7 ms·

Ask HN: Third Party Elements from Improving.duckduckgo.com

21 points by rupertfupert 5y ago

I am not a very technical person but I try to browse the web consciously. In practice that means that I use uMatrix to observe and block third party content and trackers (coupled with uBlock). On almost every popular website that means that I mostly see google tracking (tagmanager, doubleclick, fonts, captacha). But recently I saw that third party elements of improving.duckduckgo.com are appearing every time I visit a link that I clicked in a duckduckgo search. uMatrix doesn't categorise it as script or XHR, but simply as 'other'. And the element seems only to be requested when coming directly from the search result, not like the google stuff that is usually always there. Does someone know what is going on here? Do I need to worry that ddg is becoming the next google?

input_sh 5y ago
If you try opening that link it pretty much tells you what it is: > Any requests to this domain -- improving.duckduckgo.com -- are part of this anonymous experiment engine. You can learn more about how this technology works and how it was designed to protect your privacy here. Which then links to here (https://help.duckduckgo.com/privacy/atb/ https://help.duckduckgo.com/privacy/atb/), where it says: > Second, we measure engagement of specific events on the page (e.g. when a misspelling message is displayed, and when it is clicked). This allows us to run experiments where we can test different misspelling messages and use CTR (click through rate) to determine the message's efficacy. If you are looking at network requests, these are the ones going to the one-pixel image at improving.duckduckgo.com. These requests are anonymous and the information is used only by us to improve our products.
- Nextgrid 5y ago
  “Anonymous” is misleading because the user’s IP, user agent and browser fingerprint is also transmitted. All of these can be correlated with other requests including search queries themselves.
  - rovr138 5y ago
    If that’s all the identifying data and it is discarded, then it’s anonymous. We don’t know they’re using it. We don’t know they’re not using it either. But the fact that it’s sent doesn’t mean it’s used.
    - gruez 5y ago
      >> “Anonymous” is misleading because the user’s IP, user agent and browser fingerprint is also transmitted. > If that’s all the identifying data and it is discarded, then it’s anonymous. So by that standard google analytics is also "anonymous"?
    - calsy 5y ago
      The fact client data is being sent is enough reason to believe they are using it, regardless of unknown internal workings of the business. I don't think benefit of the doubt should apply to privacy or security with companies operating on the net. We know how they make their money and offer 'free services'.
- rupertfupert 5y ago
  Thank you for the hint, now I am a bit embarrassed that I didn't try to visit the subdomain myself. I am still worried about it somehow, because in my opinion the most privacy preserving way would be not to fetch that data at all. Now it seems to be down to trust. And the modern web did a good job for me to trust no one anymore. I also don't understand why the element has to 'carry' to the visited site and how that is possible.
  - technobabbler 5y ago
    Most web trackers work similarly. When a user clicks on something important, a signal is sent via another request to a monitoring server, usually Google Analytics/Ads/A-B testing or something like it. In this case DDG just made their own tracker. But yes, it's entirely an exercise in trust. There is nothing stopping them from being nefarious with this collected information, except their brand. Someday they may sell out, or maybe they already have, who knows? Thing is, nobody has your best interests at heart. These are all profit-driven enterprises and everyone has their price. DDG just markets itself as less evil. You don't want to trust anyone? Then don't. Block the trackers, rotate through VPNs, always use incognito, etc. Or just accept it as a cost of searching and move on with your life... your profile is just going to be one of millions anyway, even if they do track you. At least they don't have the cross-product integration and remarketing that Google's billions can buy. At the end of the day search is an expensive endeavor requiring constant spidering and curating and anti-spam efforts. If you get it for free, you're the product. DDG isn't magically above the economics.
  - btdmaster 5y ago
    Try Searx: https://github.com/searx/searx https://github.com/searx/searx https://searx.space/ https://searx.space/
  - mescaline 5y ago
