22 ms·

DuckDuckGo email protection beta now open

352 points by TangerineDream 4y ago

Turpen 4y ago
Why does this email service require an extension/add-on?
jcadam 4y ago
DDG? Nah, I'll stick with Startmail (https://startmail.com https://startmail.com) - which is a paid service - until they do something to lose my trust.
2Gkashmiri 4y ago
i don't know man.... this sounds yet another service to subscribe to for what benefit? i have been selfhosting on racknerd for like last 2 years and beyond the first month, i have been pretty much put it on auto mode. i use mailinabox so i get to use roundcube and it has a banner "To protect your privacy remote resources have been blocked." this is by default for all links and images unless i explicitly allow someone so isn't that the same thing?
cmurf 4y ago
Does it pass "the mom test"? The people who need this kind of protection aren't as much HNers, but the friends and family of HNers.
siproprio 4y ago
Very cool, and even replying works!
sparrc 4y ago
Anyone have a writeup that doesn't require the browser extension?
- bertman 4y ago
  https://news.ycombinator.com/item?id=32596459 https://news.ycombinator.com/item?id=32596459
tuckerman 4y ago
I've eventually settled on using fastmail and their masked email feature which can create addresses on my own domain for this. I love DDG and appreciate anyone helping in this space to make email more manageable but I assume these addresses will be quickly blocked from many services just like the firefox relay addresses are. I wish there was a way for these relay services to be effective since they are much, much easier to get someone to use than telling them to just up and move from gmail to fastmail.
- cscheid 4y ago
  (I've been a happy paying customer of Fastmail for _years_ and I didn't know about masked email. Thank you!)
  - tuckerman 4y ago
    Just in case you happen to be a 1Password user as well, there is an integration where they can auto-generate masked emails for you: https://support.1password.com/fastmail/ https://support.1password.com/fastmail/ It makes it very convenient!
    - alexchro93 4y ago
      Auto-generated masked emails using Fastmail and 1Password has worked very well for me when I'm using Firefox, with the 1Password extension installed, on my laptop. I can't for the life of me, however, figure out how to get 1Password to auto-gen a masked email from their iPhone app or desktop app. Is this possible?
    - someotherperson 4y ago
      Would love to see a Bitwarden implementation of this
  - muhammadusman 4y ago
    You can also use a custom domain (and/or anything else Fastmail lets you choose), this way you can put all the randomly generated emails coming to you in a single folder (as a rule).
mxuribe 4y ago
The concept is great, and compared to other companies, i trust duckduckgo more...but, there still a for-profit company (nothing wrong with that)...so how will they sustain this? Maybe i'm not so smart with funding models, but i would feel better if there was some sort of pricing...to make me feel like as a user i'm not the product...am i paranoid for being suspicious?
raybb 4y ago
I wonder how the privacy aspects of this compare to Firefox Relay? Having used Firefox Relay a bit, I'm pretty happy with it but the free tier is relatively limited. DDG email seems to allow unlimited addresses but after a quick look it's not obvious that you can turn them off if an account is getting too much spam. https://relay.firefox.com/ https://relay.firefox.com/
- freeAgent 4y ago
  You can deactivate addresses pretty easily. Needing to install the DDG extension in order to generate them, however, is not great.
smotched 4y ago
I've completely switched to brave search for browsing, I can never trust DDG again.
- thedorkknight 4y ago
  What happened?
  - djanogo 4y ago
    They started censoring websites based on "political fake news" filter list supplied by MSM.
    - Bilal_io 4y ago
      > based on "political fake news" filter list supplied by MSM Can you provide a citation for this?
      - behnamoh 4y ago
        Search HN, it was a big buzz recently.
        rvz 4y ago
        DuckDuckGo's search manipulation is just no different to Google's since essentially they are using Microsoft Bing's search results. [0] So the manipulation, down-ranking and censoring of search results was inevitable with tons of evidence of this: [1][2][3][4] "At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation.": [1] At this point, DDG is a front for Microsoft using 'privacy' buzzwords. Might as well use Brave Search then. [0] https://help.duckduckgo.com/duckduckgo-help-pages/results/sources/ https://help.duckduckgo.com/duckduckgo-help-pages/results/so... [1] https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318 [2] https://www.vox.com/recode/22981115/duckduckgo-free-speech-privacy-oops https://www.vox.com/recode/22981115/duckduckgo-free-speech-p... [3] https://www.reddit.com/r/duckduckgo/comments/hx5dn5/proof_duckduckgo_manipulates_search_results_to/ https://www.reddit.com/r/duckduckgo/comments/hx5dn5/proof_du... [4] https://news.ycombinator.com/item?id=27395635 https://news.ycombinator.com/item?id=27395635
jrexilius 4y ago
Dear DuckDuckGo, Please let me pay for this service. It looks worth having and: 1) I'd like to know that it is funded by users, rather than advertisers and thus can resist privacy invasion presuures. 2) I'd like to have some basis for belief that it will be around longer than it takes the VC money to run out, (or the marketing budget, or whatever non-sustainable pot it comes from).
- scoot 4y ago
  (Low cost) paid service, no browser extension: 33mail.com. Happy customer for well over ten years.
- yegg 4y ago
  DuckDuckGo has been profitable since 2014 through private search ads, and our company is not controlled or beholden to venture capital (or VC or other money). Our product vision is an "easy button" for privacy, an all-in-one privacy app. Email protection is part of that, along with search, browsing, etc. Put another way, we see email protection as part of our core product, and within our app we autofill duck addresses in email forms. We will take your comment into consideration, though we prefer free services where possible so more people can get privacy protection, which is in line with our mission. This service comes with it a set of privacy guarantees here: https://duckduckgo.com/email/privacy-guarantees https://duckduckgo.com/email/privacy-guarantees and we will not be putting ads on it.
  - TopGreg 4y ago
  - vinaypai 4y ago
    DDG has regularly raised money from VCs including a Series D about a year ago. https://www.crunchbase.com/organization/duck-duck-go/company_financials https://www.crunchbase.com/organization/duck-duck-go/company...
    - macNchz 4y ago
CA0DA 4y ago
Won't lots of services just start blocking *@duck.com email addresses now?
- megapatch 4y ago
  Then you don't use that service.
- blibble 4y ago
  most likely the only way the fastmail one works is there's paying customers on that domain (and a lot of them)
- saimiam 4y ago
  If that happens, check out https://PretzelBox.cc https://PretzelBox.cc (FD - my product) and get *@your-domain.com. They can’t block all domains other than gmail and outlook, can they?
shadowgovt 4y ago
This is a great idea, but it's going to take nearly zero time for companies to decide not to accept private duck addresses for business purposes. DDG is signing themselves up for a hard challenge, though I think they're up to it. Once you offer a service like this, you take upon yourself the burden of maximizing the outbound signal-noise ratio for emails, or you run the risk that other email providers identify your node as damaged and route around it. So they'll have to be on top of uses of their service for spam and aggressively police and kill those accounts. I'm excited to see what special sauce they're bringing to the field in this space.
TopGreg 4y ago
datavirtue 4y ago
No dots or underscores allowed?
- neon_electro 4y ago
  Probably on purpose to avoid firstnamelastname@, firstname.lastname@, and firstname_lastname@ variations being abused.
encryptluks2 4y ago
Just a note... an email anonymous relay that lets you use custom domains is a much better alternative if you ever plan on migrating away. SimpleLogin is open source and allows you to export the information so that if their service ever goes offline you have a backup and can recover your aliases.
Night_Thastus 4y ago
Could someone explain a bit about where this fits in? Is this an e-mail provider? A client? Something else? If I have X Provider and I access it using Y client (ie, Thunderbird), what exactly does this add/replace/enhance? Where does "Relay" fit in since some people here mention it?
- jabroni_salad 4y ago
  It looks like it is just a forwarder, so it doesn't replace your existing mail provider.
