DuckDuckGo Tests How Much People Care About Privacy | Hacker News Reader

DuckDuckGo Tests How Much People Care About Privacy

nytimes.com

65 pointsbookofjoe68 comments

DDG is simply awesome. I like to see the world as it is, not as some corporation thinks I like to see it as.

Also, as comments do point out. No point using DDG on Chrome. One has to switch to FF - which is seriously fast enough for my daily needs, both on ubuntu and android.

Finally, there's still two things we need to break free form tracking services.

1. A non google play store smart phone.

2. Get off gmail.

I am failing on both of the above.

"I like to see the world as it is, not as some corporation thinks I like to see it as". You realise that DDG uses Bing results, right?

I am just counting on them not personalising my search results based on whatever data about me they have access to.

If they don't personalise then they essentially don't "color my world view".

I know google has a similar option, but I think some of us have stopped trusting them.

> 2. Get off gmail.

What keeps you sticking to this? I read this often and can only wonder why.

A TLD + 50 GB webspace costs you around 2 Euro/month here in Germany and you have full control over your mail. I also find that it creates a sense of importance and seriousnesses (like in "cares about his/her communication"), if you use your own domain for mails. As long as it's not something like "hello@cuntdestroyer69.mail", obviously.

Most automatic spam filters work quite well and can also be trained, if not your client is doing the filtering. And some hosters also provide catch-all addresses which are great for seeing who misuses your mail address.

All in all, I never understood the attractiveness of Gmail, when using your own mail is so easy.

This would give insight into why self-hosting email is becoming a more difficult task.[1]

[1] https://news.ycombinator.com/item?id=19756125

Then let's break Google by not obliging to their "standards" and using their systems. Help other people to use something different than GMail and so on.

Man, I have been struggling to find a good domain to use for months. I have a custom domain already but don't use it for everything. Ideally, I would like to have one that is

- fairly short

- .com

- unambiguous when written with a pen on forms

- easy to spell on the phone

It's the last 3 I find important for an official domain. gmail for example is easy to mention on the phone as everyone knows it. I always have to repeat my fastmail address 3 times and spell it out as people don't know it.

fastmail has a bunch of domains you can use besides fastmail.com! letterboxes.org is a personal fav. (though I often give out my pobox email because - it's so easy to say P O box.com to people!

I'm using a combination of three letters from my first and my last name. For you it could be "cliste.com" (taken in this case), maybe this works with your real name. This concept is also fairly easy to explain on the phone, at least I found it to be.

But the .com space is probably more crowded than .de in my case, so you might not find it so easy to get a nice URL.

If you care about security, you should really think how professional a 2€/month hosting provider can be.

Security and sysadmin expertise is not free.

Same thing with hosting your own. Just start mapping the potential vulnerabilities. Starting for example from simple social engineering attacks against your domain registrant or hosting provider to take over your domain/servers.

Webhosters are providing the same service with standardized configs, and no option to diverge from it, to thousands of users. Economies of scale.

And any professional webhosting provider won't do worse than Google, just on a smaller scale.

> If you call up DuckDuckGo on the Chrome browser, for example, Google is still logging your search queries.

Surely not. A quick search (using Duck, obviously) gives me nothing. Anyone know what this is about?

If true, Chrome—currently my 3rd fallback browser behind Safari and Firefox—is being removed this afternoon.

I would love to know this because then Chrome is being booted too. I didn't sign up for them to be so invasive.

Are you logged into Chrome? Then your search history and open tabs are associated with your google account.

In the sense that Chrome logs and syncs your browser history across all devices logged into your account, the search queries are plaintext, so google can probably read them.

Basically I left chrome when they made it annoying to use it without being logged in to the browser (Why would I want to be logged into a web browser?)

I am not logged in to Chrome.

The above mentioned privacy issue with DuckDuckGo exists whether you are logged in or not into Chrome.

1. By default DDG keeps your query in URL (for example duckduckgo.com/?q=blue+widgets) so that exposes your DDG searches to Google through Chrome

2. Whatever browser you use, if anyone accessed your browsing history they would know exactly what you searched for

These can be changed in DDG settings by changing requests from GET to POST but there is probably lack of awareness among users who come to DDG because of the whole 'privacy' thing. More on DDG privacy issues https://choosetoencrypt.com/search-engines/duckduckgos-bigge...

