9 ms·

Tell HN: DuckDuckGo's privacy extension is adding an inline popup to web forms

I didn't really believe my eyes when I saw it the first time, I thought it had to be some ad specific to the website. But it appears every form accepting an email on any website I visit now gets a small duck icon next to it that pops up a big bold-print message box to "Protect your inbox " complete with a cheeky prompt to either "get email protection" or "maybe later." Refusal is not even an option. This is definitely new for me as of today.[0] I found DuckDuckGo via Hackernews and have generally been a happy user of both the search engine and the privacy extension. Why could they possibly be doing this? It seems like a self-destructive act from a branding standpoint, I can't imagine their target customer demographic is amicable to this kind of thing. [0]https://i.redd.it/p1tcoikka0ka1.png https://i.redd.it/p1tcoikka0ka1.png Edit: It's even on Hackernews! I genuinely can't recall a browser extension acting like this since the mid-00s adware toolbar days. https://i.imgur.com/vYjZAUK.png https://i.imgur.com/vYjZAUK.png Edit again: This post originally just said "injecting ads into web forms," I edited the title to clarify - apologies if that was misleading.

Dylan13hewtt 4y ago
[flagged]
Dylan13hewtt 4y ago
[flagged]
do66o 4y ago
Besides this, I have given up using mail protection because I find it very unpleasant to be forced to use browser extensions and search engines when I only want to use DuckDuckGo's mail protection.
JaggedJax 4y ago
After clicking "Maybe Later" I get a "Don't Ask Again" option after that, so it's possible, but harder than it should be. This is definitely bad practice. I don't feel like this should be enabled by default. It would be fine for them to advertise it when you click on the extension asking you to turn it on, but not inline on every email form with a double opt-out.
jeffbee 4y ago
DDG "Privacy Essentials" is a highly privileged extension that can do absolutely anything with all of your private data. Installing it is among the worst ideas I can think of. This weird quirk is the least of its problems.
- yegg 4y ago
  We have a strict privacy policy and don't have any user-level data (e.g., search or browsing histories) at all. Our extension is designed to be the "easy button" for privacy, and as such, needs to pack in it a wide variety of Web Tracking Protections as enumerated at https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/ https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we... that require such permissions. We do not ask for any permissions that we do not need to make the privacy features of our extension work as promised.
  - matkoniecz 4y ago
    Given that you just claimed that blatant ad is not actually an ad, does not make your other claims seeming trustworthy. At this point all users should assume that you are lying also about not storing search histories matched to users.
    - jasonlotito 4y ago
      Part of this plugin is explicitly for doing this sort of thing. e.g. You install it and part of installing it, is for this email service. It's not promoting a new service. It's highlighting a feature of the thing you installed.
      - matkoniecz 4y ago
        Has extension mentioned obnoxious inline ads as one of things it will be doing?
        thundermuffin 4y ago
sergiotapia 4y ago
Be grateful there's not a big purple monkey jumping around your screen!
- codetrotter 4y ago
  Good ol’ BonziBuddy
- thefourthchime 4y ago
  I worked for a company that made an ad with a 3d model of a 777 flying out of the browser it was so intrusive and bad it would nearly crash your machine. How did they get away with this? A secret browser extension that was installed with AOL’s AIM. which even if you didn't install came with plenty of windows machines preinstalled. We had some 100k users because of this. Nearly everyone I knew had this junk installed. Edit: this was in 2002 in the wake of the dotcom crash, I had been laid off from my previous job and couldn't find anything for 8 months. The company went bust a couple years later.
curiousfab 4y ago
The description of this extension explicitly tells you it will do this (integrated email protection). Works as advertised?
- misnome 4y ago
  Did the extension always say that? Including people who didn’t install it this week? Is it at all possible that this is a feature they added and hasn’t been there (and advertised) from the very beginning?
  - Vinnl 4y ago
    At least since June, it seems: https://web.archive.org/web/20220703202920/https://addons.mozilla.org/en-GB/firefox/addon/duckduckgo-for-firefox/ https://web.archive.org/web/20220703202920/https://addons.mo...
user3939382 4y ago
Maybe the CEO can jump on here again and give us a bunch of back-peddling double talk about how they’re misunderstood, as when they were caught censoring news results. I no longer trust DDG and switched to Kagi. Whether that’s better for privacy I’m not sure but at least their business is driven by user payments and not ads. That my quoted search terms don’t get blatantly ignored was actually the impetus to move.
- greendude29 4y ago
  > Maybe the CEO can jump on here again and give us a bunch of back-peddling double talk about how they’re misunderstood, as when they were caught censoring news results. I must have missed this, what's this about censoring news?
  - seanw444 4y ago
    I believe they're referring to when DDG announced they'd be doing something along the lines of deranking results that are pro-Russian, in context of the Ukraine-Russian war.
  - ChickenNugger 4y ago
    https://slate.com/technology/2022/03/duckduckgo-russian-disinformation-downranking.html https://slate.com/technology/2022/03/duckduckgo-russian-disi...
- yegg 4y ago
  It is simply not true that we have censored anything. I realize I previously explained how our news rankings work very poorly on Twitter, but I subsequently put out a clarification tweet[1] and then we made this help page with a much clearer (and detailed) explanation of how our news rankings work: https://help.duckduckgo.com/duckduckgo-help-pages/results/news-rankings/ https://help.duckduckgo.com/duckduckgo-help-pages/results/ne.... This is not "back-peddling"; it is the ground truth of what is actually going on with our news results. [1] "We are not ranking based on any political agenda or my (or anyone else's) personal political opinions. We are also not assessing any individual news stories." https://twitter.com/yegg/status/1515637392190935041 https://twitter.com/yegg/status/1515637392190935041
