14 ms·

PRISM fears give private search engine DuckDuckGo its best week ever

459 points by denzil_correa 13y ago

rednukleus 13y ago
Glad to see them succeeding, but personally the privacy of my web searches doesn't bother me - as long as they aren't being passed along with personally identifying information. I'm far more worried about emails, messaging, video, storage etc. Can someone explain to me (or point me in the direction of something that explains) what Google and Bing store in terms of tracking when you are not logged in? Obviously you can use VPNs or TOR to be really safe, but do you need to go that far if you want an untracked search on Google and Bing?
- bcoates 13y ago
  They have access to IP+time, your search query, and cookies for correlation to other requests. It's valuable information and Google openly documents that they are keeping and using it, along with anything else you leak to them: http://www.google.com/policies/privacy/ http://www.google.com/policies/privacy/ IP+time is enough to get your personal identity information from your ISP (physical location of the endpoint, billing information), I have no idea if Google's relationship with ISPs is good enough to buy that or if it's only available to cops.
  - jmillikin 13y ago
    > They have access to IP+time, your search query, and > cookies for correlation to other requests. It's > valuable information Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless. > IP+time is enough to get your personal identity > information from your ISP (physical location of the > endpoint, billing information), I have no idea if > Google's relationship with ISPs is good enough to > buy that or if it's only available to cops. Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification. I hope that ISPs do not release personal identity or billing data to arbitrary third parties. I know my ISP (sonic.net) claims they don't[1], and even privacy-insensitive companies such as AT&T have privacy policies that would forbid them from selling personal data[2]. Even if it were possible for random companies to obtain personal data from an ISP, I doubt that Google would have any interest in participating. [1] https://wiki.sonic.net/wiki/Category:Policies#Privacy https://wiki.sonic.net/wiki/Category:Policies#Privacy [2] http://www.att.com/gen/privacy-policy?pid=2506 http://www.att.com/gen/privacy-policy?pid=2506
    - infinity 13y ago
      >>Valuable for blackmail, but not really useful >>for anything else; the commercial value of >>information rapidly degrades over time. >>Knowing I want to buy a new fridge today is very >>valuable, knowing I wanted to buy one last month is >>nearly worthless. I think that blackmail is already bad enough. Considering which topics somebody might want to learn about on the internet, various diseases for example. >>I hope that ISPs do not release personal >>identity or billing data to arbitrary third parties. I hope that too. But this information is gathered and stored somewhere in flawed systems which are operated by humans which might decide to follow their own interests more than the interests of the customers. I know of at least one story where an employee of a search engine has been using his privileges to stalk other people.
    - icebraining 13y ago
      Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless. That depends on what they can get out of the data, besides the obvious. I'm thinking of the story about Target knowing that a girl was pregnant before even her father did[1]. Even longer trends can probably be derived, regarding personality traits, income, etc. That information is worth a lot even months or years after it was captured. [1]: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
    - saalweachter 13y ago
      I love targeted advertising because it is so blatantly obvious and hilariously over-optimistic. I search for a lot of random crap with more curiosity than intent to buy. I looked up the price for several windmills , the late 19th/early 20th century style, (~$1000, by the way). For weeks or months afterwards, I saw windmill ads on a sizable fraction of the websites I visited. To be fair, it's far more likely that I am going to by a windmill than a random ad viewer, but the probability is still staggeringly low. There had to be a hundred other products I was more likely to buy than the windmill, that would be more valuable to show me. But no! I had viewed their product and I! Must! Be! Targeted! I really wonder what the set of products that do well from targeted ads looks like.
- btian 13y ago
  Based on the leaked PRISM presentation, they could send your search log to NSA, and NSA can identify you based on your IP address that your ISP provides.