- CharlesW 4y ago
  It's a privacy-focused "email forwarding" service, which I think is synonymous with "email routing" service. Competitors would include Cloudflare¹ and Apple². ¹ https://blog.cloudflare.com/introducing-email-routing/ https://blog.cloudflare.com/introducing-email-routing/ ² https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/icloud https://support.apple.com/guide/icloud/what-you-can-do-with-...
  - Night_Thastus 4y ago
    So I could set up a new e-mail address, have it forward to my existing e-mail address, and DDG does some filtering/spam protection before it does the forward?
- deleted 4y ago
  [deleted]
huangc10 4y ago
Came here for dmail, a gmail competitor. Semi disappointed but still liking this security feature though.
- elliekelly 4y ago
  Agreed. I’d really like a middle ground between proton and gmail. Something that’s easy enough to set up and won’t actively spy on me.
  - InCityDreams 4y ago
    >won’t actively spy on me. Go on.....
  - kovac 4y ago
    There are many of those. Runbox, fastmail, mailbox.org,...
pluc 4y ago
> Email Protection requires the DuckDuckGo extension in this browser. well, that's cool I guess
- anonu 4y ago
  It doesnt really need an extension... dark pattern
  - pluc 4y ago
    You do if you want to autocomplete your email address in fields I guess, but I agree it isn't a very good reason for an extension. It's one of those convenience extension that, would it be made by any other company, I'd be very suspicious of.
    - deleted 4y ago
      [deleted]
gkoberger 4y ago
For people who aren't sure what this does: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo... EDIT: The site has been updated to point to this!
- gregmac 4y ago
  Is there any tracking other than images? I do "Block all images" in email anyway, would I gain anything (in terms of tracking protection) from this?
- mijowi 4y ago
  Email tracking is just done through image downloads right? So if images are blocked by default then tracking isn’t possible? Image blocking is easy enough to do.
pluc 4y ago
Feels like it tries to solve the same problems as Mozilla Relay [1] (they call it Firefox Relay, but the addresses are @mozmail.com soooo) except Mozilla lets you attribute specific aliases for things. 1 https://relay.firefox.com/ https://relay.firefox.com/
- laundermaf 4y ago
  Good to see more like it, but having only 5 addresses for free feels like DOA now. Even during the waitlist they didn’t increase the number, kinda shameful.
  - tintedfireglass 4y ago
    I mean, anonaddy and simple login also give only 10 and 15 free aliases respectively.
    - ffpip 4y ago
      Anonaddy gives you unlimited aliases for free. https://anonaddy.com/#pricing https://anonaddy.com/#pricing
baobob 4y ago
You have to install a browser extension to use email? Who had this bright idea?
pierrebeaucamp 4y ago
> Email Protection is not available in this browser. I'm surprised to see that Safari is not supported.
- laundermaf 4y ago
  Safari already has Hide My Email, assuming you’re already laying $60/year for iCloud.
TopGreg 4y ago
milkoolong 4y ago
I was able to generate a random private duck address (o8oyr2f8@duck.com) that's connected to my name@duck.com which then forwards to my personal gmail. I can change the forwarding address too which helps when I move from gmail to a private-er service. Please send me your best educational spams at the address above. It will self-destruct shortly when I generate a new private address. Really cool to see more offerings like these.
lijogdfljk 4y ago
I have this with FastMail - it's really cool. Even has 1Password integration to automatically create the emails.
Osmium 4y ago
Bystander impression from other comments I've read on DuckDuckGo posts recently: they have good intentions but behind-the-scenes are a bit less rigorous on privacy than would be ideal. Is this an accurate impression from anyone who knows more? For example, see discussion in this thread[0]. Even though the article itself seemed misleading, many commenters raised some good points. [0] https://news.ycombinator.com/item?id=31490515 https://news.ycombinator.com/item?id=31490515
- monetus 4y ago
  They have pushed that contract to the limit thankfully. You can load up Firefox with ad blockers and then compare and contrast with their browser. They do as well as allowed, and have extra value adds. More well intentioned than brave imo.
  - doodlesdev 4y ago
yubiox 4y ago
You need to put your real address as the from address in replies, not the duck address. DuckDG then strips out the real one and replaces it with the duck one, it seems.
solarkraft 4y ago
Opening in Firefox on Android: > Email Protection is not available in this browser > Email Protection is also available on desktop with the DuckDuckGo app for Mac (beta), as well as DuckDuckGo extensions for Firefox, Chrome, Brave, and Edge. What, I need to install a piece of software to my computer or an extension to my browser to use a service? That's invasive and, without a very good explanation (that is nowhere to be seen on that page), massively hurts my trust in the company.
- yegg 4y ago
  The original link was never meant to be linked to directly -- and has now been replaced with the announcement post.
  - solarkraft 4y ago
    Okay, but that's not an explanation. > That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system. This is a satisfactory explanation. But it's neither on the signup page, nor on the announcement page. ... and it's still really easy to accuse you of just trying to get some app installs - which would be fine if you admitted it.
BobMit 4y ago
Does it work without installing the extension?
therealmarv 4y ago
There is absolutely NO reason to use only an extension or app for that. I don't trust extensions. OSS alternative with freemium/paid subscription model (but without email tracker removal unfortunately) https://anonaddy.com https://anonaddy.com
- 3np 4y ago
  There is also SimpleLogin. https://simplelogin.io/ https://simplelogin.io/ https://github.com/simple-login/app https://github.com/simple-login/app AA and SL do look like the two more solid options compared to anything else I've seen so far.
  - jaden 4y ago
    SimpleLogin was recently acquired by Proton [1]. I'm hoping nothing changes, but you never know. [1] https://simplelogin.io/blog/simplelogin-join-proton/ https://simplelogin.io/blog/simplelogin-join-proton/
  - sha-3 4y ago
    SimpleLogin was bought by Proton[0], so if you have a Proton Unlimited, Business or Visionary plan, you'll get SimpleLogin premium for free. [0]: https://proton.me/news/proton-and-simplelogin-join-forces https://proton.me/news/proton-and-simplelogin-join-forces
- tao_oat 4y ago
  I'm working on a similar project: https://shroud.email/ https://shroud.email/ It doesn't yet have all the same features as SimpleLogin/AnonAddy, but unlike them it does remove email trackers.
- Vinnl 4y ago
  Coincidentally we just this week added tracker removal to https://relay.firefox.com/ https://relay.firefox.com/ (needs to be explicitly enabled due to the risk of breakage). I should note though, that while it is open source (and freemium), it's reliant on quite some infra that makes it pretty much impossible to self-host, if that's something you're looking to do.
cguess 4y ago
Cool, but no Safari support?
- laundermaf 4y ago
  Safari extensions are a PITA compared to the others. However considering that they already have apps in the store, I assume they will start including the extension at some point.
oftenwrong 4y ago
If you are interested in the "unlimited unique private email addresses" functionality, also take a look at these other services: https://33mail.com/ https://33mail.com/ https://anonaddy.com/ https://anonaddy.com/ https://burnermail.io/ https://burnermail.io/ https://relay.firefox.com/ https://relay.firefox.com/ https://simplelogin.io/ https://simplelogin.io/ These all support custom domains, except for Firefox Relay, which only supports a custom subdomain.
- saimiam 4y ago
  I’m building https://pretzelbox.cc https://pretzelbox.cc which is like mailinator for your own domain. While it doesn’t generate email addresses for you, since it’s a domain inbox, you can use whatever string@you-domain.com to make it work. It’s getting a bit of traction even with the rubbish website :).
ctrlmeta 4y ago
I don't understand why it needs me to install a browser extension. That's a very weird requirement to sign up for an email address? Could someone explain why an extension is needed or why it was designed like this?
deleted 4y ago
[deleted]
drstewart 4y ago
I can't think of a situation where I'd want to use this - if I don't trust the provider, I'm using a throwaway email like mailinator.com. Curious to hear about what use cases this would fall into?
- saimiam 4y ago