deleted 4y ago
[deleted]
yegg 4y ago
Founder/CEO of DuckDuckGo here. This title implies we are injecting third-party advertising into web forms, which is not the case. (Edit: that last sentence is now moot since the title has been updated. Thank you.) This is part of the onboarding for our optional DuckDuckGo Email Protection feature that comes with the extension. (Note if you just use our private search engine, you do not need our extension at all.) The feature generates email aliases for you on sign up forms (so you don't give out your real email address), which then forwards to your regular inbox with email trackers removed in the process: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo.... It is mentioned in the add-on description as one of the extension's primary features, e.g., at https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-fo.... (x-posting part of another comment here for context on this feature: Popping up a level, the goal of our product is to be the "easy button" for privacy, and email protection is a big part of it, since as we (and others) have gotten much better at web tracking protection (e.g., see https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/ https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we...), unscrupulous actors have done more and more email tracking, using your email address as a unique identifier to track you across sites and putting email trackers within emails to do similar.) Update: I am listening to the feedback presented here, though please know there is a whole team of people working on this feature, trying to bring needed email protection to our mainstream user base. Email protection as a concept is hard for people to understand and the team felt that this in-context onboarding was the best way to explain it. However, we will now revisit this given the feedback.
- mustacheemperor 4y ago
  Thank you for the response. I have edited the title to clarify it is a first-party advertisement for a DuckDuckGo service being placed alongside web forms. Seeing this notification appear once, in the extensions area as a popup from the DuckDuckGo extension, would feel much less outrageous. It does not feel like onboarding, it feels like an ad. It is an unexpected disruption of my browser's usual behavior.
  - 4y ago
TechnoJunky 4y ago
They're telling you that they can provide you with an email alias so you don't have to enter your legit email address. Using your legit email address on every site you register to helps them to track you. And you can turn off an email alias and spam to that address will stop.
greendude29 4y ago
I saw the headline on your post and felt horrified. I then read the details and I'm no longer horrified. There is a difference between advertising your own services vs injecting ads from other parties. Injecting ads from other parties could imply sharing of personal data which would be worrying. There is no breach of the DDG implicit user contract here which is low tracking and privacy.
- mustacheemperor 4y ago
  You likely saw it just before I edited the headline. I didn't realize at the time I posted it, but the original title definitely could give the impression they're injecting 3rd party ads. Personally, this feels 90% as annoying as a third party ad. But my intent was definitely not to mislead, I was hesitant to even make a post because I don't want to be a bad HN citizen by starting a thread that becomes an emotional bandwagon. I don't think there is a breach of DDG's contract but it it is a disappointing contrast to my expectations from DDG's brand, which I would expect to be more respectful of the user. This is disruptive.
yborg 4y ago
If you install the Firefox Relay extension it does exactly the same thing, which is what I want it to do.
- thefourthchime 4y ago
  Or use safari, they do the same thing for free and it works seamlessly with iPhone and mac
freedomben 4y ago
I noticed this about an hour ago as well. They're advertising their email alias feature and doing it (quite effectively) by injecting into email fields. I don't think the site matters, it's just on an email field. I think it's a little distastefeul to inject stuff into the user's page, but it's not an outrage worthy of bailing from DDG. I do hope they reconsider their approach though.
- wmeredith 4y ago
  It's so strange people are calling this advertising. It's functionality of a web browser plugin that you have to install. It literally one of the features on the extension's description page. "Enable Built-in Email Protection — Over 85% of emails sent to Duck Addresses contained trackers that can detect when you’ve opened a message, where you were when you opened it, and what device you were using. Email Protection makes it easy to block most email trackers and hide your existing address when signing up for things online, all without switching email providers."
  - freedomben 4y ago
    > It literally one of the features on the extension's description page. Yes, but just one of the features, and not one I've been using because I wasn't interested in it at the time. This is a classic "advertising" opportunity that companies do all the time called "upselling," and it's absolutely an ad because the whole point is to get me to start using a feature that I'm not currently using. I think many of the responses here have been overreactions, and "advertising" is definitely a dirty word on HN and gets some severe and undeserved knee-jerk reactions, but it is what it is.
  - mustacheemperor 4y ago