    It's my opinion privacy is a practice variously conducted by individuals. When someone says, "I don't have anything to hide", they are indicating they are OK with others knowing what they are doing (or they are ignorant of what can be done with that info). They choose to expose any data they input while online because they believe they are "above" judgment for those activities. On the other hand, those of us who do know what can be done with that info choose another path which is not about self judgement of our online actions. We are aware that data can be used in various ways to analyze our behaviors or the things we are searching and finding. Depending on the services that we use, we may be "targeted" with relevant ads, emails, or other changes in behavior by the sites we visit. Preserving privacy on an individual level is about using services or applications which we understand AND can control. Trust is lost when we don't understand applications properly or control how they react later on. Any service or application, which is not self hosted, should allow users to configure or DELETE information which has been sent or gathered by the user. That site or application should also have a clear revenue model and privacy policy that indicates the site or application owner will not change the model or behaviors unless the user has been contacted properly. Personally, I am 100% OK using an application that allows me to modify or delete the information it collects while I'm using it. It's when applications aren't set up to do this that I become worried and lose trust. It's my opinion that privacy is NOT a practice conducted by public concensus, because each individual (whose privacy is in question) retains the right to feel however they like about privacy.
mkl 5y ago
Try these: https://www.reddit.com/r/duckduckgo/comments/azlk2j/are_inquiries_being_still_sent_thru/ https://www.reddit.com/r/duckduckgo/comments/azlk2j/are_inqu... and https://www.reddit.com/r/duckduckgo/comments/i8fg3y/why_is_duckduckgo_sending_data_to/ https://www.reddit.com/r/duckduckgo/comments/i8fg3y/why_is_d...
- technobabbler 5y ago
  That first link is illuminating, thanks. Guess DDG's official policy is "this isn't tracking". brianstoner said: > There's no blurring happening because there's nothing to blur. There's no unique identifier or personal information being collected. It's no different from using the search engine. And there's no need for an opt-out, because there's literally nothing to opt out of.
  - elliekelly 5y ago
    I really love DDG but I can’t stand when companies reply like this. It’s very obviously not “completely transparent” if a user has asked about it, and then, having gotten an answer, another user tells you they don’t think they were properly informed. The gaslighting is infuriating. If it’s really no big deal to your users then at the very least you need to explain it better.
    - technobabbler 5y ago
      Yeah. Guess it's easier to dismiss your users for wrongthink than it is to revise your entire marketing effort when someone calls you out on your hypocrisy.
cors-fls 5y ago
I visited improving.duckduckgo.com and they are linking to this article[0] that explains how this domain hosts an "anonymous tracking pixel" (that respects DDG privacy policy) to collect data on how DDG is used (feature usage, A/B testing etc) But it does not tell how it could end up on other domains. Are you sure it is not part of the DDG result page or extension ? I use uBlock so I do not check every request. [0] https://help.duckduckgo.com/privacy/atb/ https://help.duckduckgo.com/privacy/atb/
andrew_ 5y ago
They're well on their way towards Google: https://mobile.twitter.com/yegg/status/1501716484761997318 https://mobile.twitter.com/yegg/status/1501716484761997318 It's come out later from comms execs within DDG that this is due to Bing following EU rules about down ranking, and the technical reason here is the least interesting bit. The impassioned defense of it by the founder and CEO is the troublesome part. Solution: use Brave Search at search.brave.com.
- technobabbler 5y ago
  What does this have to do with the OP? So DDG is delisting Russian propaganda, but how does that answer the situation with improving.duckduckgo.com? Did you link to the wrong thread...?
  - yucky 5y ago
    >So DDG is delisting Russian propaganda I wonder what would be categorized as US propaganda, or do we not do that?
    - technobabbler 5y ago
      We do plenty of that (Voice of America, Hollywood, etc.), and other countries are free to block us too (and they do). We tried the whole "global village" thing. It didn't work. People are too tribal and shortsighted. Back to our little cloistered in-groups... sigh.
  - andrew_ 5y ago
    > Do I need to worry that ddg is becoming the next google? OP is clearly looking for feedback as to the evolution of the product. Related information is relevant. It's sad that has to be explained.
    - technobabbler 5y ago
      The OP was clearly discussing invasive tracking, not SERP curation and delisting. But ok I guess? "Search engine picks and chooses results to show. Must be evil like Google now."
asojfdowgh 5y ago
Beacons fire after navigation, so they mistakenly appear as part of the new page, despite being launched by the old page https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API