  If you want to take it to next level after mailinator.com, I’m building https://pretzelbox.cc https://pretzelbox.cc - an inbox for your domain. Use whatever string@your-domain.com and we’ll forward emails to your linked email account.
TekMol 4y ago
Prompting the user to install a browser extension to use an email forwarder looks like a dark pattern to me. This lowers my trust in DDG. It's the same approach all companies use, once they grow. "Everyone is telling you they are the good guys, but they are throwing invasive technology at you! Fight back! ... by installing our invasive technology! Trust us, we are the good guys!"
- yegg 4y ago
  We offer an all-in-one privacy app. The extension/app generates the addresses and autofills them into email forms, and so you need the extension/app for those key parts of the functionality. Once signed up you can use it somewhat though without the extension/app by giving out your personal duck address directly, and trackers will be stripped from messages sent to it and then forwarded to your regular inbox. That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system.
  - Agrue8u 4y ago
    But the app changes my default search page and new tab home page without my permission. I installed the app to get my duck email address then immediately disabled it.
    - yegg 4y ago
      I'm not sure which "app" you are referring to in this case, but generally private search is a key part of being private online. In every browser but Chrome, you can, however, subsequently change the search engine if you want. It's not our fault you can't do it in Chrome -- that is their restriction.
  - TekMol 4y ago
    I would not install an extension to give me a generated address. I would expect your website to give it to me. Putting generated addresses into forms... I would do that manually. If I really would do that multiple times a day (But who signs up for services so often?) I would use a bookmarklet for it. Bookmarklets are way less intrusive than extensions. And have other usability advantages. I can nicely put them into my bookmarks for example.
Andrew_nenakhov 4y ago
Interesting. Just noticed that DDG have removed a graph with traffic from their stats page [1]. I wonder if it is because the daily average stopped growing like it used to... [1]: https://duckduckgo.com/traffic https://duckduckgo.com/traffic
nashashmi 4y ago
What is DDG getting out of this "free" service?
- InCityDreams 4y ago
blitzo 4y ago
Can't launch Brave on incognito mode (Target path --incognito) after installing the extension.
deleted 4y ago
[deleted]
InCityDreams 4y ago
My grandad is still not convinced. What the absolute fuck does that all mean?
luhn 4y ago
Unfortunately, this seems to require the "DuckDuckGo Privacy Essentials" extension to use it in your browser, which for Chrome at least requires permission to "Read and change all your data on all websites." It's not clear to me why an extension is necessary at all, let alone an extension that much more broad than just email and requires such extensive permissions. https://chrome.google.com/webstore/detail/duckduckgo-privacy-essent/bkdgflcldnnnapblkhphbgpggdiikppg https://chrome.google.com/webstore/detail/duckduckgo-privacy...
- yegg 4y ago
  Addressed in other comment (and comments below it) on this thread here: https://news.ycombinator.com/item?id=32597463 https://news.ycombinator.com/item?id=32597463
megous 4y ago
"To protect your privacy send emails via yet another additional third party you have no control over." Makes no sense, despite the offered message content sanitization that should be best done in the MUA.
websap 4y ago
I need to install a browser extension to use an email forwarding service? What information could DDG read from my emails when forwarding? This blogpost does a REALLY POOR job to explain what, why and how to use this. Hope someone can clean this up and simplify what this service does.
noisy_boy 4y ago
Fastmail also has the feature of being able to generate throwaway email addresses for sign-ups and it doesn't require installation of any extension - they call it masked email in the settings[0]. Pretty happy with it. https://www.fastmail.com/settings/masked https://www.fastmail.com/settings/masked
BiteCode_dev 4y ago
It's a great idea, but unless they start by making it a real and popular email service first, it will be blocked by most websites very soon.
- neon_electro 4y ago
  We'll see! It's already my primary email for a few core services :) (I say primary because the others are still there as backup)
  - BiteCode_dev 4y ago
    Unfortunatly you have one try for the domain. I already use spamgourmet (a old great free service in the same features) and despite the fact it has several very different domains, it's rejected sometimes. Something as high profile as ddg will be flagged very quickly. The only one that can get away with it is gmail with the "+" aliases, because nobody can afford to reject it.
firloop 4y ago
This is cool - but I feel like to do this well you need to co-mingle valid and masked emails on the same domain. Otherwise services can and will prevent folks from signing up with @duck.com emails. Apple does this well with their email masking service; all emails have an @icloud.com domain, the same as primary emails. A service can't simply block @icloud.com without blocking millions of primary/default addresses.
ArrayBoundCheck 4y ago
The fact that this exist shows open source is bad. We should have had an alternative to email by now
laundermaf 4y ago
The pushback on the extension requirement is insane. Feels like you could have been advertised this as a “DDG App” feature and maybe that would have saved you a bit. As a Safari and Hide My Email user I completely welcome this service. If anything, it pushes more companies to do the same.
benbristow 4y ago
It's a good service and I've used it a few times, but the requirement to use an extension is a bit of a pain point. Especially as the extension seems to try and install some adblock style stuff which I already use ublock for and overwrites the default search engine with no option to disable it. Every time I need to generate a new email I need to re-enable the extension, copy the email address and then disable the extension again. Not nice UX.
- Vinnl 4y ago
  I could also generate an alias from the web UI (though maybe only with the extension installed?).
nine_k 4y ago
Another (useful) service that could have been run on client, and not have to allow access to the contents of my email to an unrelated company. Sadly, the current situation with mobile and desktop software makes it much easier to run this in a datacenter. Access to my email's content, and especially binding my identity on many web sites to the duck.com domain, likely is worth something, too.
yonrg 4y ago
The idea of on-demand addresses is great. I operate my mail server since 2006 now and implemented such feature straight away. I started to never use the same mail address again. name-something@domain just forwards to the inbox of name. After a time I lost track about all the addresses I "generated". But one thing was nice, I registered my mail with a hotline agent via phone. I told them my mail is name-$YOURCOMPANYNAME@domain. They replied, oh you are a colleague, then I can give you discount :)
- saimiam 4y ago
  How did you end up resolving the issue with too many generated emails addresses? I built and use my own domain inbox which buckets emails by email addresses (https://PretzelBox.cc https://PretzelBox.cc) but more and more, I find myself using just one or two email addresses.
  - megous 4y ago
    - Simple PHP web page for adding and listing existing aliases to/from a database. Adding a new alias has to be quick. Type in a description, and copy out the generated alias to clipboard for use elsewhere. - Startup script that fetches the aliases from DB and modifies a mail client configuration so that all randomly generated addresses are annotated with a short descriptive text indicating to whom the address was issued and makes it so that replying sets the From header to the alias. This combo works well for me.
    - yonrg 4y ago
      Actually, I do not actively generate, meaning create, a new addresses. I use a filter I'm the delivery process in Exim which truncates a suffix from the local name.
      - megous 4y ago
        Keeping track of addresses is still worth it, regardless of how they're implemented.
chenshuiluke 4y ago
Is there a way to integrate something like this with Bitwarden?
- Vinnl 4y ago
  Bitwarden does integrate with a couple of similar services: https://bitwarden.com/blog/add-privacy-and-security-using-email-aliases-with-bitwarden/ https://bitwarden.com/blog/add-privacy-and-security-using-em... (Disclosure: I work on one of them, Firefox Relay.)
NaturalPhallacy 4y ago