    This is at least the third similar reply I've read in this thread, so I'll just reiterate that this extension is much older than this feature, and at the time I installed this extension nothing about its description indicated it would ever behave like this. When I installed this, it was offered essentially as a PrivacyBadger alternative. The only notification to me that it was being changed to new kind of extension offering more services was the injection of an advertisement for those services into the form fields of webpages I visit. The existing extension already has a UI panel - it lives in the top right of my browser, under an icon. Plenty of other extensions have utilized this panel or a new tab page to respectfully inform me of changes to the offering. DuckDuckGo is the only extension that has decided to materially alter the contents of the webpages I visit without my consent to make such a notification.
autoexec 4y ago
It sure didn't take long for the Founder/CEO to show up to try to spin this. If they're lurking here it kind of makes me feel like they've been intentionally ignoring my constant complaining about their search not working correctly. Come on DDG lurkers, fix "-" so that searching for things like "Office -microsoft" or "apple -id" works correctly instead of returning results with "microsoft office" or "apple id" in the title and body! This is basic functionality we've had for years without issue! I don't know what broke it, but it's forcing me to G! far more often than I'd care to.
happybuy 4y ago
Sometimes the cure is worse than the disease. If you want privacy, it would be best practice to not install an extension that has complete read/write access to all of the pages that you browse.
- jraph 4y ago
  I don't know about DDG's extension, but if you want privacy, you definitely need an extension with a complete read/write access to all of the pages that you browse though. uBlock Origin would not be able to do its magic without this access. It needs to inspect and filter any request from any website, and to apply filters on the page too. This is what Chrome's Manifest v3 is killing by the way.
  - happybuy 4y ago
    There's other ways to do content / ad blocking without full read/write access to every web page you visit and every network request that is made. These other approaches do have limitations and may not be able to block everything but from a privacy perspective they are infinitely more secure than giving an extension full permissions.
    - jraph 4y ago
      > they are infinitely more secure than giving an extension full permissions Not at all, if they can't block everything uBlock Origin can block. I trust this extension infinitely more than the websites I visit. You can even install it from the package provided by Debian in its repositories [1] if you want an extra layer of review. [1] https://packages.debian.org/bookworm/webext-ublock-origin-firefox https://packages.debian.org/bookworm/webext-ublock-origin-fi...
aendruk 4y ago
Ads aside, injecting your UI into random sites sounds like a good way to train your users to get phished.
kmfrk 4y ago
I like the e-mail service, especially for newsletters, but the UX is also a little weird the other way around: I ended up disabling the feature by accident, because I didn't know it was tied to the privacy extension which I otherwise didn't feel I needed. As a former Opera user, I'm all about feature bundling, but it's a little unintuitive what you get, especially when you're using a different search engine than DDG. :) One issue I have with The Button is that tends to compete for space with other password manager buttons, but I don't know what the ideal solution is.
someotherperson 4y ago
I stopped using DDG a while ago. Brave is a much better option. Has similar bangs (i.e !g) and doesn't come with this nonsense.
- monetus 4y ago
  I love that most of the engines use bangs now. Brave has done some questionable things too though, from my point of view. The bat implementation has had some incidents significantly worse than this form fill, like when donations were rolled out and anyone could be donated to even if they didn't know brave existed or had a way to collect on those donations.
Croftengea 4y ago
It looks so weird! Especially when you see it on an email search field of a private CRM system.
- mustacheemperor 4y ago
  Seeing it come up next to the share field in a OneDrive repo containing some sensitive documentation really set off my alarm bells. Of course I logically know that this is not an information security risk, but it feels sketchy. I am surprised it was shipped, and frankly also surprised it hasn't been rolled back. Someone else in the thread raised the point that this kind of UX can snowblind novice users against future phishing attempts. I do appreciate that DDG is a company we can collectively engage with feedback like this in such a manner. I'm certainly not quitting them over this.
deleted 4y ago
[deleted]
reustle 4y ago
Meta: Often reminded how hard being a funded CEO must be. On one hand, he (CEO who replied here) probably has investors pushing and prodding about getting a return on the $172,000,000 (+?) that has been invested into the company. On the other hand, users are so easily spooked by moves like this (often rightly) and attack the company. This isn't even that bad of a case, though.
dstola 4y ago
If you use Alternate Player for Twitch DDG privacy extension was preventing it from connecting with twitch servers and lose quite a bit functionality as you would always stay logged out. Not sure why it was doing that, but just a PSA regarding same extension
- monetus 4y ago
  There is a VPN style ad blocker in the browser app, that must be the extension implementation.
wccrawford 4y ago
Yeah, despite the "explanation", that's still an ad being injected. No thanks. I uninstalled the extension a long time ago, and I've been mulling over just going back to Google search, and this has made that decision for me. It's not only a bad idea, it's a bad idea that has full support from the top of the company. Good bye, DDG.
deleted 4y ago
[deleted]
DueDilligence 4y ago
.. instantly uninstalled on all 125 of our lab workstations and to the CEO: in this current browsing environment, you are afforded ZERO chances to alter our trust and then out for good.
dean2432 4y ago
I think the DDG inline icon is handy and use it a lot to generate proxy emails.. That was why I installed the extension in the first place. Good stuff.