- infinity 13y ago
  The IP address from which you send your request to a search engines website may be regarded as a personally identifying information. In case that this information becomes publicly available the connection between your search terms and your IP address will be visible. In fact, this has happend in the past and there was a searchable database with the leaked information online where you could look up search terms. I don't know what data Google and Bing are collecting, but here is one quote from the wikipedia entry on internet privacy concerning the AOL search engine: A search engine takes all of its users and assigns each one a specific ID number. Those in control of the database often keep records of where on the Internet each member has traveled to. AOL’s system is one example. AOL has a database 21 million members deep, each with their own specific ID number. The way that AOLSearch is set up, however, allows for AOL to keep records of all the websites visited by any given member. Even though the true identity of the user isn’t known, a full profile of a member can be made just by using the information stored by AOLSearch. By keeping records of what people query through AOLSearch, the company is able to learn a great deal about them without knowing their names. Source: http://en.wikipedia.org/wiki/Internet_privacy http://en.wikipedia.org/wiki/Internet_privacy
- elorant 13y ago
  TOR is not that safe. If the exit node is compromised you’re f*cked for good. As for Google the thing is that they’re also an advertising network so basically they track you all around the web.
  - icebraining 13y ago
    If the exit node is compromised you’re fcked for good.* It's not that simple, otherwise there wouldn't be any value in using an Onion architecture. Assuming you're using HTTPS, which every decent search engine supports, they either also need to create a fake but acceptable certificate for the domain, or to also control entry nodes and match the entering requests with the exit ones. The NSA might be able to do it, but it's not just a matter of controlling an exit node.
  - betterunix 13y ago
    "TOR is not that safe. If the exit node is compromised you’re f*cked for good." Not if you are using TLS, which you should be using regardless of Tor.
  - Estragon 13y ago
    What threat are you referring to here? Takeovers through the browser via HTML injected by the exit node?
rasterizer 13y ago
At least you can't blame them for missing a PR opportunity: https://plus.google.com/+JeffJarvis/posts/5X7nHcjijsC https://plus.google.com/+JeffJarvis/posts/5X7nHcjijsC
dgesang 13y ago
Here is a non-US-based alternative: https://startpage.com https://startpage.com
- umsm 13y ago
  Just because they say they don't collect your info, it doesn't mean that google doesn't get it. Look at the source of a search page and you'll notice that they include scripts directly from google.com...
  - icebraining 13y ago
    Hum, neither NoScript nor a search in their source reveals such scripts. Can you point me to them?
    - umsm 13y ago
      Open up the source and search for google.com...
  - babby 13y ago
    Google assuredly gets info, just not from the user. There aren't any google requests from Firebug's net tab, either, so perhaps you are mistaken.
    - umsm 13y ago
      Google knows what you were searching for, when, and for how long...
jpdoctor 13y ago
Why would anyone believe that DuckDuckGo isn't already penetrated?
- jafaku 13y ago
  Because look at the logo and the design, that duck is cool! And it says it's private! /s
  - oneye 13y ago
    Or because their entire business differentiation from the beginning has been privacy. This does not mean that it is not compromised, of course. But its why people would believe it isn't compromised. And its a much better reason than your sarcastic imitation.
    - betterunix 13y ago
      "Or because their entire business differentiation from the beginning has been privacy." The same is true of Hushmail. How did that work out?
      - oneye 13y ago
        I have no idea. I (as I said) was not trying to assert that DuckDuckGo is not compromised, I was asserting that the reason that people believe it to be secure is because they've differentiated on privacy since the beginning. Mostly, I don't like seeing condescending, inaccurate statements.
        betterunix 13y ago
        Well, the Hushmail story is pretty famous: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ There is nothing inaccurate about claiming that people believe that DDG is protecting their privacy because of how the website presents itself and the claims made by the company. That is exactly why people believed (and many continue to believe) that Hushmail is protecting their privacy. The way companies advertise themselves is not necessarily reflective of reality.
dmix 13y ago
Chrome integration possible?
- kall 13y ago
  you can integrate any search engine into chrome by right clicking in the search field and picking "Add as Search Engine". Then you can go to Settings and make it your default.
- mmmelissa 13y ago
  this is a joke... right?
  - suyash 13y ago
    haha..I hope so..you need to use Firefox and not even Safari to be totally safe..even better Private Window browsing mode in Firefox.
oinksoft 13y ago
I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation. Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.
- jsingleton 13y ago
  I really like the how the goodies have improved (or at least the discoverability). There's some really useful / geeky stuff in there. https://duckduckgo.com/goodies#Science https://duckduckgo.com/goodies#Science https://duckduckgo.com/?q=how+much+magnesium+is+in+43+cubic+miles+of+fried+chicken https://duckduckgo.com/?q=how+much+magnesium+is+in+43+cubic+...