DDG declared themselves part of the Ministry Of Truth earlier this year and I jumped ship immediately to brave search: https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318 I will have nothing to do with any of their products and no longer recommend them to others.
- cedilla 4y ago
  I refuse to believe that anyone who thinks that 1984's main takeaway is that there is no objective truth and that any attempt to stand against propaganda is a greater crime than the propaganda lies themselves has actually read it. The problem with minitru is that 2 plus 2 does not, in fact, equal 5. It's not that saying one fact is true is somehow immoral.
  - NaturalPhallacy 4y ago
    >I refuse to believe that anyone who thinks that 1984's main takeaway is that there is no objective truth and that any attempt to stand against propaganda is a greater crime than the propaganda lies themselves has actually read it. The issue has never been about truth itself. It's always been that you should allow no single entity to be the arbiter of what is the truth, because everyone has an agenda, and organizations have multiple people with multiple agendas.
- yegg 4y ago
  I (the author of the tweet you referenced) commented on this subject on this thread here: https://news.ycombinator.com/item?id=32597340 https://news.ycombinator.com/item?id=32597340. We didn’t do that, e.g., we actually did not (and do not) censor anything for political purposes, we don’t do any URL-level fact checking, etc.
  - NaturalPhallacy 4y ago
    No one gets to be the decision maker on what is misinformation and what isn't. Nobody is the exception to that rule. No matter how good faith and good their intentions are. It's not how you're doing it, it's that you're trying to do it at all that is the problem.
aaaddaaaaa1112 4y ago
googlryas 4y ago
I'm not installing a brand new web browser, or a browser extension, in order to use an email forwarding service.
- TheRealNGenius 4y ago
- deleted 4y ago
  [deleted]
- TheRealNGenius 4y ago
  - dang 4y ago
    We've banned this account for repeatedly breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
m1117 4y ago
brbot 4y ago
Will DDG ever drop Bing index (yes, I've heard of mythical DDG crawler)? In current form, calling DDG a search engine is an overstatement, it's more like a Bing proxy. By a nature, what was censored in Bing is censored on DDG.
mike-cardwell 4y ago
Just tested this with https://www.emailprivacytester.com https://www.emailprivacytester.com Removed three trackers, but left several in place.
deleted 4y ago
[deleted]
gerash 4y ago
It seems like DuckDuckGo's raison d'etre is being "not Google". Personally, I don't care about these "evil tracking" where my screen size and user agent might get logged through some telemetry. What I'd pay for in an email client is a way for it to help me sort through the giant stream of stuff I constantly receive. For example when I buy something online I get 4 different email threads in Gmail: 1. order confirmation 2.it was shipped 3.it's arrived 4.fill up this survey I want my email client to cluster all those into one. Basically sift through my crap and summarize what's important and delete the unimportant stuff because I hate having to constantly keeping my inbox tidy.
tt_dev 4y ago
whats the catch?
srg0 4y ago
I’m using duck.com, Hide My Email and Firefox Relay. All work fine, but I think Firefox Relay has better UI to manage aliases: it has tags and can block promotional emails. And I like that it’s a paid service.
arealaccount 4y ago
It seems like the browser extension quietly changes your browsers default search engine to DuckDuckGo. Edit - I use DDG on several devices, but happen to not use it on the one where I installed this extension.
user3939382 4y ago
I’m sure I’m in the minority but after the recent thing where the CEO was explaining why they were delisting political news they didn’t like I’ll never trust them again.
- spindle 4y ago
  ABSOLUTELY. This shows fundamentally bad values. I've gone from recommending DDG to everyone to recommending other search engines.
BlueMachine 4y ago
What stops vendors from blocking @duck emails knowing it’s nothing more than an alias service?
hankchinaski 4y ago
i use anonaddy.com and create masked emails that forward to my address. Much easier and more convenient than having to install extensions
frasermarlow 4y ago
I love DDG but I never cease to wonder if the name itself is a barrier to adoption.
nigrioid 4y ago
Another wolf in sheep's clothing, just like Cloudflare. Puppies and rainbows and safety and privacy... all you have to do is channel all of your information through one entity! https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- GingerMidas 4y ago
  Email is inherently insecure, I don't see how this is worse.
  - nigrioid 4y ago
    It facilitates bulk data collection at a single point.
    - notyourwork 4y ago
      Ok, stop using email. Period. What’s your point exactly?
  - rtpg 4y ago
    “Email is not encrypted” and “all of your emails are relayed to another system” are largely different things with different threat models (I trust DDG as much as one can in this sort of system)
- woojoo666 4y ago
  Just like Apple too, who also released an email privacy service, thread here: [1] But comparing that thread with this one, people seem oddly more skeptical of DDG than they are with Apple Also, friendly reminder that Safari collects your browsing history and admits so in their TOS [2]. Whereas DDG merely has access, but says they do not collect anything [1]: https://news.ycombinator.com/item?id=30979563 https://news.ycombinator.com/item?id=30979563 [2]: https://news.ycombinator.com/item?id=32591775 https://news.ycombinator.com/item?id=32591775
TheArcane 4y ago
How's this different from apple's hide my email?
deleted 4y ago
[deleted]
nabakin 4y ago
I did a little digging into the source and discovered that every email sent by your email alias to your main email, includes a password capable of deactivating that email alias. Imagine you want to forward an email sent to you through an alias, to someone else. You've now given that person control over your email alias. Every email from an email alias includes a link. That link is used to look at the details of that email alias and gives you the option to deactivate it. You'd think there would be some login verification to prevent just anyone from using that link, but no, anyone that has this link, can now deactivate your email alias. The password itself is formatted in json, compressed with deflate, and simply tacked on to the end of the link's URL. When you click on the link, the destination webpage takes the end of the URL, decompresses the deflate, and serves a deactivate button to deactivate the email alias. When you click on that button, the email alias's address and password are sent to DDG's API and your email alias is disabled.
- myuzio 4y ago
  Another thing that worries me is that you can pretty much direct email to anybody without their consent, no verification is required from their side. Dream work for spammers and scammers.
  - nabakin 4y ago
    You mean, if you format the email in the right way, you can get your email alias to send an email to someone, before they send a single email to you?
    - myuzio 4y ago
      Let's say I have made an alias from bob@duck.com to bob@example.com, I don't need any verification from Bob to be allowed to do that. Therefore I can do stuff with that email now, including registering in websites with the duck email, and send emails to Bob from that website. Well I can't tell in how many ways that can be harmful, but for example if Bob is tricked to click to the legit link from the website and enter his personal information, then I can change the alias to my own email, reset the password and have full access to Bob's verified account, so yeah, that's one big flaw IMO.
deleted 4y ago
[deleted]
neodypsis 4y ago
How does it work? Does it rewrite the original email?
timvisee 4y ago
DuckDuckGo removing trackers. The company that had a hidden deal with Microsoft for tracking.
prokopton 4y ago
Been enjoying the same thing through Hey for a couple years now.
- benhurmarcel 4y ago
  Hey.com can generate unique email addresses for each website? I don't see any mention of that on their page, and it wasn't there when I tried it.
codethief 4y ago
> [donald@duck.com ] > That duck address is unavailable. Try something more unique. :(
ploppyploppy 4y ago
DDG's complicity in the censorship around COVID has me avoiding any & all they do forevermore. I also recommend family & friends who ask against using them, and advise my clients the same.
- hammyhavoc 4y ago
  Have you got any futher info regarding this? Not a DDG user, but first I'm hearing of it.
deleted 4y ago
[deleted]
flerovium 4y ago
Can you send from the DDG address?