Dylan13hewtt 4y ago

[flagged]

Dylan13hewtt 4y ago

[flagged]

do66o 4y ago

Besides this, I have given up using mail protection because I find it very unpleasant to be forced to use browser extensions and search engines when I only want to use DuckDuckGo's mail protection.

JaggedJax 4y ago

After clicking "Maybe Later" I get a "Don't Ask Again" option after that, so it's possible, but harder than it should be. This is definitely bad practice. I don't feel like this should be enabled by default. It would be fine for them to advertise it when you click on the extension asking you to turn it on, but not inline on every email form with a double opt-out.

jeffbee 4y ago

DDG "Privacy Essentials" is a highly privileged extension that can do absolutely anything with all of your private data. Installing it is among the worst ideas I can think of. This weird quirk is the least of its problems.

yegg 4y ago
We have a strict privacy policy and don't have any user-level data (e.g., search or browsing histories) at all. Our extension is designed to be the "easy button" for privacy, and as such, needs to pack in it a wide variety of Web Tracking Protections as enumerated at https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/ https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we... that require such permissions. We do not ask for any permissions that we do not need to make the privacy features of our extension work as promised.
- matkoniecz 4y ago
  Given that you just claimed that blatant ad is not actually an ad, does not make your other claims seeming trustworthy. At this point all users should assume that you are lying also about not storing search histories matched to users.
  - jasonlotito 4y ago
    Part of this plugin is explicitly for doing this sort of thing. e.g. You install it and part of installing it, is for this email service. It's not promoting a new service. It's highlighting a feature of the thing you installed.
    - matkoniecz 4y ago
      Has extension mentioned obnoxious inline ads as one of things it will be doing?
      - thundermuffin 4y ago

sergiotapia 4y ago

Be grateful there's not a big purple monkey jumping around your screen!

