DuckDuckGo browser seemingly sends domains a user visits to DDG servers

Re:DuckDuckGo browser seemingly sends domains a user visits ... by warpspin on Thursday July 02, 2020 @06:24AM (#23711757)

This was not about search results, where their favicon webservice is in fact privacy increasing, but about the privacy browser and the favicons it displays, where it is privacy decreasing as it involved sending information about visited sites to a central authority while you are not on the DDG search engine. For example the TabRenderer will fetch the favicons from DDG instead of from the site you are actually visiting: https://github.com/duckduckgo/Android/blob/db728523240e37727...

Anyway, great decision by Gabriel.

[ Parent | on HN ]

Re:DuckDuckGo browser seemingly sends domains a user visits ... by mthoms on Thursday July 02, 2020 @10:10AM (#23713260)

Thanks for pointing out that the service was already in use on their search results pages. To me, this goes a long way toward explaining how this could have happened:

Scenario #1 - "We need to show favicons in our browser tabs. Lets develop an API that requires every domain be sent to us!"

Scenario #2 - "We need to show favicons in our browser tabs. Hey look, we've already got a service that provides this. We know it collects no PII and our users trust it already."

Obviously the second scenario is flawed thinking, because (of course) it's better to not send that info at all. However, I can easily see how their developer(s) may have arrived at the conclusion that this is still compliant with their privacy ethos.

The fact that the favicon service already existed (and was trusted by users) before this was implemented, makes it much easier to understand how this could have been a legitimate mistake and thus, they deserve the benefit of the doubt.

[ Parent | on HN ]

Re:DuckDuckGo browser seemingly sends domains a user visits ... by warpspin on Friday July 03, 2020 @02:19AM (#23721497)

Yes, it is a totally plausible mistake. The fault was "only" ignoring it after it was reported.

[ Parent | on HN ]

Re:DuckDuckGo browser seemingly sends domains a user visits ... by _hl_ on Thursday July 02, 2020 @06:26AM (#23711763)

Ah I guess I should have read TFA l, because search results have a similar feature (that is opt-out). For a browser I agree it makes more sense to get the icon directly from the site being visited without any privacy risks.

[ Parent | on HN ]