If you use DuckDuckGo: Now, you have "Yahoo Ads" instead of Microsoft Ads, but these ads, they are in fact Microsoft Ads, except sold via Yahoo.

In front of these Yahoo Ads, DuckDuckGo actually adds its own click-through tracker.

Now you have DDG, Yahoo and Microsoft tracking you.

Bonus point if you click on an Amazon affiliate link, because in that case, the Amazon affiliate (DuckDuckGo) knows item-per-item what you purchased.

The sell is more that the data MS/DDG has is hopefully going to be siloed away from Google and so it is getting more expensive for an given entity to cross-reference information about you. And if we're lucky competitive pressure will peel DDG away from MS sooner or later if they get larger.

[0] This logic does lead to an argument for a fair chunk of HNs readership to use Yandex, because they are hosted in a country that is effectively at war with the English-speaking world but not presently targeting English speakers.

As you have noted, Russia is at war with the ~English-speaking world~ West, so it is much more likely to use this data against the users than in the past.

Besides, it'd be a struggle for the Russians to even figure out who they are. They'd only have search data. That is powerful but probably not enough in many cases.

Create disposable template for the browser with deleted browser dot-folder with no network,

(Optional) create appvm qube (or disposable template + disposable) for ProtonVPN or Mullvad

Create named disposable qube utilising the disposable template for the browser, and either sys-whonix or your VPN qube for network, and enjoy the most anonymous internet you will ever get!

Or put another way, if their browser had no content blocker (like the stock browsers of any mobile OS), their browser would be behaving like all the others. The scrutiny came from the conspicuous exclusion, given their arrangement with Bing (much like the controversy of Adblock Plus many years ago).

Yes, they block other tracking scripts, but since they have an explicit exception for tracking from Microsoft, it's not a complete stretch to say they were "tracking for MS"; I know technically it's Microsoft doing the tracking, but DDG gives them explicit permission to do so. I think that it's a distinction without much of a difference, and I don't think it's unfair to extrapolate a bit. If they're being misleading about the types of tracking in their mobile app to make Daddy Microsoft happy, why the fuck would I believe their claims that their search engine (which is more or less a proxy for Bing) would be immune from it?

It actually really upset me; I was a big user and advocate of the DDG browser on iOS and Android, but when that news came out it felt like a big betrayal. I haven't used any DDG product since then, and while I have no idea what kind of trackers they block (if any), I just use Firefox Focus now with Kagi search.

This rando's comments (https://old.reddit.com/r/privacy/comments/1bmubkd/thoughts_a...) on the filter bubble problem seems like a reasonable concern too. It's best for a search engine to know nothing about you and just provide the best results for what you asked, not what it thinks you want to hear.

I still trust Kagi more than basically any free service though. There's no ads, and since they charge for search they at least have a means of making money that doesn't involve selling my data. Even if Kagi knows what I'm doing, I'm willing to accept that they're not dispensing my data quite as liberally as Google and Microsoft (and apparently DDG).

Please don’t. Just look at the paid services/products around you. Don’t give more PII to a browser vendor than is necessary.

I do generally agree with your broader point, however in 2024 I don't think it's realistic to stop utilizing search engines while not inadvertently giving up PII. I mean, I could, but I do think my life would be considerably worse.

At least with Kagi, they have some means of making money that doesn't involve selling data. It's entirely possible that they betray us and start selling our data anyway, I'm not completely naive, but at least it's not an inevitability like with ostensibly free services.

The context of the news was a security researcher conducting an audit of the app. If DDG were, as the GP claimed, performing tracking on behalf of MS then it would be more concerning since there is a difference between performing tracking on behalf of a third-party company and merely excluding them from being blocked via a content blocker that most mobile browsers lack anyway.

A mobile app has much more freedom to do what it likes so if this was the worst that occurred in an audit I'm not of the opinion this mark against them is enough to change my use of them. Many things carry some compromise so one has to weigh if an alternative is better. Use of Firefox by default has Mozilla tracking (hence why some mobile forks exists, including one I use), analytics for sponsored links, non-disableable domain name auto-completion by partners, while use of Kagi search is directly tied to an IRL identity via payment.

For me, I'm comfortable using uBlock Origin on both Desktop and Mobile (via a Firefox fork) unless more egregious facts present themselves.

Sorry, I'm still not entirely sure that I agree that this doesn't count as tracking on behalf of Microsoft. If their browser has an "if MSTracker then allow else doNotAllow", that still seems like it's effectively endorsing MS tracking.

That said, I agree with your criticisms on Kagi (as outlined in sister thread). It would be ideal if Kagi had some means of truly decoupling searches from accounts, but as I stated, at least Kagi charges a fee so they have a means of making money without mining and selling data.

Which Firefox fork do you use? Does it work on iPhone? I would really prefer to use something that allows me to install extensions like uBlock.

I use Fennec, which afaict is Android only. It's my understanding it removed various Mozilla analytics though some is said to remain. It's compiled independently from source by F-Droid, which supports reproducible builds.

Primary reasons I use it is for enabling about:config editing out of the box and third party addons (either Mozilla-approved ones like uBlock Origin or any arbitrary addons so long as they're in an addon 'collection', following the same procedure like Firefox Nightly until Mozilla fulfils their goal of easier addon support).

Once Alt stores show up in the US I suspect we'll get a lot more of these browsers showing up on iPhone. My last experience with Android was awful so I went crawling back to iOS, but I think that I just got a bad physical unit more than anything else.

I did see that Kagi's Orion browser allows you to install extensions, though I had issues with stability when I tried it a year ago, but a lot can change in a year so I should probably give it again.

Important to note is that Kagi does not associate searches with an account to begin with, nor there are any incentives for Kagi to do so (search log would be just a giant liability from a standpoint of Kagi's business model, with no benefit).

I think what you mean is - are there means to make that provable from a technology standpoint? It turns out there are, through something called blind tokens, and we are looking into it. It is being discussed in Kagi forums here: https://kagifeedback.org/d/653-completely-anonymous-searches...

Another solution available right now in Kagi is paying for the service with Bitcoin/Lightning and using a random email address to sign up (Kagi does not need or verify email addresses, they are just a login id and can be anything).

Yes that is what I meant. I do genuinely believe you when you say that the searches aren't correlated to the accounts, but the problem is that it's difficult to know for sure if that's actually true; how many cases in tech have we thought something was "private" and it turned out that they were vending our data out to the highest bidder?

As long as Kagi doesn't start serving targeted ads, I am personally willing to trust it (as I have for the last year and a half), though I am super interested in the blind token thing you linked.