- hkmurakami 13y ago
  I second the observation that the results have improved considerably over the last year. There are still holes where I have to resort to using the !g option and use google (non-English searches would be the most prominent example) but I've set all my default search options to DDG and haven't regretted it!
- jpdoctor 13y ago
  > Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.
  - drakaal 13y ago
    http://www.samuru.com http://www.samuru.com is better for concise answers.
    - jpdoctor 13y ago
wnevets 13y ago
if the NSA is intercepting the communications, why would switching sites matter?
- marshray 13y ago
  1. The NSA isn't the only threat to privacy on the net. 2. DDG is SSL, so there's some hope that the traffic is not visible to a passive observer, even the NSA.
  - wnevets 13y ago
    Google is also SSL. There was a post on here a day or two ago with the theory that PRISM is really about intercepting and cracking SSL certs
aacook 13y ago
This is great news for DuckDuckGo and I'm all for it, however, DuckDuckGo isn't completely private right? From what I see, DuckDuckGo obtains much of its data from 3rd parties, such as Bing/Microsoft and Yahoo. http://help.duckduckgo.com/customer/portal/articles/216399-sources http://help.duckduckgo.com/customer/portal/articles/216399-s... "While our indexes are getting bigger, we do not expect to be wholly independent from third-parties. Bing and Google each spend hundreds of millions of dollars a year crawling and indexing the deep Web. It costs so much that even big companies like Yahoo and Ask are giving up general crawling and indexing. Therefore, it seems silly to compete on crawling and, besides, we do not have the money to do so. Instead, we've focused on building a better search engine by concentrating on what we think are long-term value-adds -- having way more instant answers, way less spam, real privacy and a better overall search experience."
- jaryd 13y ago
  While we do use 3rd parties to fulfill some of our organic results we always make those calls from our machines. We never pass along IP addresses. This means that while our other sources might see your queries, they are not tied with PII (personally identifiable information).
  - aacook 13y ago
    I misunderstood. Excellent.
- Skalman 13y ago
  I think you're not quite understanding how it works. They retrieve the data from e.g. Bing behind the scenes and the 3rd parties have no way to connect a query to an individual user. That said, maybe there'd be an issue if you enter personally identifiable information as a query. But who does that?
lurkinggrue 13y ago
Not that this is going to help. The NSA is probably tapping the fiber at the ISP's backbone in front of Google. Why do you think it is called PRISM? It's probably named for the way they are splitting the fiber and recording everything.
- zachrose 13y ago
  Or it could be an API for issuing FISA warrants and collecting the requested data. (The NSA may very well be doing both.)
  - lurkinggrue 13y ago
    They are probably doing both.
- adamtj 13y ago
  In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of "https://duckduckgo.com" https://duckduckgo.com", it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.
  - jackpirate 13y ago
    >Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.
    - betterunix 13y ago
      http://www.wired.com/threatlevel/2010/03/packet-forensics/ http://www.wired.com/threatlevel/2010/03/packet-forensics/
    - icebraining 13y ago
codereflection 13y ago
I've been using DDG for nearly a year now, and have rarely turned back to Google. I only do so when I really cannot find what I'm looking for on DDG, and I try to tell DDG about the bad results (which I've actually seen get fixed). Getting bad results happens infrequently though, so the benefit of using DDG really outweighs the occasional inconvenience.
suyash 13y ago
And as far as browser is concerned, I would recommend go with Firefox vs Google or Safari. Mozilla is a non profit and I feel I can trust it the most.
- hkmurakami 13y ago
  I take it you mean Firefox over Chrome or Safari? (I agree. The only thing I use Chrome for is Facebook)
  - suyash 13y ago
    even better prefer to use Private Window in Firefox. Chrome is only good for it's debugger so I rather prefer Canary.
- kostya-kow 13y ago
  The only safe thing to do would be to compile Firefox or Chromium yourself.
  - suyash 13y ago
    Well the safest of all would be to write your own highly secure browser and use TOR.
pschastain 13y ago
DDG is has been my primary search engine for about a year now, and I do what I can to proselytize for it. Their results aren't always as comprehensive as the bigger engines, but I can usually find what I need.
