3 ms·

Thx Matt. At issue here is the search leakage, and I tried to keep this post to that topic. I included the quote from Google because it mentions the Referrer st

Thx Matt. At issue here is the search leakage, and I tried to keep this post to that topic. I included the quote from Google because it mentions the Referrer sting aspect; I included the full quote because I didn't want be accused of taking it out context. The part in particular that is relevant is "All search engines and websites use referrer terms as part of the architecture of the web, but we recognize our responsibility to protect the data that users entrust to us and we give them meaningful choices to protect their privacy." It is not a choice that you need to give a user -- you can just do it for them as it should not effect search results. The bottom line of the post is that Google can easily control this particular leaking of personal information, so why not do it? I cannot seem to get a straight answer to that question from you or anyone.

grhino 16y ago
My guess is that a significant portion of business website technical infrastructure has some dependence on being able to access the search terms. Tons of commerce websites would scream if they lost this information. It's probably a complicated web of business relationships and strategies that is the answer for why Google would be reluctant to make such a change. It would cause a lot of upheaval and potentially ill will from companies affected by the change. It would be an extremely bold move by Google to make to prevent search leakage by default. Does Google believe that encrypted.google.com appeases the users who are concerned? Does Google believe that it is only a minority of users that are concerned?
- jacquesm 16y ago
  I have a gut feeling that google should be on the side of the users in this case, not the websites. Even if the users 'don't care' it's mostly because they are not aware of issues like this. Typically someone that types a query in to a searchbox on www.google.com thinks they are having a conversation with google, not with all of the potential links they'll click after having completed their query. Try explaining to a few non-computer literate people what happens behind the scenes when you do something as simple as a keyword search, most of them will have their eyes solidly glazed over long before you get to the HTTP_REFERER header.
  - VBprogrammer 16y ago
    Nothing against what you've said but search terms are hardly my bank account details, I'm well aware that they are being 'leaked' (although, I'm not sure that's even the correct term given that it's quite delibarate) and I doubt my whole search history would reveal more than which language I was working on and what error message had me stumped. Oh, and maybe which celebrity I have the hots for too.
axod 16y ago
BTW, DDG still leaks search terms: * Disable javascript * Do a search * Click on an https result Your search terms are sent to the website as referrer. Referer https://duckduckgo.com/html?q=https If you're going to claim to be whiter than white, you better cover all bases.
- epi0Bauqu 16y ago
  If there is leak I'm of course happy to fix it. Ahh, this is a bug I just committed yesterday fixing something else for someone. Will fix right away -- the html version is supposed to be using POST by default. Edit: fixed. The non-JS versions are somewhat new and there are a lot more bugs floating around them. Please report whenever you see something awry.
  - gregable 16y ago
    I just tried this right now from the http: version and it still has the same problem.
    - epi0Bauqu 16y ago
      I don't understand this at all because for the non-JS version you should never be on https. If you go the http homepage, the default form submit is POST and HTTPS. JS changes the action, so if you have JS off it should submit to the non-JS vesion (via HTTPS and POST). Also, the non-JS plugins are also HTTPS. Please email me to sort out what is going on: http://duckduckgo.com/feedback.html http://duckduckgo.com/feedback.html
      - deleted 16y ago
        [deleted]

grhino 16y ago

My guess is that a significant portion of business website technical infrastructure has some dependence on being able to access the search terms. Tons of commerce websites would scream if they lost this information. It's probably a complicated web of business relationships and strategies that is the answer for why Google would be reluctant to make such a change. It would cause a lot of upheaval and potentially ill will from companies affected by the change. It would be an extremely bold move by Google to make to prevent search leakage by default. Does Google believe that encrypted.google.com appeases the users who are concerned? Does Google believe that it is only a minority of users that are concerned?

jacquesm 16y ago
I have a gut feeling that google should be on the side of the users in this case, not the websites. Even if the users 'don't care' it's mostly because they are not aware of issues like this. Typically someone that types a query in to a searchbox on www.google.com thinks they are having a conversation with google, not with all of the potential links they'll click after having completed their query. Try explaining to a few non-computer literate people what happens behind the scenes when you do something as simple as a keyword search, most of them will have their eyes solidly glazed over long before you get to the HTTP_REFERER header.
- VBprogrammer 16y ago
  Nothing against what you've said but search terms are hardly my bank account details, I'm well aware that they are being 'leaked' (although, I'm not sure that's even the correct term given that it's quite delibarate) and I doubt my whole search history would reveal more than which language I was working on and what error message had me stumped. Oh, and maybe which celebrity I have the hots for too.

axod 16y ago

BTW, DDG still leaks search terms: * Disable javascript * Do a search * Click on an https result Your search terms are sent to the website as referrer. Referer https://duckduckgo.com/html?q=https If you're going to claim to be whiter than white, you better cover all bases.

epi0Bauqu 16y ago
If there is leak I'm of course happy to fix it. Ahh, this is a bug I just committed yesterday fixing something else for someone. Will fix right away -- the html version is supposed to be using POST by default. Edit: fixed. The non-JS versions are somewhat new and there are a lot more bugs floating around them. Please report whenever you see something awry.
- gregable 16y ago
  I just tried this right now from the http: version and it still has the same problem.
  - epi0Bauqu 16y ago
    I don't understand this at all because for the non-JS version you should never be on https. If you go the http homepage, the default form submit is POST and HTTPS. JS changes the action, so if you have JS off it should submit to the non-JS vesion (via HTTPS and POST). Also, the non-JS plugins are also HTTPS. Please email me to sort out what is going on: http://duckduckgo.com/feedback.html http://duckduckgo.com/feedback.html
    - deleted 16y ago
      [deleted]