But nobody yet has confirmed this issue. It's been mentioned but without any supporting evidence.

Does anyone have a link or other evidence that definitively shows that Chrome sends my browsing history to Google independently of my signed-in status? That's what was implied. That's what I find hard to believe. That's what has not yet been demonstrated in this thread.

No problem! We'll just check the source code for Chrome.

...

Ah. We can't. Chrome is closed-source, because Google wants to... Say, why is Chrome closed-source? What do Google add to Chromium that they don't want you to see?

Point well made, but my question stands! If the OP's allegation is true, someone has sniffed the packets. There's a blog post somewhere. There's something.

I just want that something here, for the record. As it stands, I am dismissing the allegation as baseless. I'm not sticking up for Chrome, which I do not trust, but this allegation has no evidence.

The local privacy of GET vs POST for submitting a query is a super cool distinction to point out, thanks

I went looking for this setting in DDG because I didn't understand you at first, but you're saying that DuckDuckGo could change their website to hide the query in a request body instead of the querystring, not that its a user-accessible feature, right?

Why would you need to be logged in? I'd wager that logging in simply makes the history available to you across devices. Google knows which device made the queries and knows you use the device, even without any further analysis it's a good bet you made the search.

I use an application level firewall to block Chrome's outgoing connections and it took a lot of effort to get the ruleset right, even now I'm not sure it is.

Which is why I use other browsers ;-)

How did you block outgoing connections without breaking web browsing?

Trial and error. I got a list of Google's IP ranges (using something like the technique in [1]) and input them into the app layer firewall and tried browsing using Chrome and nothing broke, but that's because when I use Chrome I don't browse to any Google sites.

I use uMatrix on my main browser and I'm well used to breaking sites, I suppose it's increased my patience for refreshing pages until I find the magic minimum for them to work.

I almost always have to turn off all kinds of blocking when doing a payment though, especially anything involving redirects, like plane tickets. Javascript is the biggest pain, IMO, next would be sites that use Recaptcha.

[1] https://snurps.blogspot.com/2013/10/how-many-ip-addresses-do...

It's got into a point where I just assume Google would do x thing against my privacy if it can.

What I do to keep Chrome but ditch Google's anti-features is lockdown requests to Google domains with Little Snitch by Chrome.

I believe you could do something similar with LuLu by ObjectiveSee if you don't want to pay for Little Snitch.

This is just a hack, not areal solution.

Google could introduce a new domain or use something you could not block (cloudflare?) and you are toasted.

I am a DDG user for 4 years or so, and had very few quality problems. When I am not happy with results, I check Google, too. Most of the time, though, Google returns similar results.

I hope to get here. I've been using DDG since the start of the year, and I'm thinking of switching back to Google. The results for me are off the mark to such a degree that I use the `!g` more times than not. Even if DDG has the result on the first page, it's never at the top like Google often is.

Using DuckDuckGo is pleasant in ways that Google just isn't, but can be easy to forget.

I'm reminded every time I somehow default to Google by mistake (using different browser or PC, for example) and am hit with one of those "Before you go!.. some bright colours and dark patterns which we hope will shield us from GDPR" modals.*

It's just such a nice break from what the internet has become, like booting into Linux and simply not having that general feeling that everything you touch is out to screw you somehow to squeeze just a little more value out of the interaction.

No modals, no overlays, no cookie warnings, no needing to save cookies to avoid cookie warnings which have already been acknowledged. So refreshing.

Their branding and message is so on-point that after a while of using their search, a journey into chrome/Google feels almost seedy, like downloading a "Best Free Calculator/Flashlight App" from the android play store, or browsing sourceforge a few years ago.

*As a sidenote, I'd love to see the statistics of people who immediately stop and bounce to DDG when presented with one of those.

