4 ms·

DuckDuckGo is a mirage and should not be used by privacy-conscious folks. Take a look at its terms of service, information collected section: "We also save sea

DuckDuckGo is a mirage and should not be used by privacy-conscious folks. Take a look at its terms of service, information collected section: "We also save searches, but again, not in a personally identifiable way, as we do not store IP addresses or unique User agent strings. We use aggregate, non-personal search data to improve things like misspellings." So they save your web searches and claim that they do so in an non-personally identifiable way. The privacy problems with this claim are many, even if one accepts it at face value (good luck verifying that this is the case).

WA9ACE 6y ago
Do you have a search engine that you prefer to use that claims not to store said information that I might try?
- metroholografix 6y ago
  The only solution I see is fully distributed/decentralized search. Run your own crawler or be part of a network that distributes this out to each participating node. Every centralized search engine has immensely hard-to-resist and powerful incentives to play "The Eye of Sauron" with your data. Additionally, they offer single points of compromise to other, far more powerful actors. Whatever guarantees DuckDuckGo gives you -and right now they don't give any- don't mean much, if they've been thoroughly (willingly or unwillingly) compromised. Which doesn't mean one should always steer well clear just that one should at least be aware of the tradeoffs one makes when using a centralized search engine. And with DuckDuckGo's misleading marketing, I feel that this point is lost on significant chunks of its userbase.
  - burnthrow 6y ago
    "Run your own crawler" is not a solution. Cool my comments are immediately downvoted like that Italian guy's.
  - ravenstine 6y ago
    Such search engines have been around for many years, and they suck donkey balls. Pardon my French. Install YaCy and tell me how you like it. It wouldn't matter anyway, because decentralization doesn't really solve privacy any better than centralized search, besides the fact that it could theoretically provide more choices. No matter what you use, privacy ultimately depends on trust. The reason that I have more trust for DDG than I do Google is, unlike Google, its primary audience is privacy-minded folks. If it came out that DDG was tracking users and selling that data, DDG would be immediately done as a brand. They at least have some incentive to do what they say. Decentralization provides no such benefit because a search "node" is unlikely to have any sort of meaningful brand to keep up. > And with DuckDuckGo's misleading marketing, I feel that this point is lost on significant chunks of its userbase. How is it misleading? My understanding from their marketing is that they don't create profiles of their users based on searches. Until we have evidence to the contrary, it's not outrageous to assume they are being truthful.
  - unethical_ban 6y ago
    Yeah, now you're just saying "Nothing centralized can ever be trusted". So just say that rather than nitpicking their ToS. You weren't going to care what they said anyway.
- h2onock 6y ago
  I can hand on heart tell you that Mojeek doesn’t and never has. I know this because I work for Mojeek.
  - Pick-A-Hill2019 6y ago
    Hi. I took a look at Mojeek (first time I've heard about it) and since you mentioned the site and you work there - In your Privacy page (Data Usage Section) there is a mention of stored "Browser Data" & " These logs contain the time of visit, page requested, possibly referral data, and located in a separate log browser information." & "We may also use aggregate, non-personal search data to improve our results". This is an honest question - How is that not exactly what the Parent stated was the issue? So they save your web searches and claim that they do so in an non-personally identifiable way.
    - ricardo81 6y ago
      An often referred to issue with DDG is that its favicon service was informing DDG of sites you visit, rather than searches you make. But agreed that all search engines have to be trusted on their word about anonymising data and not retaining PII when it comes to searches specifically. There's nothing any front end user can do to verify it.
fbelzile 6y ago
> DuckDuckGo is a mirage ... The privacy problems with this claim are many ... good luck verifying ... Okay, can you list just a few? If you're going to make counter-claims like this, you're going to have to provide evidence. Statements like these are not conducive in gaining popular support for increased privacy.
- metroholografix 6y ago
  How do you save a search in a non-personally identifiable way? Do you have a human verify the data belonging to each and every search ? Not saving IPs and/or browser data doesn't solve the problem since the search terms themselves can be personally identifiable. How do you verify that DuckDuckGo does -the minimal and ineffective- things they claim to do? They offer no proof. How do you verify that DuckDuckGo does not secretly cooperate with more powerful coercive actors? How do you verify that DuckDuckGo, offering a single point of compromise, has not been thoroughly compromised by more powerful actors?
  - bscphil 6y ago
    > How do you save a search in a non-personally identifiable way? Save a sha256 hash of every search for 24 hours. If you see the same hash from >10 distinct IP addresses in a 24 hour period, save the search terms. That's just off the top of my head, I have no reason to think they're doing it exactly like that. The point is that you're claiming that we shouldn't trust DuckDuckGo because you can't think of a way that they could securely and privately do what they do -- but that's just your intuitions, for whatever they may be worth. I also don't really buy the worries you have with the last two questions, e.g.: > How do you verify that DuckDuckGo does not secretly cooperate with more powerful coercive actors? How would you verify that for any centralized service, open source or not? I think your security concerns go a bit beyond what most people interested in critiquing / improving DDG can reasonably expect to achieve.
    - pb7 6y ago
      >How would you verify that for any centralized service, open source or not? Other centralized (search) services don't have their entire existence depending on this one factor. What is DDG if not alleged privacy? Just use Bing directly.
robertlagrant 6y ago
I don't see why you'd both nitpick their terms of service, and then also claim that it's a pack of lies and can't be trusted. Why do the former and then the latter? If your complaint is just "I can't verify anything about their privacy" then that would've made sense.