codetrotter 4y ago
Good ol’ BonziBuddy
thefourthchime 4y ago
I worked for a company that made an ad with a 3d model of a 777 flying out of the browser it was so intrusive and bad it would nearly crash your machine. How did they get away with this? A secret browser extension that was installed with AOL’s AIM. which even if you didn't install came with plenty of windows machines preinstalled. We had some 100k users because of this. Nearly everyone I knew had this junk installed. Edit: this was in 2002 in the wake of the dotcom crash, I had been laid off from my previous job and couldn't find anything for 8 months. The company went bust a couple years later.

curiousfab 4y ago

The description of this extension explicitly tells you it will do this (integrated email protection). Works as advertised?

misnome 4y ago
Did the extension always say that? Including people who didn’t install it this week? Is it at all possible that this is a feature they added and hasn’t been there (and advertised) from the very beginning?
- Vinnl 4y ago
  At least since June, it seems: https://web.archive.org/web/20220703202920/https://addons.mozilla.org/en-GB/firefox/addon/duckduckgo-for-firefox/ https://web.archive.org/web/20220703202920/https://addons.mo...

user3939382 4y ago

Maybe the CEO can jump on here again and give us a bunch of back-peddling double talk about how they’re misunderstood, as when they were caught censoring news results. I no longer trust DDG and switched to Kagi. Whether that’s better for privacy I’m not sure but at least their business is driven by user payments and not ads. That my quoted search terms don’t get blatantly ignored was actually the impetus to move.

greendude29 4y ago
> Maybe the CEO can jump on here again and give us a bunch of back-peddling double talk about how they’re misunderstood, as when they were caught censoring news results. I must have missed this, what's this about censoring news?
- seanw444 4y ago
  I believe they're referring to when DDG announced they'd be doing something along the lines of deranking results that are pro-Russian, in context of the Ukraine-Russian war.
- ChickenNugger 4y ago
  https://slate.com/technology/2022/03/duckduckgo-russian-disinformation-downranking.html https://slate.com/technology/2022/03/duckduckgo-russian-disi...
yegg 4y ago
It is simply not true that we have censored anything. I realize I previously explained how our news rankings work very poorly on Twitter, but I subsequently put out a clarification tweet[1] and then we made this help page with a much clearer (and detailed) explanation of how our news rankings work: https://help.duckduckgo.com/duckduckgo-help-pages/results/news-rankings/ https://help.duckduckgo.com/duckduckgo-help-pages/results/ne.... This is not "back-peddling"; it is the ground truth of what is actually going on with our news results. [1] "We are not ranking based on any political agenda or my (or anyone else's) personal political opinions. We are also not assessing any individual news stories." https://twitter.com/yegg/status/1515637392190935041 https://twitter.com/yegg/status/1515637392190935041

deleted 4y ago

[deleted]

yegg 4y ago

Founder/CEO of DuckDuckGo here. This title implies we are injecting third-party advertising into web forms, which is not the case. (Edit: that last sentence is now moot since the title has been updated. Thank you.) This is part of the onboarding for our optional DuckDuckGo Email Protection feature that comes with the extension. (Note if you just use our private search engine, you do not need our extension at all.) The feature generates email aliases for you on sign up forms (so you don't give out your real email address), which then forwards to your regular inbox with email trackers removed in the process: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo.... It is mentioned in the add-on description as one of the extension's primary features, e.g., at https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-fo.... (x-posting part of another comment here for context on this feature: Popping up a level, the goal of our product is to be the "easy button" for privacy, and email protection is a big part of it, since as we (and others) have gotten much better at web tracking protection (e.g., see https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/ https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we...), unscrupulous actors have done more and more email tracking, using your email address as a unique identifier to track you across sites and putting email trackers within emails to do similar.) Update: I am listening to the feedback presented here, though please know there is a whole team of people working on this feature, trying to bring needed email protection to our mainstream user base. Email protection as a concept is hard for people to understand and the team felt that this in-context onboarding was the best way to explain it. However, we will now revisit this given the feedback.