Why does this email service require an extension/add-on?

DDG? Nah, I'll stick with Startmail (https://startmail.com https://startmail.com) - which is a paid service - until they do something to lose my trust.

2Gkashmiri 4y ago

i don't know man.... this sounds yet another service to subscribe to for what benefit? i have been selfhosting on racknerd for like last 2 years and beyond the first month, i have been pretty much put it on auto mode. i use mailinabox so i get to use roundcube and it has a banner "To protect your privacy remote resources have been blocked." this is by default for all links and images unless i explicitly allow someone so isn't that the same thing?

cmurf 4y ago

Does it pass "the mom test"? The people who need this kind of protection aren't as much HNers, but the friends and family of HNers.

siproprio 4y ago

Very cool, and even replying works!

sparrc 4y ago

Anyone have a writeup that doesn't require the browser extension?

bertman 4y ago
https://news.ycombinator.com/item?id=32596459 https://news.ycombinator.com/item?id=32596459

tuckerman 4y ago

I've eventually settled on using fastmail and their masked email feature which can create addresses on my own domain for this. I love DDG and appreciate anyone helping in this space to make email more manageable but I assume these addresses will be quickly blocked from many services just like the firefox relay addresses are. I wish there was a way for these relay services to be effective since they are much, much easier to get someone to use than telling them to just up and move from gmail to fastmail.

cscheid 4y ago
(I've been a happy paying customer of Fastmail for _years_ and I didn't know about masked email. Thank you!)
- tuckerman 4y ago
  Just in case you happen to be a 1Password user as well, there is an integration where they can auto-generate masked emails for you: https://support.1password.com/fastmail/ https://support.1password.com/fastmail/ It makes it very convenient!
  - alexchro93 4y ago
    Auto-generated masked emails using Fastmail and 1Password has worked very well for me when I'm using Firefox, with the 1Password extension installed, on my laptop. I can't for the life of me, however, figure out how to get 1Password to auto-gen a masked email from their iPhone app or desktop app. Is this possible?
  - someotherperson 4y ago
    Would love to see a Bitwarden implementation of this
- muhammadusman 4y ago
  You can also use a custom domain (and/or anything else Fastmail lets you choose), this way you can put all the randomly generated emails coming to you in a single folder (as a rule).

mxuribe 4y ago

The concept is great, and compared to other companies, i trust duckduckgo more...but, there still a for-profit company (nothing wrong with that)...so how will they sustain this? Maybe i'm not so smart with funding models, but i would feel better if there was some sort of pricing...to make me feel like as a user i'm not the product...am i paranoid for being suspicious?

raybb 4y ago

I wonder how the privacy aspects of this compare to Firefox Relay? Having used Firefox Relay a bit, I'm pretty happy with it but the free tier is relatively limited. DDG email seems to allow unlimited addresses but after a quick look it's not obvious that you can turn them off if an account is getting too much spam. https://relay.firefox.com/ https://relay.firefox.com/

freeAgent 4y ago
You can deactivate addresses pretty easily. Needing to install the DDG extension in order to generate them, however, is not great.

smotched 4y ago

I've completely switched to brave search for browsing, I can never trust DDG again.

thedorkknight 4y ago
What happened?
- djanogo 4y ago
  They started censoring websites based on "political fake news" filter list supplied by MSM.
  - Bilal_io 4y ago
    > based on "political fake news" filter list supplied by MSM Can you provide a citation for this?
    - behnamoh 4y ago
      Search HN, it was a big buzz recently.
      - rvz 4y ago
        DuckDuckGo's search manipulation is just no different to Google's since essentially they are using Microsoft Bing's search results. [0] So the manipulation, down-ranking and censoring of search results was inevitable with tons of evidence of this: [1][2][3][4] "At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation.": [1] At this point, DDG is a front for Microsoft using 'privacy' buzzwords. Might as well use Brave Search then. [0] https://help.duckduckgo.com/duckduckgo-help-pages/results/sources/ https://help.duckduckgo.com/duckduckgo-help-pages/results/so... [1] https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318 [2] https://www.vox.com/recode/22981115/duckduckgo-free-speech-privacy-oops https://www.vox.com/recode/22981115/duckduckgo-free-speech-p... [3] https://www.reddit.com/r/duckduckgo/comments/hx5dn5/proof_duckduckgo_manipulates_search_results_to/ https://www.reddit.com/r/duckduckgo/comments/hx5dn5/proof_du... [4] https://news.ycombinator.com/item?id=27395635 https://news.ycombinator.com/item?id=27395635

jrexilius 4y ago

Dear DuckDuckGo, Please let me pay for this service. It looks worth having and: 1) I'd like to know that it is funded by users, rather than advertisers and thus can resist privacy invasion presuures. 2) I'd like to have some basis for belief that it will be around longer than it takes the VC money to run out, (or the marketing budget, or whatever non-sustainable pot it comes from).

scoot 4y ago
(Low cost) paid service, no browser extension: 33mail.com. Happy customer for well over ten years.
yegg 4y ago
DuckDuckGo has been profitable since 2014 through private search ads, and our company is not controlled or beholden to venture capital (or VC or other money). Our product vision is an "easy button" for privacy, an all-in-one privacy app. Email protection is part of that, along with search, browsing, etc. Put another way, we see email protection as part of our core product, and within our app we autofill duck addresses in email forms. We will take your comment into consideration, though we prefer free services where possible so more people can get privacy protection, which is in line with our mission. This service comes with it a set of privacy guarantees here: https://duckduckgo.com/email/privacy-guarantees https://duckduckgo.com/email/privacy-guarantees and we will not be putting ads on it.
- TopGreg 4y ago
- vinaypai 4y ago
  DDG has regularly raised money from VCs including a Series D about a year ago. https://www.crunchbase.com/organization/duck-duck-go/company_financials https://www.crunchbase.com/organization/duck-duck-go/company...
  - macNchz 4y ago

CA0DA 4y ago

Won't lots of services just start blocking *@duck.com email addresses now?

megapatch 4y ago
Then you don't use that service.
blibble 4y ago
most likely the only way the fastmail one works is there's paying customers on that domain (and a lot of them)
saimiam 4y ago
If that happens, check out https://PretzelBox.cc https://PretzelBox.cc (FD - my product) and get *@your-domain.com. They can’t block all domains other than gmail and outlook, can they?

shadowgovt 4y ago

This is a great idea, but it's going to take nearly zero time for companies to decide not to accept private duck addresses for business purposes. DDG is signing themselves up for a hard challenge, though I think they're up to it. Once you offer a service like this, you take upon yourself the burden of maximizing the outbound signal-noise ratio for emails, or you run the risk that other email providers identify your node as damaged and route around it. So they'll have to be on top of uses of their service for spam and aggressively police and kill those accounts. I'm excited to see what special sauce they're bringing to the field in this space.

TopGreg 4y ago

datavirtue 4y ago

No dots or underscores allowed?

neon_electro 4y ago
Probably on purpose to avoid firstnamelastname@, firstname.lastname@, and firstname_lastname@ variations being abused.

encryptluks2 4y ago

Just a note... an email anonymous relay that lets you use custom domains is a much better alternative if you ever plan on migrating away. SimpleLogin is open source and allows you to export the information so that if their service ever goes offline you have a backup and can recover your aliases.