WA9ACE 6y ago

Do you have a search engine that you prefer to use that claims not to store said information that I might try?

metroholografix 6y ago
The only solution I see is fully distributed/decentralized search. Run your own crawler or be part of a network that distributes this out to each participating node. Every centralized search engine has immensely hard-to-resist and powerful incentives to play "The Eye of Sauron" with your data. Additionally, they offer single points of compromise to other, far more powerful actors. Whatever guarantees DuckDuckGo gives you -and right now they don't give any- don't mean much, if they've been thoroughly (willingly or unwillingly) compromised. Which doesn't mean one should always steer well clear just that one should at least be aware of the tradeoffs one makes when using a centralized search engine. And with DuckDuckGo's misleading marketing, I feel that this point is lost on significant chunks of its userbase.
- burnthrow 6y ago
  "Run your own crawler" is not a solution. Cool my comments are immediately downvoted like that Italian guy's.
- ravenstine 6y ago
  Such search engines have been around for many years, and they suck donkey balls. Pardon my French. Install YaCy and tell me how you like it. It wouldn't matter anyway, because decentralization doesn't really solve privacy any better than centralized search, besides the fact that it could theoretically provide more choices. No matter what you use, privacy ultimately depends on trust. The reason that I have more trust for DDG than I do Google is, unlike Google, its primary audience is privacy-minded folks. If it came out that DDG was tracking users and selling that data, DDG would be immediately done as a brand. They at least have some incentive to do what they say. Decentralization provides no such benefit because a search "node" is unlikely to have any sort of meaningful brand to keep up. > And with DuckDuckGo's misleading marketing, I feel that this point is lost on significant chunks of its userbase. How is it misleading? My understanding from their marketing is that they don't create profiles of their users based on searches. Until we have evidence to the contrary, it's not outrageous to assume they are being truthful.
- unethical_ban 6y ago
  Yeah, now you're just saying "Nothing centralized can ever be trusted". So just say that rather than nitpicking their ToS. You weren't going to care what they said anyway.
h2onock 6y ago
I can hand on heart tell you that Mojeek doesn’t and never has. I know this because I work for Mojeek.
- Pick-A-Hill2019 6y ago
  Hi. I took a look at Mojeek (first time I've heard about it) and since you mentioned the site and you work there - In your Privacy page (Data Usage Section) there is a mention of stored "Browser Data" & " These logs contain the time of visit, page requested, possibly referral data, and located in a separate log browser information." & "We may also use aggregate, non-personal search data to improve our results". This is an honest question - How is that not exactly what the Parent stated was the issue? So they save your web searches and claim that they do so in an non-personally identifiable way.
  - ricardo81 6y ago
    An often referred to issue with DDG is that its favicon service was informing DDG of sites you visit, rather than searches you make. But agreed that all search engines have to be trusted on their word about anonymising data and not retaining PII when it comes to searches specifically. There's nothing any front end user can do to verify it.

fbelzile 6y ago

> DuckDuckGo is a mirage ... The privacy problems with this claim are many ... good luck verifying ... Okay, can you list just a few? If you're going to make counter-claims like this, you're going to have to provide evidence. Statements like these are not conducive in gaining popular support for increased privacy.

metroholografix 6y ago
How do you save a search in a non-personally identifiable way? Do you have a human verify the data belonging to each and every search ? Not saving IPs and/or browser data doesn't solve the problem since the search terms themselves can be personally identifiable. How do you verify that DuckDuckGo does -the minimal and ineffective- things they claim to do? They offer no proof. How do you verify that DuckDuckGo does not secretly cooperate with more powerful coercive actors? How do you verify that DuckDuckGo, offering a single point of compromise, has not been thoroughly compromised by more powerful actors?
- bscphil 6y ago
  > How do you save a search in a non-personally identifiable way? Save a sha256 hash of every search for 24 hours. If you see the same hash from >10 distinct IP addresses in a 24 hour period, save the search terms. That's just off the top of my head, I have no reason to think they're doing it exactly like that. The point is that you're claiming that we shouldn't trust DuckDuckGo because you can't think of a way that they could securely and privately do what they do -- but that's just your intuitions, for whatever they may be worth. I also don't really buy the worries you have with the last two questions, e.g.: > How do you verify that DuckDuckGo does not secretly cooperate with more powerful coercive actors? How would you verify that for any centralized service, open source or not? I think your security concerns go a bit beyond what most people interested in critiquing / improving DDG can reasonably expect to achieve.
  - pb7 6y ago
    >How would you verify that for any centralized service, open source or not? Other centralized (search) services don't have their entire existence depending on this one factor. What is DDG if not alleged privacy? Just use Bing directly.

robertlagrant 6y ago

I don't see why you'd both nitpick their terms of service, and then also claim that it's a pack of lies and can't be trusted. Why do the former and then the latter? If your complaint is just "I can't verify anything about their privacy" then that would've made sense.