mustacheemperor 4y ago
Thank you for the response. I have edited the title to clarify it is a first-party advertisement for a DuckDuckGo service being placed alongside web forms. Seeing this notification appear once, in the extensions area as a popup from the DuckDuckGo extension, would feel much less outrageous. It does not feel like onboarding, it feels like an ad. It is an unexpected disruption of my browser's usual behavior.
- 4y ago

TechnoJunky 4y ago

They're telling you that they can provide you with an email alias so you don't have to enter your legit email address. Using your legit email address on every site you register to helps them to track you. And you can turn off an email alias and spam to that address will stop.

greendude29 4y ago

I saw the headline on your post and felt horrified. I then read the details and I'm no longer horrified. There is a difference between advertising your own services vs injecting ads from other parties. Injecting ads from other parties could imply sharing of personal data which would be worrying. There is no breach of the DDG implicit user contract here which is low tracking and privacy.

mustacheemperor 4y ago
You likely saw it just before I edited the headline. I didn't realize at the time I posted it, but the original title definitely could give the impression they're injecting 3rd party ads. Personally, this feels 90% as annoying as a third party ad. But my intent was definitely not to mislead, I was hesitant to even make a post because I don't want to be a bad HN citizen by starting a thread that becomes an emotional bandwagon. I don't think there is a breach of DDG's contract but it it is a disappointing contrast to my expectations from DDG's brand, which I would expect to be more respectful of the user. This is disruptive.

yborg 4y ago

If you install the Firefox Relay extension it does exactly the same thing, which is what I want it to do.

thefourthchime 4y ago
Or use safari, they do the same thing for free and it works seamlessly with iPhone and mac

freedomben 4y ago

I noticed this about an hour ago as well. They're advertising their email alias feature and doing it (quite effectively) by injecting into email fields. I don't think the site matters, it's just on an email field. I think it's a little distastefeul to inject stuff into the user's page, but it's not an outrage worthy of bailing from DDG. I do hope they reconsider their approach though.

wmeredith 4y ago
It's so strange people are calling this advertising. It's functionality of a web browser plugin that you have to install. It literally one of the features on the extension's description page. "Enable Built-in Email Protection — Over 85% of emails sent to Duck Addresses contained trackers that can detect when you’ve opened a message, where you were when you opened it, and what device you were using. Email Protection makes it easy to block most email trackers and hide your existing address when signing up for things online, all without switching email providers."
- freedomben 4y ago
  > It literally one of the features on the extension's description page. Yes, but just one of the features, and not one I've been using because I wasn't interested in it at the time. This is a classic "advertising" opportunity that companies do all the time called "upselling," and it's absolutely an ad because the whole point is to get me to start using a feature that I'm not currently using. I think many of the responses here have been overreactions, and "advertising" is definitely a dirty word on HN and gets some severe and undeserved knee-jerk reactions, but it is what it is.
- mustacheemperor 4y ago
  This is at least the third similar reply I've read in this thread, so I'll just reiterate that this extension is much older than this feature, and at the time I installed this extension nothing about its description indicated it would ever behave like this. When I installed this, it was offered essentially as a PrivacyBadger alternative. The only notification to me that it was being changed to new kind of extension offering more services was the injection of an advertisement for those services into the form fields of webpages I visit. The existing extension already has a UI panel - it lives in the top right of my browser, under an icon. Plenty of other extensions have utilized this panel or a new tab page to respectfully inform me of changes to the offering. DuckDuckGo is the only extension that has decided to materially alter the contents of the webpages I visit without my consent to make such a notification.

autoexec 4y ago

It sure didn't take long for the Founder/CEO to show up to try to spin this. If they're lurking here it kind of makes me feel like they've been intentionally ignoring my constant complaining about their search not working correctly. Come on DDG lurkers, fix "-" so that searching for things like "Office -microsoft" or "apple -id" works correctly instead of returning results with "microsoft office" or "apple id" in the title and body! This is basic functionality we've had for years without issue! I don't know what broke it, but it's forcing me to G! far more often than I'd care to.