Night_Thastus 4y ago

Could someone explain a bit about where this fits in? Is this an e-mail provider? A client? Something else? If I have X Provider and I access it using Y client (ie, Thunderbird), what exactly does this add/replace/enhance? Where does "Relay" fit in since some people here mention it?

jabroni_salad 4y ago
It looks like it is just a forwarder, so it doesn't replace your existing mail provider.
CharlesW 4y ago
It's a privacy-focused "email forwarding" service, which I think is synonymous with "email routing" service. Competitors would include Cloudflare¹ and Apple². ¹ https://blog.cloudflare.com/introducing-email-routing/ https://blog.cloudflare.com/introducing-email-routing/ ² https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/icloud https://support.apple.com/guide/icloud/what-you-can-do-with-...
- Night_Thastus 4y ago
  So I could set up a new e-mail address, have it forward to my existing e-mail address, and DDG does some filtering/spam protection before it does the forward?
deleted 4y ago
[deleted]

huangc10 4y ago

Came here for dmail, a gmail competitor. Semi disappointed but still liking this security feature though.

elliekelly 4y ago
Agreed. I’d really like a middle ground between proton and gmail. Something that’s easy enough to set up and won’t actively spy on me.
- InCityDreams 4y ago
  >won’t actively spy on me. Go on.....
- kovac 4y ago
  There are many of those. Runbox, fastmail, mailbox.org,...

pluc 4y ago

> Email Protection requires the DuckDuckGo extension in this browser. well, that's cool I guess

anonu 4y ago
It doesnt really need an extension... dark pattern
- pluc 4y ago
  You do if you want to autocomplete your email address in fields I guess, but I agree it isn't a very good reason for an extension. It's one of those convenience extension that, would it be made by any other company, I'd be very suspicious of.
  - deleted 4y ago
    [deleted]

gkoberger 4y ago

For people who aren't sure what this does: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo... EDIT: The site has been updated to point to this!

gregmac 4y ago
Is there any tracking other than images? I do "Block all images" in email anyway, would I gain anything (in terms of tracking protection) from this?
mijowi 4y ago
Email tracking is just done through image downloads right? So if images are blocked by default then tracking isn’t possible? Image blocking is easy enough to do.

pluc 4y ago

Feels like it tries to solve the same problems as Mozilla Relay [1] (they call it Firefox Relay, but the addresses are @mozmail.com soooo) except Mozilla lets you attribute specific aliases for things. 1 https://relay.firefox.com/ https://relay.firefox.com/

laundermaf 4y ago
Good to see more like it, but having only 5 addresses for free feels like DOA now. Even during the waitlist they didn’t increase the number, kinda shameful.
- tintedfireglass 4y ago
  I mean, anonaddy and simple login also give only 10 and 15 free aliases respectively.
  - ffpip 4y ago
    Anonaddy gives you unlimited aliases for free. https://anonaddy.com/#pricing https://anonaddy.com/#pricing

baobob 4y ago

You have to install a browser extension to use email? Who had this bright idea?

pierrebeaucamp 4y ago

> Email Protection is not available in this browser. I'm surprised to see that Safari is not supported.

laundermaf 4y ago
Safari already has Hide My Email, assuming you’re already laying $60/year for iCloud.

TopGreg 4y ago

milkoolong 4y ago

I was able to generate a random private duck address (o8oyr2f8@duck.com) that's connected to my name@duck.com which then forwards to my personal gmail. I can change the forwarding address too which helps when I move from gmail to a private-er service. Please send me your best educational spams at the address above. It will self-destruct shortly when I generate a new private address. Really cool to see more offerings like these.

lijogdfljk 4y ago

I have this with FastMail - it's really cool. Even has 1Password integration to automatically create the emails.

Osmium 4y ago

Bystander impression from other comments I've read on DuckDuckGo posts recently: they have good intentions but behind-the-scenes are a bit less rigorous on privacy than would be ideal. Is this an accurate impression from anyone who knows more? For example, see discussion in this thread[0]. Even though the article itself seemed misleading, many commenters raised some good points. [0] https://news.ycombinator.com/item?id=31490515 https://news.ycombinator.com/item?id=31490515

monetus 4y ago
They have pushed that contract to the limit thankfully. You can load up Firefox with ad blockers and then compare and contrast with their browser. They do as well as allowed, and have extra value adds. More well intentioned than brave imo.
- doodlesdev 4y ago

yubiox 4y ago

You need to put your real address as the from address in replies, not the duck address. DuckDG then strips out the real one and replaces it with the duck one, it seems.

solarkraft 4y ago

Opening in Firefox on Android: > Email Protection is not available in this browser > Email Protection is also available on desktop with the DuckDuckGo app for Mac (beta), as well as DuckDuckGo extensions for Firefox, Chrome, Brave, and Edge. What, I need to install a piece of software to my computer or an extension to my browser to use a service? That's invasive and, without a very good explanation (that is nowhere to be seen on that page), massively hurts my trust in the company.

yegg 4y ago
The original link was never meant to be linked to directly -- and has now been replaced with the announcement post.
- solarkraft 4y ago
  Okay, but that's not an explanation. > That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system. This is a satisfactory explanation. But it's neither on the signup page, nor on the announcement page. ... and it's still really easy to accuse you of just trying to get some app installs - which would be fine if you admitted it.

BobMit 4y ago

Does it work without installing the extension?

therealmarv 4y ago

There is absolutely NO reason to use only an extension or app for that. I don't trust extensions. OSS alternative with freemium/paid subscription model (but without email tracker removal unfortunately) https://anonaddy.com https://anonaddy.com

3np 4y ago
There is also SimpleLogin. https://simplelogin.io/ https://simplelogin.io/ https://github.com/simple-login/app https://github.com/simple-login/app AA and SL do look like the two more solid options compared to anything else I've seen so far.
- jaden 4y ago
  SimpleLogin was recently acquired by Proton [1]. I'm hoping nothing changes, but you never know. [1] https://simplelogin.io/blog/simplelogin-join-proton/ https://simplelogin.io/blog/simplelogin-join-proton/
- sha-3 4y ago
  SimpleLogin was bought by Proton[0], so if you have a Proton Unlimited, Business or Visionary plan, you'll get SimpleLogin premium for free. [0]: https://proton.me/news/proton-and-simplelogin-join-forces https://proton.me/news/proton-and-simplelogin-join-forces
tao_oat 4y ago
I'm working on a similar project: https://shroud.email/ https://shroud.email/ It doesn't yet have all the same features as SimpleLogin/AnonAddy, but unlike them it does remove email trackers.
Vinnl 4y ago
Coincidentally we just this week added tracker removal to https://relay.firefox.com/ https://relay.firefox.com/ (needs to be explicitly enabled due to the risk of breakage). I should note though, that while it is open source (and freemium), it's reliant on quite some infra that makes it pretty much impossible to self-host, if that's something you're looking to do.

cguess 4y ago

Cool, but no Safari support?

laundermaf 4y ago
Safari extensions are a PITA compared to the others. However considering that they already have apps in the store, I assume they will start including the extension at some point.

oftenwrong 4y ago

If you are interested in the "unlimited unique private email addresses" functionality, also take a look at these other services: https://33mail.com/ https://33mail.com/ https://anonaddy.com/ https://anonaddy.com/ https://burnermail.io/ https://burnermail.io/ https://relay.firefox.com/ https://relay.firefox.com/ https://simplelogin.io/ https://simplelogin.io/ These all support custom domains, except for Firefox Relay, which only supports a custom subdomain.

saimiam 4y ago
I’m building https://pretzelbox.cc https://pretzelbox.cc which is like mailinator for your own domain. While it doesn’t generate email addresses for you, since it’s a domain inbox, you can use whatever string@you-domain.com to make it work. It’s getting a bit of traction even with the rubbish website :).

ctrlmeta 4y ago

I don't understand why it needs me to install a browser extension. That's a very weird requirement to sign up for an email address? Could someone explain why an extension is needed or why it was designed like this?

deleted 4y ago

[deleted]

drstewart 4y ago

I can't think of a situation where I'd want to use this - if I don't trust the provider, I'm using a throwaway email like mailinator.com. Curious to hear about what use cases this would fall into?

saimiam 4y ago
If you want to take it to next level after mailinator.com, I’m building https://pretzelbox.cc https://pretzelbox.cc - an inbox for your domain. Use whatever string@your-domain.com and we’ll forward emails to your linked email account.

