem attack, not that calling out the founder is an ad hominem attack.

Ok, but that's pretty irrelevant to the core of dabbernaught420's argument. Focusing on that is kind of pointless.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#178

Post by nexuist »

st3fan wrote: post #109
tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS

What a world class reply. This is what makes open source valuable.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#179

Post by what_ever »

accelbred wrote: post #61
_5vzs wrote: post #51

Earlier quoted context omitted.

Faster + less bloat

Ad blockers' functionality has been limited on chromium due to changes in the extension API, though

I don't think that has taken place yet?

Disc: Googler

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#180

Post by byteshock »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

I’m very disappointed in how you guys responded to this. As a privacy focused company I would not have expected an answer that sounds like it came from a data collecting company like Google.

I just switched to DDG browser a week ago and will now be looking for a new browser now. I hope you know this is not an appropriate response to the situation. Especially because all you guys do is preach about how much you protect your users’ privacy. Now you’re here asking us to trust you not to abuse our data and just linking us your privacy policy. I’m sad to say that my faith in the DuckDuckGo company and team is now lost.

Post reply on HN