happybuy 4y ago

Sometimes the cure is worse than the disease. If you want privacy, it would be best practice to not install an extension that has complete read/write access to all of the pages that you browse.

jraph 4y ago
I don't know about DDG's extension, but if you want privacy, you definitely need an extension with a complete read/write access to all of the pages that you browse though. uBlock Origin would not be able to do its magic without this access. It needs to inspect and filter any request from any website, and to apply filters on the page too. This is what Chrome's Manifest v3 is killing by the way.
- happybuy 4y ago
  There's other ways to do content / ad blocking without full read/write access to every web page you visit and every network request that is made. These other approaches do have limitations and may not be able to block everything but from a privacy perspective they are infinitely more secure than giving an extension full permissions.
  - jraph 4y ago
    > they are infinitely more secure than giving an extension full permissions Not at all, if they can't block everything uBlock Origin can block. I trust this extension infinitely more than the websites I visit. You can even install it from the package provided by Debian in its repositories [1] if you want an extra layer of review. [1] https://packages.debian.org/bookworm/webext-ublock-origin-firefox https://packages.debian.org/bookworm/webext-ublock-origin-fi...

aendruk 4y ago

Ads aside, injecting your UI into random sites sounds like a good way to train your users to get phished.

kmfrk 4y ago

I like the e-mail service, especially for newsletters, but the UX is also a little weird the other way around: I ended up disabling the feature by accident, because I didn't know it was tied to the privacy extension which I otherwise didn't feel I needed. As a former Opera user, I'm all about feature bundling, but it's a little unintuitive what you get, especially when you're using a different search engine than DDG. :) One issue I have with The Button is that tends to compete for space with other password manager buttons, but I don't know what the ideal solution is.

someotherperson 4y ago

I stopped using DDG a while ago. Brave is a much better option. Has similar bangs (i.e !g) and doesn't come with this nonsense.

monetus 4y ago
I love that most of the engines use bangs now. Brave has done some questionable things too though, from my point of view. The bat implementation has had some incidents significantly worse than this form fill, like when donations were rolled out and anyone could be donated to even if they didn't know brave existed or had a way to collect on those donations.

Croftengea 4y ago

It looks so weird! Especially when you see it on an email search field of a private CRM system.

mustacheemperor 4y ago
Seeing it come up next to the share field in a OneDrive repo containing some sensitive documentation really set off my alarm bells. Of course I logically know that this is not an information security risk, but it feels sketchy. I am surprised it was shipped, and frankly also surprised it hasn't been rolled back. Someone else in the thread raised the point that this kind of UX can snowblind novice users against future phishing attempts. I do appreciate that DDG is a company we can collectively engage with feedback like this in such a manner. I'm certainly not quitting them over this.

deleted 4y ago

[deleted]

reustle 4y ago

Meta: Often reminded how hard being a funded CEO must be. On one hand, he (CEO who replied here) probably has investors pushing and prodding about getting a return on the $172,000,000 (+?) that has been invested into the company. On the other hand, users are so easily spooked by moves like this (often rightly) and attack the company. This isn't even that bad of a case, though.

dstola 4y ago

If you use Alternate Player for Twitch DDG privacy extension was preventing it from connecting with twitch servers and lose quite a bit functionality as you would always stay logged out. Not sure why it was doing that, but just a PSA regarding same extension

monetus 4y ago
There is a VPN style ad blocker in the browser app, that must be the extension implementation.

wccrawford 4y ago

Yeah, despite the "explanation", that's still an ad being injected. No thanks. I uninstalled the extension a long time ago, and I've been mulling over just going back to Google search, and this has made that decision for me. It's not only a bad idea, it's a bad idea that has full support from the top of the company. Good bye, DDG.

deleted 4y ago

[deleted]

DueDilligence 4y ago

.. instantly uninstalled on all 125 of our lab workstations and to the CEO: in this current browsing environment, you are afforded ZERO chances to alter our trust and then out for good.

dean2432 4y ago

I think the DDG inline icon is handy and use it a lot to generate proxy emails.. That was why I installed the extension in the first place. Good stuff.