TekMol 4y ago

Prompting the user to install a browser extension to use an email forwarder looks like a dark pattern to me. This lowers my trust in DDG. It's the same approach all companies use, once they grow. "Everyone is telling you they are the good guys, but they are throwing invasive technology at you! Fight back! ... by installing our invasive technology! Trust us, we are the good guys!"

yegg 4y ago
We offer an all-in-one privacy app. The extension/app generates the addresses and autofills them into email forms, and so you need the extension/app for those key parts of the functionality. Once signed up you can use it somewhat though without the extension/app by giving out your personal duck address directly, and trackers will be stripped from messages sent to it and then forwarded to your regular inbox. That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system.
- Agrue8u 4y ago
  But the app changes my default search page and new tab home page without my permission. I installed the app to get my duck email address then immediately disabled it.
  - yegg 4y ago
    I'm not sure which "app" you are referring to in this case, but generally private search is a key part of being private online. In every browser but Chrome, you can, however, subsequently change the search engine if you want. It's not our fault you can't do it in Chrome -- that is their restriction.
- TekMol 4y ago
  I would not install an extension to give me a generated address. I would expect your website to give it to me. Putting generated addresses into forms... I would do that manually. If I really would do that multiple times a day (But who signs up for services so often?) I would use a bookmarklet for it. Bookmarklets are way less intrusive than extensions. And have other usability advantages. I can nicely put them into my bookmarks for example.

Andrew_nenakhov 4y ago

Interesting. Just noticed that DDG have removed a graph with traffic from their stats page [1]. I wonder if it is because the daily average stopped growing like it used to... [1]: https://duckduckgo.com/traffic https://duckduckgo.com/traffic

nashashmi 4y ago

What is DDG getting out of this "free" service?

InCityDreams 4y ago

blitzo 4y ago

Can't launch Brave on incognito mode (Target path --incognito) after installing the extension.

deleted 4y ago

[deleted]

InCityDreams 4y ago

My grandad is still not convinced. What the absolute fuck does that all mean?

luhn 4y ago

Unfortunately, this seems to require the "DuckDuckGo Privacy Essentials" extension to use it in your browser, which for Chrome at least requires permission to "Read and change all your data on all websites." It's not clear to me why an extension is necessary at all, let alone an extension that much more broad than just email and requires such extensive permissions. https://chrome.google.com/webstore/detail/duckduckgo-privacy-essent/bkdgflcldnnnapblkhphbgpggdiikppg https://chrome.google.com/webstore/detail/duckduckgo-privacy...

yegg 4y ago
Addressed in other comment (and comments below it) on this thread here: https://news.ycombinator.com/item?id=32597463 https://news.ycombinator.com/item?id=32597463

megous 4y ago

"To protect your privacy send emails via yet another additional third party you have no control over." Makes no sense, despite the offered message content sanitization that should be best done in the MUA.

websap 4y ago

I need to install a browser extension to use an email forwarding service? What information could DDG read from my emails when forwarding? This blogpost does a REALLY POOR job to explain what, why and how to use this. Hope someone can clean this up and simplify what this service does.

noisy_boy 4y ago

Fastmail also has the feature of being able to generate throwaway email addresses for sign-ups and it doesn't require installation of any extension - they call it masked email in the settings[0]. Pretty happy with it. https://www.fastmail.com/settings/masked https://www.fastmail.com/settings/masked

BiteCode_dev 4y ago

It's a great idea, but unless they start by making it a real and popular email service first, it will be blocked by most websites very soon.

neon_electro 4y ago
We'll see! It's already my primary email for a few core services :) (I say primary because the others are still there as backup)
- BiteCode_dev 4y ago
  Unfortunatly you have one try for the domain. I already use spamgourmet (a old great free service in the same features) and despite the fact it has several very different domains, it's rejected sometimes. Something as high profile as ddg will be flagged very quickly. The only one that can get away with it is gmail with the "+" aliases, because nobody can afford to reject it.

firloop 4y ago

This is cool - but I feel like to do this well you need to co-mingle valid and masked emails on the same domain. Otherwise services can and will prevent folks from signing up with @duck.com emails. Apple does this well with their email masking service; all emails have an @icloud.com domain, the same as primary emails. A service can't simply block @icloud.com without blocking millions of primary/default addresses.

ArrayBoundCheck 4y ago

The fact that this exist shows open source is bad. We should have had an alternative to email by now

laundermaf 4y ago

The pushback on the extension requirement is insane. Feels like you could have been advertised this as a “DDG App” feature and maybe that would have saved you a bit. As a Safari and Hide My Email user I completely welcome this service. If anything, it pushes more companies to do the same.

benbristow 4y ago

It's a good service and I've used it a few times, but the requirement to use an extension is a bit of a pain point. Especially as the extension seems to try and install some adblock style stuff which I already use ublock for and overwrites the default search engine with no option to disable it. Every time I need to generate a new email I need to re-enable the extension, copy the email address and then disable the extension again. Not nice UX.

Vinnl 4y ago
I could also generate an alias from the web UI (though maybe only with the extension installed?).

nine_k 4y ago

Another (useful) service that could have been run on client, and not have to allow access to the contents of my email to an unrelated company. Sadly, the current situation with mobile and desktop software makes it much easier to run this in a datacenter. Access to my email's content, and especially binding my identity on many web sites to the duck.com domain, likely is worth something, too.

yonrg 4y ago

The idea of on-demand addresses is great. I operate my mail server since 2006 now and implemented such feature straight away. I started to never use the same mail address again. name-something@domain just forwards to the inbox of name. After a time I lost track about all the addresses I "generated". But one thing was nice, I registered my mail with a hotline agent via phone. I told them my mail is name-$YOURCOMPANYNAME@domain. They replied, oh you are a colleague, then I can give you discount :)

saimiam 4y ago
How did you end up resolving the issue with too many generated emails addresses? I built and use my own domain inbox which buckets emails by email addresses (https://PretzelBox.cc https://PretzelBox.cc) but more and more, I find myself using just one or two email addresses.
- megous 4y ago
  - Simple PHP web page for adding and listing existing aliases to/from a database. Adding a new alias has to be quick. Type in a description, and copy out the generated alias to clipboard for use elsewhere. - Startup script that fetches the aliases from DB and modifies a mail client configuration so that all randomly generated addresses are annotated with a short descriptive text indicating to whom the address was issued and makes it so that replying sets the From header to the alias. This combo works well for me.
  - yonrg 4y ago
    Actually, I do not actively generate, meaning create, a new addresses. I use a filter I'm the delivery process in Exim which truncates a suffix from the local name.
    - megous 4y ago
      Keeping track of addresses is still worth it, regardless of how they're implemented.

chenshuiluke 4y ago

Is there a way to integrate something like this with Bitwarden?

Vinnl 4y ago
Bitwarden does integrate with a couple of similar services: https://bitwarden.com/blog/add-privacy-and-security-using-email-aliases-with-bitwarden/ https://bitwarden.com/blog/add-privacy-and-security-using-em... (Disclosure: I work on one of them, Firefox Relay.)

