6 ms·

I've already posted this somewhere else, but I'll copy it here again as well: It's not immediately obvious whether it is more privacy preserving if the client

by _hl_ 6y ago

I've already posted this somewhere else, but I'll copy it here again as well: It's not immediately obvious whether it is more privacy preserving if the client automatically makes a request to each site in the search results while scrolling through the results, especially since you're already trusting DDG when performing the search. Maybe this should be an opt-in rather than an opt-out feature? All in all its really not as big of an issue as people here make it out to be.

epi0Bauqu 6y ago
Yes, after consulting with staff, I understand we thought it was more privacy protecting because we know our services are already encrypted and throw away PII, and so to get the favicon you could either (a) make another request to our known anonymous service or (b) make a request (or possibly multiple) to a non-anonymous service. On the other hand it is another request to a distinct domain that traverses another path on the Internet, albeit an encrypted one.
warpspin 6y ago
This was not about search results, where their favicon webservice is in fact privacy increasing, but about the privacy browser and the favicons it displays, where it is privacy decreasing as it involved sending information about visited sites to a central authority while you are not on the DDG search engine. For example the TabRenderer will fetch the favicons from DDG instead of from the site you are actually visiting: https://github.com/duckduckgo/Android/blob/db728523240e377277deb88af71d751eb8bdb5dd/app/src/main/java/com/duckduckgo/app/tabs/ui/TabRendererExtension.kt https://github.com/duckduckgo/Android/blob/db728523240e37727... Anyway, great decision by Gabriel.
- _hl_ 6y ago
  Ah I guess I should have read TFA l, because search results have a similar feature (that is opt-out). For a browser I agree it makes more sense to get the icon directly from the site being visited without any privacy risks.
- mthoms 6y ago
  Thanks for pointing out that the service was already in use on their search results pages. To me, this goes a long way toward explaining how this could have happened: Scenario #1 - "We need to show favicons in our browser tabs. Lets develop an API that requires every domain be sent to us!" Scenario #2 - "We need to show favicons in our browser tabs. Hey look, we've already got a service that provides this. We know it collects no PII and our users trust it already." Obviously the second scenario is flawed thinking, because (of course) it's better to not send that info at all. However, I can easily see how their developer(s) may have arrived at the conclusion that this is still compliant with their privacy ethos. The fact that the favicon service already existed (and was trusted by users) before this was implemented, makes it much easier to understand how this could have been a legitimate mistake and thus, they deserve the benefit of the doubt.
  - warpspin 6y ago
    Yes, it is a totally plausible mistake. The fault was "only" ignoring it after it was reported.
classified 6y ago
> not as big of an issue as people here make it out to be. Please refrain from speaking for others without being asked to.
- sokoloff 6y ago
  I don’t think that line is speaking for others. It is characterizing what others are actually saying.
  - classified 6y ago
    Exactly. Everyone should decide for themselves how big of an issue it is for them and not one person who just shrugs it off. That person made their statement sound like a universal fact.
    - sokoloff 6y ago
      I think the most charitable (and probably the default) reading of that clause has an implied "I believe" prepended. It certainly does not have an implied "It is a universal fact that" prepended. By way of analogy, when you earlier said "This is ludicrous. Can we switch to the metric system already?" no one thinks that you're speaking for everyone, but rather are advancing your own belief in the "This is ludicrous." sentence. https://news.ycombinator.com/item?id=23660985 https://news.ycombinator.com/item?id=23660985

by _hl_ 6y ago

epi0Bauqu 6y ago

Yes, after consulting with staff, I understand we thought it was more privacy protecting because we know our services are already encrypted and throw away PII, and so to get the favicon you could either (a) make another request to our known anonymous service or (b) make a request (or possibly multiple) to a non-anonymous service. On the other hand it is another request to a distinct domain that traverses another path on the Internet, albeit an encrypted one.

warpspin 6y ago

This was not about search results, where their favicon webservice is in fact privacy increasing, but about the privacy browser and the favicons it displays, where it is privacy decreasing as it involved sending information about visited sites to a central authority while you are not on the DDG search engine. For example the TabRenderer will fetch the favicons from DDG instead of from the site you are actually visiting: https://github.com/duckduckgo/Android/blob/db728523240e377277deb88af71d751eb8bdb5dd/app/src/main/java/com/duckduckgo/app/tabs/ui/TabRendererExtension.kt https://github.com/duckduckgo/Android/blob/db728523240e37727... Anyway, great decision by Gabriel.

_hl_ 6y ago
Ah I guess I should have read TFA l, because search results have a similar feature (that is opt-out). For a browser I agree it makes more sense to get the icon directly from the site being visited without any privacy risks.
mthoms 6y ago
Thanks for pointing out that the service was already in use on their search results pages. To me, this goes a long way toward explaining how this could have happened: Scenario #1 - "We need to show favicons in our browser tabs. Lets develop an API that requires every domain be sent to us!" Scenario #2 - "We need to show favicons in our browser tabs. Hey look, we've already got a service that provides this. We know it collects no PII and our users trust it already." Obviously the second scenario is flawed thinking, because (of course) it's better to not send that info at all. However, I can easily see how their developer(s) may have arrived at the conclusion that this is still compliant with their privacy ethos. The fact that the favicon service already existed (and was trusted by users) before this was implemented, makes it much easier to understand how this could have been a legitimate mistake and thus, they deserve the benefit of the doubt.
- warpspin 6y ago
  Yes, it is a totally plausible mistake. The fault was "only" ignoring it after it was reported.

classified 6y ago

> not as big of an issue as people here make it out to be. Please refrain from speaking for others without being asked to.

sokoloff 6y ago
I don’t think that line is speaking for others. It is characterizing what others are actually saying.
- classified 6y ago
  Exactly. Everyone should decide for themselves how big of an issue it is for them and not one person who just shrugs it off. That person made their statement sound like a universal fact.
  - sokoloff 6y ago
    I think the most charitable (and probably the default) reading of that clause has an implied "I believe" prepended. It certainly does not have an implied "It is a universal fact that" prepended. By way of analogy, when you earlier said "This is ludicrous. Can we switch to the metric system already?" no one thinks that you're speaking for everyone, but rather are advancing your own belief in the "This is ludicrous." sentence. https://news.ycombinator.com/item?id=23660985 https://news.ycombinator.com/item?id=23660985