News for hackers. Stuff that matters.

A comment on The next version of DuckDuckGo. Parent comment

Re:The next version of DuckDuckGo by yegg on Monday May 05, 2014 @04:31PM (#7701015)
You can read more about that here: https://duck.co/blog/https-on-by-default

It has no privacy impact since we do not store or collect personal information.

[ Parent | on HN ]
Re:The next version of DuckDuckGo by ancarda on Monday May 05, 2014 @04:51PM (#7701143)
>we do not store or collect personal information.

But the redirection is done over plain HTTP and not HTTPS. If you don't have a wildcard certificate, you could use /r?url=... instead of a subdomain.

Ideally, the best setup would be to use the "noreferrer" attribute on anchor tags. It's a relatively new standard but perhaps you could detect if it's supported and then use that rather than a redirector?

https://www.webkit.org/blog/907/webkit-nightlies-support-htm...

[ Parent | on HN ]
Re:The next version of DuckDuckGo by yetfeo on Monday May 05, 2014 @08:17PM (#7702149)
As I mention in a previous comment, if you are using the TOR hidden service (3g2upl4pq6kufc4m.onion/) the redirect goes over a TOR exit node without https. Ideally it should use the hidden service so no exit node is involved, or at the least use HTTPS.
[ Parent | on HN ]