21 points by rupertfupert 5y ago

input_sh 5y ago

If you try opening that link it pretty much tells you what it is: > Any requests to this domain -- improving.duckduckgo.com -- are part of this anonymous experiment engine. You can learn more about how this technology works and how it was designed to protect your privacy here. Which then links to here (https://help.duckduckgo.com/privacy/atb/ https://help.duckduckgo.com/privacy/atb/), where it says: > Second, we measure engagement of specific events on the page (e.g. when a misspelling message is displayed, and when it is clicked). This allows us to run experiments where we can test different misspelling messages and use CTR (click through rate) to determine the message's efficacy. If you are looking at network requests, these are the ones going to the one-pixel image at improving.duckduckgo.com. These requests are anonymous and the information is used only by us to improve our products.

Nextgrid 5y ago
“Anonymous” is misleading because the user’s IP, user agent and browser fingerprint is also transmitted. All of these can be correlated with other requests including search queries themselves.
- rovr138 5y ago
  If that’s all the identifying data and it is discarded, then it’s anonymous. We don’t know they’re using it. We don’t know they’re not using it either. But the fact that it’s sent doesn’t mean it’s used.
  - gruez 5y ago
    >> “Anonymous” is misleading because the user’s IP, user agent and browser fingerprint is also transmitted. > If that’s all the identifying data and it is discarded, then it’s anonymous. So by that standard google analytics is also "anonymous"?
  - calsy 5y ago
    The fact client data is being sent is enough reason to believe they are using it, regardless of unknown internal workings of the business. I don't think benefit of the doubt should apply to privacy or security with companies operating on the net. We know how they make their money and offer 'free services'.
rupertfupert 5y ago
Thank you for the hint, now I am a bit embarrassed that I didn't try to visit the subdomain myself. I am still worried about it somehow, because in my opinion the most privacy preserving way would be not to fetch that data at all. Now it seems to be down to trust. And the modern web did a good job for me to trust no one anymore. I also don't understand why the element has to 'carry' to the visited site and how that is possible.
- technobabbler 5y ago
  Most web trackers work similarly. When a user clicks on something important, a signal is sent via another request to a monitoring server, usually Google Analytics/Ads/A-B testing or something like it. In this case DDG just made their own tracker. But yes, it's entirely an exercise in trust. There is nothing stopping them from being nefarious with this collected information, except their brand. Someday they may sell out, or maybe they already have, who knows? Thing is, nobody has your best interests at heart. These are all profit-driven enterprises and everyone has their price. DDG just markets itself as less evil. You don't want to trust anyone? Then don't. Block the trackers, rotate through VPNs, always use incognito, etc. Or just accept it as a cost of searching and move on with your life... your profile is just going to be one of millions anyway, even if they do track you. At least they don't have the cross-product integration and remarketing that Google's billions can buy. At the end of the day search is an expensive endeavor requiring constant spidering and curating and anti-spam efforts. If you get it for free, you're the product. DDG isn't magically above the economics.
- btdmaster 5y ago
  Try Searx: https://github.com/searx/searx https://github.com/searx/searx https://searx.space/ https://searx.space/
- mescaline 5y ago
  It's my opinion privacy is a practice variously conducted by individuals. When someone says, "I don't have anything to hide", they are indicating they are OK with others knowing what they are doing (or they are ignorant of what can be done with that info). They choose to expose any data they input while online because they believe they are "above" judgment for those activities. On the other hand, those of us who do know what can be done with that info choose another path which is not about self judgement of our online actions. We are aware that data can be used in various ways to analyze our behaviors or the things we are searching and finding. Depending on the services that we use, we may be "targeted" with relevant ads, emails, or other changes in behavior by the sites we visit. Preserving privacy on an individual level is about using services or applications which we understand AND can control. Trust is lost when we don't understand applications properly or control how they react later on. Any service or application, which is not self hosted, should allow users to configure or DELETE information which has been sent or gathered by the user. That site or application should also have a clear revenue model and privacy policy that indicates the site or application owner will not change the model or behaviors unless the user has been contacted properly. Personally, I am 100% OK using an application that allows me to modify or delete the information it collects while I'm using it. It's when applications aren't set up to do this that I become worried and lose trust. It's my opinion that privacy is NOT a practice conducted by public concensus, because each individual (whose privacy is in question) retains the right to feel however they like about privacy.