My wife ordered pizza today and less than a minute later I got an unusual ad for panago pizza in YouTube. I’ve never seen a pizza ad before. I use a VPN and she doesn’t, but it still figures out we live together and connected the dots

I see this get discussed all the time and have always meant to flag it.

I have spent a lot of time deep in ad tech and a ton of time specifically thinking about identity resolution for ads - i have never seen a DSP make a conscious effort to do "target every cookie that belongs to a specific IP address" as a default rule (or even an option) but I see DSPs automatically opting in to the Liveramp cross device map - is this what causes this behaviour? I am even skeptical that Liveramp can robustly provide this data at scale and fast enough, so I wonder if its almost alway coincidence?

"target every cookie that belongs to a specific IP address"

That shouldn't work if the GP uses a VPN, as theg'd have a perceivably different IP address.

More likely they are logged into youtube, and their account has been associated with their girlfriend's account (location data from gmail/android phones/maps/etc, probably not using the VPN 24/7, etc)

How is it correlating that two devices on different networks (as far as it can see) are in the same house? I can understand device-level fingerprinting associating device@vpn <-> device@office, but I'm not seeing where deviceA@vpn <-> deviceB@home have anything in common to tie them together.

"Hey honey, wanna order pizza?" ... and one Android device listens....

Bluetooth. Device A and Device B can see eachother, occassionally throughout the day, via bluetooth. An app using either the Google or Criteo Framework records these and through knowing that one devices has VPN on, knows that it's endpoint is likely not real and assigns the two devices together.

Even better, thanks to criteo's bluetooth beacon service, if you go to pick up your pizza, they will know you bought it and can present you with further ads from that specific pizza chain.

If you think Criteo isn't doing that, you should check out their marketing material.

A simpler explanation is both devices have location services on, or are on the same WiFi network (same SSID).

Criteo's framework relies on Bluetooth more than Wifi IIRC. They love telling you about how accurate their bluetooth beacons are.

This is true and the reason I register all my Bluetooth devices while on business trips.

Typically on a busy train or plane

Spooooky!

My problem has been DDG consistently produces worse results than google for many/most of my searches. It's often sufficient, but often it is so bad I have to redo the search in google :-/

I really want to use DDG over google, but it's just not there for me yet.

I’ve been using DSG exclusively for about a year now and I've had the opposite experience: I've been amazed at how relevant the results have been. Occasionally, when struggling to find something, I'll use Google (via !g) and the results are, more often than not, mostly the same. It's rare for me to use Google search these days and when I do I'm annoyed by the assumptions it makes about my queries.

Fellow DDG user, but your observation about Google Searches is interesting... It may be the case that your limited use of Google is contributing to the poor assumptions it makes about your queries. The more Google tracks you, the better it can anticipate your intent.

Of course this is at the expense of privacy, filter bubble, etc. Still funny to think that Google may be over-optimizing around the presumption of an available browsing history. If true, Google could very well be degrading the anonymized experience on its sites. Could backfire in a more privacy-conscious future...

I agree with this, especially for long tail terms but I also think it is getting better with time. If it helps, you can use !g to search with Google.

I've found better success with DDG if I give it keywords instead of questions. Over the years I think I've stopped viewing Google as a web search engine and started treating it as a "type any question and get an answer" service.

One could argue that the underlying goal of searching the web is to get an answer to a question, but one of these services is much better at taking a question and turning it into a result than the other. DDG feels like early/mid 2000s Google. Type keywords that you hope to find in close relation to each other on pages across the web. Meanwhile, Google has become _terrible_ at that. It tries to figure out what you want with such vigor it ends up ignoring parts of your query. In that regard DDG has been a better service for me.

Every now and then I won't find what I want and I'll throw a !g on the end of my query to Google it instead. Can't win 'em all. I'm just glad they're trying.

Instead of !g, try !s for Startpage, a proxied Google.

Google is definitely better, but DDG is good enough most of the time, and it has !g for when it isn't.

The only way it's going to get there is if you keep feeding it. Much like Google :)

I find that if DDG isn't giving me good results - which it's true, it doesn't always - then I fallback to Startpage. Between the pair of them I only miss Google's Book service, so when I need it I go straight to it.

