Comment by tombert | Hacker News Reader

Comment by tombert | Hacker News Reader

Parent Full thread

I don't think the parent's comment was that strange of a way of characterizing it.

Yes, they block other tracking scripts, but since they have an explicit exception for tracking from Microsoft, it's not a complete stretch to say they were "tracking for MS"; I know technically it's Microsoft doing the tracking, but DDG gives them explicit permission to do so. I think that it's a distinction without much of a difference, and I don't think it's unfair to extrapolate a bit. If they're being misleading about the types of tracking in their mobile app to make Daddy Microsoft happy, why the fuck would I believe their claims that their search engine (which is more or less a proxy for Bing) would be immune from it?

It actually really upset me; I was a big user and advocate of the DDG browser on iOS and Android, but when that news came out it felt like a big betrayal. I haven't used any DDG product since then, and while I have no idea what kind of trackers they block (if any), I just use Firefox Focus now with Kagi search.

Kagi has its own issues. At least with DDG you could search without logging in and your searches weren't directly tied to your name/address/credit card. Ads are best handled with ad blockers anyway.

This rando's comments (https://old.reddit.com/r/privacy/comments/1bmubkd/thoughts_a...) on the filter bubble problem seems like a reasonable concern too. It's best for a search engine to know nothing about you and just provide the best results for what you asked, not what it thinks you want to hear.

The privacy vs. anonymous thing is fair, and I have some issues with that, and I wish it were a bit more clear on what exactly that means. Even if Vlad's example of "parents knowing what you're doing but still respecting privacy" thing is true, it's not like I want my parents know I'm looking at porn, even if they don't know what kind of porn I'm looking at. That's something that they should address.

I still trust Kagi more than basically any free service though. There's no ads, and since they charge for search they at least have a means of making money that doesn't involve selling my data. Even if Kagi knows what I'm doing, I'm willing to accept that they're not dispensing my data quite as liberally as Google and Microsoft (and apparently DDG).

> I still trust Kagi more than basically any free service though

Please don’t. Just look at the paid services/products around you. Don’t give more PII to a browser vendor than is necessary.

Well I don't use the Kagi Orion browser at all, I use IceCat on all my PC stuff, and Firefox on mobile.

I do generally agree with your broader point, however in 2024 I don't think it's realistic to stop utilizing search engines while not inadvertently giving up PII. I mean, I could, but I do think my life would be considerably worse.

At least with Kagi, they have some means of making money that doesn't involve selling data. It's entirely possible that they betray us and start selling our data anyway, I'm not completely naive, but at least it's not an inevitability like with ostensibly free services.

>why the fuck would I believe their claims that their search engine (which is more or less a proxy for Bing) would be immune from it?

The context of the news was a security researcher conducting an audit of the app. If DDG were, as the GP claimed, performing tracking on behalf of MS then it would be more concerning since there is a difference between performing tracking on behalf of a third-party company and merely excluding them from being blocked via a content blocker that most mobile browsers lack anyway.

A mobile app has much more freedom to do what it likes so if this was the worst that occurred in an audit I'm not of the opinion this mark against them is enough to change my use of them. Many things carry some compromise so one has to weigh if an alternative is better. Use of Firefox by default has Mozilla tracking (hence why some mobile forks exists, including one I use), analytics for sponsored links, non-disableable domain name auto-completion by partners, while use of Kagi search is directly tied to an IRL identity via payment.

For me, I'm comfortable using uBlock Origin on both Desktop and Mobile (via a Firefox fork) unless more egregious facts present themselves.

> The context of the news was a security researcher conducting an audit of the app. If DDG were, as the GP claimed, performing tracking on behalf of MS then it would be more concerning since there is a difference between performing tracking on behalf of a third-party company and merely excluding them from being blocked via a content blocker that most mobile browsers lack anyway.

Sorry, I'm still not entirely sure that I agree that this doesn't count as tracking on behalf of Microsoft. If their browser has an "if MSTracker then allow else doNotAllow", that still seems like it's effectively endorsing MS tracking.

That said, I agree with your criticisms on Kagi (as outlined in sister thread). It would be ideal if Kagi had some means of truly decoupling searches from accounts, but as I stated, at least Kagi charges a fee so they have a means of making money without mining and selling data.

Which Firefox fork do you use? Does it work on iPhone? I would really prefer to use something that allows me to install extensions like uBlock.

> Which Firefox fork do you use? Does it work on iPhone?

I use Fennec, which afaict is Android only. It's my understanding it removed various Mozilla analytics though some is said to remain. It's compiled independently from source by F-Droid, which supports reproducible builds.

Primary reasons I use it is for enabling about:config editing out of the box and third party addons (either Mozilla-approved ones like uBlock Origin or any arbitrary addons so long as they're in an addon 'collection', following the same procedure like Firefox Nightly until Mozilla fulfils their goal of easier addon support).

Yeah, doesn't appear to support iOS, at least not in the app store.

Once Alt stores show up in the US I suspect we'll get a lot more of these browsers showing up on iPhone. My last experience with Android was awful so I went crawling back to iOS, but I think that I just got a bad physical unit more than anything else.

I did see that Kagi's Orion browser allows you to install extensions, though I had issues with stability when I tried it a year ago, but a lot can change in a year so I should probably give it again.

> It would be ideal if Kagi had some means of truly decoupling searches from accounts

Important to note is that Kagi does not associate searches with an account to begin with, nor there are any incentives for Kagi to do so (search log would be just a giant liability from a standpoint of Kagi's business model, with no benefit).

I think what you mean is - are there means to make that provable from a technology standpoint? It turns out there are, through something called blind tokens, and we are looking into it. It is being discussed in Kagi forums here: https://kagifeedback.org/d/653-completely-anonymous-searches...

Another solution available right now in Kagi is paying for the service with Bitcoin/Lightning and using a random email address to sign up (Kagi does not need or verify email addresses, they are just a login id and can be anything).

> I think what you mean is - are there means to make that provable from a technology standpoint?

Yes that is what I meant. I do genuinely believe you when you say that the searches aren't correlated to the accounts, but the problem is that it's difficult to know for sure if that's actually true; how many cases in tech have we thought something was "private" and it turned out that they were vending our data out to the highest bidder?

As long as Kagi doesn't start serving targeted ads, I am personally willing to trust it (as I have for the last year and a half), though I am super interested in the blind token thing you linked.

Reply on news.ycombinator.com