mkl 5y ago

Try these: https://www.reddit.com/r/duckduckgo/comments/azlk2j/are_inquiries_being_still_sent_thru/ https://www.reddit.com/r/duckduckgo/comments/azlk2j/are_inqu... and https://www.reddit.com/r/duckduckgo/comments/i8fg3y/why_is_duckduckgo_sending_data_to/ https://www.reddit.com/r/duckduckgo/comments/i8fg3y/why_is_d...

technobabbler 5y ago
That first link is illuminating, thanks. Guess DDG's official policy is "this isn't tracking". brianstoner said: > There's no blurring happening because there's nothing to blur. There's no unique identifier or personal information being collected. It's no different from using the search engine. And there's no need for an opt-out, because there's literally nothing to opt out of.
- elliekelly 5y ago
  I really love DDG but I can’t stand when companies reply like this. It’s very obviously not “completely transparent” if a user has asked about it, and then, having gotten an answer, another user tells you they don’t think they were properly informed. The gaslighting is infuriating. If it’s really no big deal to your users then at the very least you need to explain it better.
  - technobabbler 5y ago
    Yeah. Guess it's easier to dismiss your users for wrongthink than it is to revise your entire marketing effort when someone calls you out on your hypocrisy.

cors-fls 5y ago

I visited improving.duckduckgo.com and they are linking to this article[0] that explains how this domain hosts an "anonymous tracking pixel" (that respects DDG privacy policy) to collect data on how DDG is used (feature usage, A/B testing etc) But it does not tell how it could end up on other domains. Are you sure it is not part of the DDG result page or extension ? I use uBlock so I do not check every request. [0] https://help.duckduckgo.com/privacy/atb/ https://help.duckduckgo.com/privacy/atb/

andrew_ 5y ago

They're well on their way towards Google: https://mobile.twitter.com/yegg/status/1501716484761997318 https://mobile.twitter.com/yegg/status/1501716484761997318 It's come out later from comms execs within DDG that this is due to Bing following EU rules about down ranking, and the technical reason here is the least interesting bit. The impassioned defense of it by the founder and CEO is the troublesome part. Solution: use Brave Search at search.brave.com.

technobabbler 5y ago
What does this have to do with the OP? So DDG is delisting Russian propaganda, but how does that answer the situation with improving.duckduckgo.com? Did you link to the wrong thread...?
- yucky 5y ago
  >So DDG is delisting Russian propaganda I wonder what would be categorized as US propaganda, or do we not do that?
  - technobabbler 5y ago
    We do plenty of that (Voice of America, Hollywood, etc.), and other countries are free to block us too (and they do). We tried the whole "global village" thing. It didn't work. People are too tribal and shortsighted. Back to our little cloistered in-groups... sigh.
- andrew_ 5y ago
  > Do I need to worry that ddg is becoming the next google? OP is clearly looking for feedback as to the evolution of the product. Related information is relevant. It's sad that has to be explained.
  - technobabbler 5y ago
    The OP was clearly discussing invasive tracking, not SERP curation and delisting. But ok I guess? "Search engine picks and chooses results to show. Must be evil like Google now."

asojfdowgh 5y ago

Beacons fire after navigation, so they mistakenly appear as part of the new page, despite being launched by the old page https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API