Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

391–400 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#391

Post by [deleted] »

robertlagrant wrote: post #390
throwaway_pdp09 wrote: post #342

Earlier quoted context omitted.

Google: stripmines everything. Would collect your soul if it could[0]. DDG: favicon fuckup. And you can't see the difference? > Why use DDG at all, if they're not safely protecting your private data 100%? Says the man who's willingly chosen to spunk his real name, the company he works for, his position within said company, his photograph and I'm sure I could find much else besides, over the web. Then asks for 100% pr…

This isn't just a mistake. They're saying it's not a problem. Do you agree with that? If not, you're arguing with the wrong person.

[deleted]

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#392

Post by raziel2p »

hanspeter wrote: post #324
throwaway_pdp09 wrote: post #313

There's an interesting disease showing up here in the responses. I accept DDG's statement that this is about a favicon and that they "do not collect or share any personal information", and despite that, I also agree with others that DDG should be on the safe side and just stop doing this small thing. It's just the safer and more moral thing to do (So DDG, as many are suggesting, plz stop doing it. Today is good). But…

> ignoring the genuinely huger issue of the amount of info and mining that google By using DuckDuckGo you're doing the opposite of ignoring privacy issues in Google products. And hence the reaction. Why use DDG at all, if they're not safely protecting your private data 100%?

You're okay with them having data on what you're searching for, but them potentially having data on the domains you're visiting from those search pages is where you draw the line?

I mean, I agree with the principle of storing as little data as possible but this isn't a huge deal in my eyes.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#393

Post by bad_user »

pelliphant wrote: post #359
bad_user wrote: post #220

Speaking of leaks, I never understood why people use DDG's bangs. By using bangs you're sending your search history to DDG even when using search engines that aren't DDG.

but.. that is obvious?!? If I don't want ddg to know what I google, ofc I won't do it by typing in !g in ddg... I actually use bang functions because I want to help ddg out by informing them when I'm unhappy with the results I got from them.

So ... you're expecting them to log your searches for later analysis, or at least meta data about your searches.

That's what they promise to not do and the whole point behind many people's decision to use them.

And it might be obvious for some, but it still makes no sense :-) given the browser is capable of doing it.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#394

Post by hanspeter »

throwaway_pdp09 wrote: post #342
hanspeter wrote: post #324

Earlier quoted context omitted.

> ignoring the genuinely huger issue of the amount of info and mining that google By using DuckDuckGo you're doing the opposite of ignoring privacy issues in Google products. And hence the reaction. Why use DDG at all, if they're not safely protecting your private data 100%?

Google: stripmines everything. Would collect your soul if it could[0]. DDG: favicon fuckup. And you can't see the difference? > Why use DDG at all, if they're not safely protecting your private data 100%? Says the man who's willingly chosen to spunk his real name, the company he works for, his position within said company, his photograph and I'm sure I could find much else besides, over the web. Then asks for 100% pr…

I don't know how the rules are here about getting personal, but aside from making other users be uncomfortable you're missing the point completely.

I don't personally feel a need for a high level of privacy, but I can understand other people who do. And if they are using DuckDuckGo for that purpose, this issue would seem like a big thing. If you served a dish for a vegan with 5 % meat in it, you wouldn't justify it by comparing to the amount of meat in non-vegan dishes.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#395

Post by bad_user »

jhasse wrote: post #318
bad_user wrote: post #215

Earlier quoted context omitted.

And how would they get the "batch of favicons" in the first place?

When there's a miss, send the domain to the server so that it can fill the cache. You probably won't even have to do that as DDG could have already filled the cache with their search results.

OK, at what point does it become complicated enough to just implement that shit client side? :-)

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#396

Post by SahAssar »

tagawa wrote: post #79
tananaev wrote: post #2

Very weak argument for why they do it. Using a service to retrieve a favicon? Surely there's a way to implement the same logic locally.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

What do you mean by "end-to-end encrypted"? Isn't this just a request to your service that will then go out and fetch the icon from the site, so it can't be e2e since you need to know which site to request the icon from.

Why use that term when it clearly can't be true or even seems applicable/relevant?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#397

Post by olafure »

I think we're due a full disclosure on this favicon service, what information is collected and what is stored.

DDG has repeatedly said that they have "not collected any personal information".

For example,

1. Does the service store the fact that it got a request for a domain?

2. Does it store any ID along with that information and if so, how unique is that ID? How is it generated and what is it linked to?

3. What other information is stored along with the request?

4. How does DDG process this information?

5. Who has or can get access to this information?

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#398

Post by warpspin »

afiori wrote: post #372
warpspin wrote: post #295

Earlier quoted context omitted.

If it is an unnecessary request to another service, yes. IP-adddresses are considered personally identifying information. TCP requests transmit IP addresses. Under the strict interpretation of the GDPR, a lot of things which are common outside the EU might be illegal, like e.g. embedding Google Fonts. To be on the safe side, people usually at least list these external dependencies in their privacy policies to constru…

I don't think this is an accurate way to analyze GDPR compliance. As the staffer points out this favicon service follows their own privacy policy, if by this policy they keep (or analyze, sell, distribute, etc.) no data on your use of the service then there is nothing of interest for the GDPR. They might have to prove that their privacy policy is indeed GDPR conformant and that their service works as advertised, but…

It's not as simple as that.

Art. 4 GDPR (1) clearly makes the (ip-address, visited domain) tuple personal data Art. 4 GDPR (2) defines "processing" data, and the pure "collecting" of data, even if immediately thrown away, is usually already considered "processing", therefore the GDPR applies.

If you are doubting this, just for a moment imagine, instead of the visited domain they would have sent all form data, including for example credit card data, you entered somewhere on a third party webpage to their central server and did not mention the fact in their privacy policy.

Do you really think then there is "nothing of interest for the GDPR" just because they do not actually permanently record that information? It would clearly be a violation. But to the GDPR, the importance of that data is equal. In fact, the domainnames might actually be more important to the law, as article 9 establishes event stricter rules for "sensitive" data about e.g. health or sex life of a person, and the domainnames might just leak that information.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#399

Post by MfromB123456 »

yegg wrote: post #340

Hi all, Founder and CEO of DuckDuckGo here. I’m literally just waking up and reading the comments here. I’m new to this issue and happy to commit us to move to doing this locally in the browser and will have us move on that ASAP. That said, I want to be clear that we did not and have not collected any personal information here. As other staff have referenced, our services are encrypted and throw away PII like IP addr…

Why do you develop features without considering privacy in the first place? Every developer on earth could have told you, that your favicon service is potentially violating users privacy. One could guess you don't know much about how to keep users privacy. Other guess would be, you implemented this service that way deliberately.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#400

Post by jariel »

nsomaru wrote: post #331
throwaway_pdp09 wrote: post #313

There's an interesting disease showing up here in the responses. I accept DDG's statement that this is about a favicon and that they "do not collect or share any personal information", and despite that, I also agree with others that DDG should be on the safe side and just stop doing this small thing. It's just the safer and more moral thing to do (So DDG, as many are suggesting, plz stop doing it. Today is good). But…

Google don’t sell privacy. Anyways, what’s this got to do with Google? “Privacy browser violates basic privacy to do something useless” is actually ridiculous. And the response is even more ridiculous! How does literally every single other browser do it? I’m disappointed because I put my reputation on the line to recommend DDG to users based on...privacy. But here we see they actually do not hold true to their stated…

"Google don’t sell privacy."

What does DDG 'sell'?

Which is to say, how much have you paid them?

If you're not paying for it, then you are the product, that's the inevitable trade. There is no free lunch.

Post reply on HN