If only I could wean my friends and family off of Gmail, Chrome and Google Maps…

I find OsmAnd is generally a decent alterative to Google Maps, and actually it has better mapping of walking routes. Google Maps is better for transit directions and finding businesses - I haven't found good alternatives there yet.

It's the same for me, maybe worse because I do many search in Italian.

I'm currently using Startpage for this reason.

I have the same problem, DDG seems to be sufficient but only for a niche of search results: mostly related to technology or technical searches or searches related to the US/websites in English.

As soon as you try to search something non technical or something local (non-US) the quality of search results drops significantly.

I've been using DDG for quite a few years now. At first, I would !g to Google pretty often, but these days it's pretty rare I feel the need, and when I do, Google is no better. I'm not sure if this is because Google no longer has enough information to tailor searches to me (seems unlikely), or DDG got better, or whether it's just that I've got better at expressing my searches in a form that works well on DDG. I'm not quite sure what I'm doing differently, but I'm sure that after several years how I express searches probably has changed a little.

OT (but not really): putting DDG into Google Image Search first shows DuckDuckGo about 2/3 of the way down the page: https://www.google.com/search?newwindow=1&hl=en&tbm=isch&sou...

Putting DDG into DDG Image Search yields nothing but pictures of U.S.N. destroyers: https://duckduckgo.com/?q=DDG&t=h_&iax=images&ia=images&iai=...

I've loved DDG forever, used it since 2010 I think.

A while ago, i needed to search something from the cli with w3m, ddg wouldn't work without JS so I had to use google.

That commentary aside, search engines make a big chunk of their revenue on prioritizing results and making sure the search term is relevant. Why can't the index be exposed as an api to allow arbitrary front ends?

>A while ago, i needed to search something from the cli with w3m, ddg wouldn't work without JS so I had to use google.

https://help.duckduckgo.com/duckduckgo-help-pages/features/n...

Thanks!

Google and Microsoft do expose their indexes as APIs both called Custom Search. There just isn't much demand for a frontend, because in exchange for not having monetization glued on they charge half a cent per query.

Huh, maybe I'll look into that for my own search needs. If the whole issue is people aren't paying, and this comes without all the other strings, it'd be worth it.

Surfraw supports ddg.

    surfraw duckduckgo search for this

my situation: i would like to move on from google but can't.

1. google maps is my number 1 maps app. i post reviews, i search for restaurants, i book hotels. basically gmaps is my gateway to the real world.

2. gmail is my number 1 email app. i've got over 10 accounts in there, both corporate and personal. custom labels, filters and haven't gotten spam in a decade.

2. google search still produces the best results. this is because of them knowing everything about me. DDG on the other hand produces horrible results for me; they don't do tracking so it doesn't know anything about me. and i need them to have context.

3. Firefox on macos is... not good to say the least. especially compared to chrome on macos.

any ideas on this? are there any proper blows-your-mind kind of alternatives or am I stuck?

For search, perhaps you just need to spend a little while with DuckDuckGo to learn what you need to type in to get the results you are looking for. If you stay logged into Google, then when you can't find what you're looking for on DDG, add !g to your query and it'll take you to Google. The point is you can switch gradually.

that's a very good suggestion. thank you!

3. I use Firefox all day every day on my mac(s) and have absolutely no problem with it. What problems do you have?

page rendering, js performance, ram usage.

Is your machine very old by any chance? Although, that said, I have no problems on a 2013 MBP.

I still use a 2012 MB Air as my home laptop. I've used Firefox on it forever and have never had a problem.

I understand google maps and search.

Email you can replace but it wont be free - both setting up and paying for the service.

Firefox on mac is just fine. I wonder what is so big difference. I work daily with all Firefox, Chrome and Safari - safari is by far worst (except battery drain), chrome / firefox are mostly identical to me. FF has some things i use like containers. Chrome has devtools i am more used too but FF devtools are different and good for some things. I am not sure if chrome is faster maybe its not noticeable to me. What i have noticed if i have many tabs open FF is less memory hungry and more consistent but then again 40 tabs are probably bad habit.

Reply on news.ycombinator.com