Duck Duck Go Searches Are Now Externally Anonymous

http://www.gabrielweinberg.com/blog/2010/05/duck-duck-go-searches-are-now-externally-anonymous.html

by phsr • 16 years ago

132 48 16 years ago

lawn• 16 years ago

I love the fast fixes and changes you're giving. As much as I like Google I just can't see them reacting this fast.

pclark• 16 years ago

Google has billions of dollars riding on their search, I'd bet they would react pretty freaking fast if a game changing bug or user concern appeared :)

patio112• 16 years ago

I have every confidence that Google would give any concerns about search every bit of the attentive customer service they are famous for showering their paying customers with.

MikeCapone2• 16 years ago

Thank you, Gabriel.

The way you listen to your users and implement fixes and suggestions quickly is probably almost as important to your success as good search results right now, at least to me. Makes me want to use your site more.

epi0Bauqu12• 16 years ago

You're very welcome. And please do--I need as much help as I can get :) http://duckduckgo.com/spread.html

aplusbi2• 16 years ago

Is there a way to add Duck Duck Go to the firefox search bar? I really like using keywords to launch searches (since I use VIMperator) but I can't seem to add arbitrary keywords to my knowledge.

epi0Bauqu12• 16 years ago

To add it to the search bar, go to http://duckduckgo.com/ or https://duckduckgo.com/ (depending on if you want SSL or not), and click 'Add to Firefox' at the bottom.

To add it to the address bar, type about:config into the address bar, search for keyword.url and then change it to http://duckduckgo.com/?q= (or https://duckduckgo.com/?q= for SSL).

aplusbi2• 16 years ago

This will just replace one of the current searches whereas I want to add one. But I figured it out - in the searchplugins directory in the firefox install are a bunch of xml files. I added a new one with the relevant info and now "duck" is the keyword that maps to a duck duck go search.

sirn• 16 years ago

"To add it to the address bar, type about:config into the address bar, search for keyword.url"

Actually, it's much simpler than that: just right click on the search field and choose "Add a Keyword for this Search…".

nfriedly• 16 years ago

You can also use the search plugin at http://nfriedly.com/stuff/duckduckgoogle/ if you want search suggestions. Note, however, that this kills some of the privacy as it sends your searches to both Google and Duck Duck Go.

w1ntermute• 16 years ago

Try the Add to Search Bar extension: https://addons.mozilla.org/en-US/firefox/addon/3682/

I also use Vimperator, and have a DDG keyword search.

MikeCapone2• 16 years ago

I'll copy here what I wrote on GW's blog:

Thank you for taking the privacy of your users seriously! Most of us aren't spies or Chinese dissidents, but the principle of privacy is very important to me, and I'm glad to see that it is to you too.

mike-cardwell3• 16 years ago

Excellent work. Thank you for taking this problem seriously.

mike-cardwell3• 16 years ago

FYI, https://ddgw.s3.amazonaws.com/external.png is still being loaded direct by s212.css, rather than being proxied via your server. The search term isn't included in the referer though.

epi0Bauqu12• 16 years ago

Good catch :). Will fix!

mike-cardwell3• 16 years ago

I use a Firefox addon called "TamperData". It's really good for stuff like this. I just go to a web page, open TamperData, hit <ctrl>refresh and it will give me a list of all the requests that are made. I can then go and take a look at the full set of HTTP Request and Response headers for each individual request.

It lets you intercept and modify request headers on the fly too. Very useful tool.

aw3c23• 16 years ago

The site now(?) uses some redirection instead of sending me directly to the URL I click on. This screws up copy'n'pasting. I really do not like this.

I found kd=-1 on the params page but that parameter is gone as soon as I enter a new search term.

epi0Bauqu12• 16 years ago

Unless I'm missing something, it shouldn't screw up copy and pasting at all. It's done via JS when you click on the link, but the link itself is the original URL.

You can set the setting indefinitely on the settings page (http://duckduckgo.com/settings.html). To use the URL params to do so, you can add that param to your search bar settings.

aw3c23• 16 years ago

I am using the latest Opera snapshot on Linux. If I rightclick on a link on a result page and copy the link address, I get the redirection link.

The parameters are not "transfered" to another DDG page for me. Eg I manually crafted http://duckduckgo.com/?kf=-1&kz=-1&kd=-1&q=hello... which works great but if I now enter "hello epi0Bauqu" at the site and hit Enter I end up at http://duckduckgo.com/?q=hello+epi0Bauqu&v=

I have cookies disabled, referrers too.

wesley• 16 years ago

What is the big deal with sending the referrer header? It's been common practice for many years. Why the upheaval now? And shouldn't this type of thing be a browser setting instead of a website hack?

jacquesm2• 16 years ago

It's no 'big deal', it's just that people that are not technically oriented don't even realize that it exists.