WestCoastJustin 13y ago
You can see the stats here: http://duckduckgo.com/traffic.html http://duckduckgo.com/traffic.html
paulsutter 13y ago
It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the_PRISM_presentation.jpg http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the slide), when "Upstream" access is just as big a concern. EDIT: rephrased my concern about direct vs upstream
- nwh 13y ago
  If you're using HTTPS, they can't even see your URLs or headers. That's sort of the point.
  - lurkinggrue 13y ago
    Email is unencrypted in transit.
    - eridius 13y ago
      What does that have to do with using a search engine? I'm pretty sure you aren't emailing them your queries.
      - skeletonjelly 13y ago
        Maybe that's all Stallman's queries
    - diminoten 13y ago
      ...unless you encrypt it.
    - bigiain 13y ago
      That's not universally true - there's a remarkable amount of TLS/SSL encrypted email-in-transit, either via STARTTLS ESMTP commands or SSL over port 465 (and 993/995 for IPAM and POP3). I don't think there's a way to guarantee your mail always travels over TLS/SSL secured connections, but I suspect more of it does than you think.
tocomment 13y ago
Is there a way to make ddg the default on the iPhone?
cinquemb 13y ago
Anyone else wondering if DDG will come out with their version of email? Maybe something that uses end to end encryption (maybe working together with Mozilla Foundation)?
- fourstar 13y ago
  This is where they would kill it. Search would be supplementary, but if they pivoted and focused on email (eventually rebranding it), then that's a home run in my book. I'd like to see this, and would be interested in beta testing if/when it happens.
- lignuist 13y ago
  I would prefer if someone else did it. Not because I do not trust DDG, but because I don't like the idea of one company providing everything (or too much). Why step into the footsteps of the dinosaurs?
  - cinquemb 13y ago
    Fair enough. >Why step into the footsteps of the dinosaurs? I'd think adding E2EE to email would be like what pagerank did to the search engine. Why build from the ground up when you can build on the shoulders of the giants?
    - lignuist 13y ago
      If only someone solved the problem of bringing PGP to the masses. Maybe the need has to reach a critical mass.
      - cinquemb 13y ago
        I agree, and that's why I was thinking that a company that is still growing and is known for their privacy practices could be good (beach-head?) at doing this (at least being able to advertise it on their own services to get some traction and feedback). It's not like google or anyone else is going to do it. And looking at DDG traffic, it seems like it is a growing need. Then again, how to you monetize encrypted emails? contextual encyrpted ads? ;)
bpatrianakos 13y ago
I have a private writing app and I can confirm that this NSA thing has been good for me too and I'm betting lots of services concerned with privacy. I saw a 5X increase in users in the past week and reviews in blogs are getting more numerous. I wonder though if now all services regardless of their real focus will start marketing privacy as a feature and muddy the waters, making it hard for consumers to discern who is really about privacy and who just uses it as a marketing ploy.
rosser 13y ago
An observation: Ghostery blocked 22 trackers on this article. Does it somehow make tracking my every move online okay if it's done for profit? EDIT: phrasing.
- guelo 13y ago
  With all the tracking by advertisers it makes one wonder if the Feds have approached them for access to those databases.
- devindotcom 13y ago
  I know, it's ridiculous. But people do want to see how many likes the story has, and cross-service comments are pretty next-wave, so you have to have widgets now for 5 social sites, 7 comment systems, global analytics, live analytics, sitewide ad, contextual ad, site cookie and maybe add two more because I haven't thought of them... that's 19 right there! We really need something better than having these MASSIVE amounts of callouts. It's like those pictures of Internet Explorer totally taken over by toolbars, except it's a different set on every single site on the web. Bah!
  - gohrt 13y ago
    It turns out that if you block all the trackers and 3rd part widgets, the website continues to function as the use desires, and nothing of value is lost.
    - rosser 13y ago
      For some sites, yes. Space.com and Business Insider are two that I've noticed tend not to work if some of their trackers are blocked.
- humanspecies 13y ago
  Everyone was ok with google's tracking for ads and commercial purposes, even though it felt kinda weird, we had a feelign it wasn't evil somehow. Now I can't even look at Google anymore, they're like a spouse that cheated on you. You knew the spouse may have been watching you, but at least they weren't fucking with someone else while you trusted them.
mikemoka 13y ago
I like DDG, but has it ever mentioned how this TRACKING data is used? http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org%2Fpractice-tests%2F http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org... (every time you click on a search result you actually click on a link like this,which redirects you to the actual page) Is it just for pagerank?