NaturalPhallacy 4y ago

DDG declared themselves part of the Ministry Of Truth earlier this year and I jumped ship immediately to brave search: https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318 I will have nothing to do with any of their products and no longer recommend them to others.

cedilla 4y ago
I refuse to believe that anyone who thinks that 1984's main takeaway is that there is no objective truth and that any attempt to stand against propaganda is a greater crime than the propaganda lies themselves has actually read it. The problem with minitru is that 2 plus 2 does not, in fact, equal 5. It's not that saying one fact is true is somehow immoral.
- NaturalPhallacy 4y ago
  >I refuse to believe that anyone who thinks that 1984's main takeaway is that there is no objective truth and that any attempt to stand against propaganda is a greater crime than the propaganda lies themselves has actually read it. The issue has never been about truth itself. It's always been that you should allow no single entity to be the arbiter of what is the truth, because everyone has an agenda, and organizations have multiple people with multiple agendas.
yegg 4y ago
I (the author of the tweet you referenced) commented on this subject on this thread here: https://news.ycombinator.com/item?id=32597340 https://news.ycombinator.com/item?id=32597340. We didn’t do that, e.g., we actually did not (and do not) censor anything for political purposes, we don’t do any URL-level fact checking, etc.
- NaturalPhallacy 4y ago
  No one gets to be the decision maker on what is misinformation and what isn't. Nobody is the exception to that rule. No matter how good faith and good their intentions are. It's not how you're doing it, it's that you're trying to do it at all that is the problem.

aaaddaaaaa1112 4y ago

googlryas 4y ago

I'm not installing a brand new web browser, or a browser extension, in order to use an email forwarding service.

TheRealNGenius 4y ago
deleted 4y ago
[deleted]
TheRealNGenius 4y ago
- dang 4y ago
  We've banned this account for repeatedly breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.

m1117 4y ago

brbot 4y ago

Will DDG ever drop Bing index (yes, I've heard of mythical DDG crawler)? In current form, calling DDG a search engine is an overstatement, it's more like a Bing proxy. By a nature, what was censored in Bing is censored on DDG.

mike-cardwell 4y ago

Just tested this with https://www.emailprivacytester.com https://www.emailprivacytester.com Removed three trackers, but left several in place.

deleted 4y ago

[deleted]

gerash 4y ago

It seems like DuckDuckGo's raison d'etre is being "not Google". Personally, I don't care about these "evil tracking" where my screen size and user agent might get logged through some telemetry. What I'd pay for in an email client is a way for it to help me sort through the giant stream of stuff I constantly receive. For example when I buy something online I get 4 different email threads in Gmail: 1. order confirmation 2.it was shipped 3.it's arrived 4.fill up this survey I want my email client to cluster all those into one. Basically sift through my crap and summarize what's important and delete the unimportant stuff because I hate having to constantly keeping my inbox tidy.

tt_dev 4y ago

whats the catch?

srg0 4y ago

I’m using duck.com, Hide My Email and Firefox Relay. All work fine, but I think Firefox Relay has better UI to manage aliases: it has tags and can block promotional emails. And I like that it’s a paid service.

arealaccount 4y ago

It seems like the browser extension quietly changes your browsers default search engine to DuckDuckGo. Edit - I use DDG on several devices, but happen to not use it on the one where I installed this extension.

user3939382 4y ago

I’m sure I’m in the minority but after the recent thing where the CEO was explaining why they were delisting political news they didn’t like I’ll never trust them again.

spindle 4y ago
ABSOLUTELY. This shows fundamentally bad values. I've gone from recommending DDG to everyone to recommending other search engines.

BlueMachine 4y ago

What stops vendors from blocking @duck emails knowing it’s nothing more than an alias service?

hankchinaski 4y ago

i use anonaddy.com and create masked emails that forward to my address. Much easier and more convenient than having to install extensions

frasermarlow 4y ago

I love DDG but I never cease to wonder if the name itself is a barrier to adoption.

nigrioid 4y ago

Another wolf in sheep's clothing, just like Cloudflare. Puppies and rainbows and safety and privacy... all you have to do is channel all of your information through one entity! https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A

GingerMidas 4y ago
Email is inherently insecure, I don't see how this is worse.
- nigrioid 4y ago
  It facilitates bulk data collection at a single point.
  - notyourwork 4y ago
    Ok, stop using email. Period. What’s your point exactly?
- rtpg 4y ago
  “Email is not encrypted” and “all of your emails are relayed to another system” are largely different things with different threat models (I trust DDG as much as one can in this sort of system)
woojoo666 4y ago
Just like Apple too, who also released an email privacy service, thread here: [1] But comparing that thread with this one, people seem oddly more skeptical of DDG than they are with Apple Also, friendly reminder that Safari collects your browsing history and admits so in their TOS [2]. Whereas DDG merely has access, but says they do not collect anything [1]: https://news.ycombinator.com/item?id=30979563 https://news.ycombinator.com/item?id=30979563 [2]: https://news.ycombinator.com/item?id=32591775 https://news.ycombinator.com/item?id=32591775

TheArcane 4y ago

How's this different from apple's hide my email?

deleted 4y ago

[deleted]

nabakin 4y ago

I did a little digging into the source and discovered that every email sent by your email alias to your main email, includes a password capable of deactivating that email alias. Imagine you want to forward an email sent to you through an alias, to someone else. You've now given that person control over your email alias. Every email from an email alias includes a link. That link is used to look at the details of that email alias and gives you the option to deactivate it. You'd think there would be some login verification to prevent just anyone from using that link, but no, anyone that has this link, can now deactivate your email alias. The password itself is formatted in json, compressed with deflate, and simply tacked on to the end of the link's URL. When you click on the link, the destination webpage takes the end of the URL, decompresses the deflate, and serves a deactivate button to deactivate the email alias. When you click on that button, the email alias's address and password are sent to DDG's API and your email alias is disabled.

myuzio 4y ago
Another thing that worries me is that you can pretty much direct email to anybody without their consent, no verification is required from their side. Dream work for spammers and scammers.
- nabakin 4y ago
  You mean, if you format the email in the right way, you can get your email alias to send an email to someone, before they send a single email to you?
  - myuzio 4y ago
    Let's say I have made an alias from bob@duck.com to bob@example.com, I don't need any verification from Bob to be allowed to do that. Therefore I can do stuff with that email now, including registering in websites with the duck email, and send emails to Bob from that website. Well I can't tell in how many ways that can be harmful, but for example if Bob is tricked to click to the legit link from the website and enter his personal information, then I can change the alias to my own email, reset the password and have full access to Bob's verified account, so yeah, that's one big flaw IMO.

deleted 4y ago

[deleted]

neodypsis 4y ago

How does it work? Does it rewrite the original email?

timvisee 4y ago

DuckDuckGo removing trackers. The company that had a hidden deal with Microsoft for tracking.

prokopton 4y ago

Been enjoying the same thing through Hey for a couple years now.

benhurmarcel 4y ago
Hey.com can generate unique email addresses for each website? I don't see any mention of that on their page, and it wasn't there when I tried it.

codethief 4y ago

> [donald@duck.com ] > That duck address is unavailable. Try something more unique. :(

ploppyploppy 4y ago

DDG's complicity in the censorship around COVID has me avoiding any & all they do forevermore. I also recommend family & friends who ask against using them, and advise my clients the same.

hammyhavoc 4y ago
Have you got any futher info regarding this? Not a DDG user, but first I'm hearing of it.

deleted 4y ago

[deleted]

flerovium 4y ago

Can you send from the DDG address?