The problem here is - or rather was - that duckduckgo is differentiating itself from other search engines in a number of ways, and one of the more important ways in which this is done is that at duckduckgo.com you can search for things in the knowledge that they take your privacy seriously and that they will not sell your soul to their highest bidder.

On top of that they try to limit inadvertent exposure of your private information to third parties.

And that's where the problem came from, if you state loud and clear that you are secure, and then you're found to be insecure you have an immediate problem.

So, since duckduckgo.com is setting itself apart from the 'pack' by providing this useful feature and because it is part of their image of being trustworthy they had to address it.

If browser manufacturers would think a bit they would drop the 'Referer' header on https requests, but since it's been there for years now you can expect it to be there for years to come, to step forward and fix it was the right thing to do, and I'm very impressed with the way Gabriel responded to the publicity around the issue and how quick and thoroughly he fixed it.

I wished all companies would be that professional in their dealings with the public.

joeyh2• 16 years ago

Clicking on a search result now redirects through the DDG server.

So, Gabriel, if you woke up tomorrow as your Evil twin, you could do click tracking with no further user-visible change of behavior.

Google used to do stealth click tracking via javascript. I have not kept up with whether they still do, but it was that kind of thing that influenced me to switch to DDG.

epi0Bauqu12• 16 years ago

Maybe I'm missing something here, but I don't see the privacy leak given that I don't know who you are.

joeyh2• 16 years ago

Well, Evil Gabe probably would know who I am based on all the logs of my DDG searches. Adding click tracking to that is just more data. :)

lftl• 16 years ago

This did get me thinking about if there was a way to obscure the referrer without hitting the server side. Apparently in webkit-based browsers if you create an iframe, and inject some javascript to redirect to the desired link from inside the iframe the referrer doesn't get passed. Unfortunately it doesn't work in IE or FF, but I suppose there might be some trick. Quick proof of concept for webkit:

http://junk.wehrenberg.us/t1.html

EDIT: Apparently both FF and IE work fine if you redirect using a meta refresh rather than js from inside the iframe. But that doesn't give you any way to bust out of the iframe.

http://junk.wehrenberg.us/t3.html

u489982• 16 years ago

I did a search and I was served a domain parking Ad as a landing page. WTF am I missing? This search engine looks like a spam to me.and I wouldn't have cared if it hadn't shown up at HN.

epi0Bauqu12• 16 years ago

Sorry to hear that. It generally has less spam, and less parking pages in particular. If you email me your search I would love to look into it. http://duckduckgo.com/feedback.html

u489982• 16 years ago

k, thanks, have added it to the firefox, will give it a try. The first impression was pretty bad with that Ad showing up.

stanleydrew• 16 years ago

"WTF am I missing?"

You've obviously missed a lot of previous HN posts related to the privacy features of DDG, multiple posts from Gabriel's blog concerning the search engine, testimonials from people who have tried DDG for a week and never looked back. Let's just say you're missing a lot.

jacquesm2• 16 years ago

Hey Gabriel,

Fantastic work, a case study in dealing with problems in a product.

If there was a prize for stuff like this you ought to get it :)

freetard2• 16 years ago

People here are probably not going to like this but I will not trust Duck Duck Go until they release their whole source code and allow me to run my own instance. For now, there's still a middle man called Duck Duck Go that I have to blindly trust. I salute his efforts to make his page privacy friendly, but as long as there is a middle man and no one to check his source code to check if he's not sending anything about us, there can't possibly and technically be any guaranteed privacy. Any one who has taken basic cryptography course would agree with that.

epi0Bauqu12• 16 years ago

Would be satisfied by an EFF audit?

freetard2• 16 years ago

Unless they have constant access to your servers to make sure you don't make any changes afterward... But even then, the only way to be sure about one's privacy on the net is to run your own server, no web service can beat that kind of privacy. I personally prefer Google to Duck Duck Go by the way (especially using chromium search feature by pressing TAB) but if I really really cared about privacy to the point of giving up on Google, Duck Duck Go wouldn't be enough, sorry. Good luck though.

tptacek• 16 years ago

Presumably you've sworn off Google, Yahoo, and Microsoft as well, and accomplish Internet search by using a self-hosted copy of ARCHIE.

known• 16 years ago

What's wrong with https://www.google.com

Duck Duck Go Searches Are Now Externally Anonymous

Related Stories