- zwegner 13y ago
  This irritated me, as it makes me somewhat skeptical of the "we don't track" claim. However, I noticed that if you use their HTML version (i.e., use duckduckgo.com/html/<query> instead), that they don't do the click-tracking. The only downside I've noticed is that there's no infinite-scrolling mode, you have to hit "next". Whether they're still tracking the search queries, though, I have no idea...
- gohrt 13y ago
  DDG just claims they don't store your history. Presumably they could use redirected clicks as quality signal, without tying it to your browser cookies.
- boyter 13y ago
  It might be used internally for additional ranking signals. But the privacy policy states it can never be tied back to you as an individual so nothing to worry about. From memory the main reason they do this is to allow downstream websites to determine if a user was referred to them by DuckDuckGo without the actual search term. IE you know they came from DDG but with no leakage. I run searchcode.com (which provides a lot of the code doco and sample results) and since this was done I can now determine how much referral traffic actually comes from DDG but have no idea what you were searching for when you click through.
- claudius 13y ago
  You can turn that on/off in the settings dialog, essentially it is meant to hide the search queries from the target website.
- deleted 13y ago
  [deleted]
mratzloff 13y ago
Whenever I think about DDG, I think "Oh, you think Gabriel Weinberg suddenly cares about your privacy after he sold a truckload of user information to Classmates.com?"
arindone 13y ago
Anyone going to say it? DuckDuckGo searches are still really low quality. I WANT them to be a legitimate competitor in the space (in fact, I've been having similar hopes for Bing for years) but it's just not there yet.
beefsack 13y ago
It's been around for a long time, but I really love the TTY mode of DDG: https://duckduckgo.com/tty/ https://duckduckgo.com/tty/
ninetenel 13y ago
Somewhat related but I've been canceling my subscriptions (Office365 in my case) to services I can't properly secure.. I'm also in the process of selling my surface pro and going back to a Linux laptop (OneNote 2013 sucks with touch on the Desktop for me .. and Microsoft's Windows8 version won't allow you to not use Skydrive) Also, I pay Microsoft .. why won't they let me save my OneNote docs in a secure way using their Windows8 apps?
Lyaserkiev 13y ago
One thing that I prefer about DDG is that it doesn't try to guess what language I want to search in other than by my input. It is ridiculous that google forces me to go through worse results based solely on my location, it shouldn't matter where you are from.
isaacb 13y ago
It really only took me about a week to get used to DuckDuckGo, and now using Google just feels wrong.
josteink 13y ago
Things like PRISM makes me completely want to back out of the Google ecosystem. Part of that would be replacing Gmail. That can be done, but what good (free) options exists for a webmail solution? I'd also love this instant to cut gtalk (or "hangouts" which it is called now. hopeless), but Google just declared hate on XMPP, so setting up your own node will land you on your own tiny island. The trend is clear though: Google is stuffing the exit-holes while the US government is requiring more and more of Google's data. If you haven't started moving out yet, you better get started. And for the love of God, ditch Chrome. Support someone who supports the open web and respects your privacy.
ausjke 13y ago
I tried duckduckgo and it did not work as well as google, yet. I especially dislike its name, it's odd and too long to type, and again, duck 'walks' slowly, not a good sign. can this be renamed to something better, and shorter? sometimes name does matter.

459 points by denzil_correa 13y ago

Glad to see them succeeding, but personally the privacy of my web searches doesn't bother me - as long as they aren't being passed along with personally identifying information. I'm far more worried about emails, messaging, video, storage etc. Can someone explain to me (or point me in the direction of something that explains) what Google and Bing store in terms of tracking when you are not logged in? Obviously you can use VPNs or TOR to be really safe, but do you need to go that far if you want an untracked search on Google and Bing?

bcoates 13y ago
They have access to IP+time, your search query, and cookies for correlation to other requests. It's valuable information and Google openly documents that they are keeping and using it, along with anything else you leak to them: http://www.google.com/policies/privacy/ http://www.google.com/policies/privacy/ IP+time is enough to get your personal identity information from your ISP (physical location of the endpoint, billing information), I have no idea if Google's relationship with ISPs is good enough to buy that or if it's only available to cops.
- jmillikin 13y ago
  > They have access to IP+time, your search query, and > cookies for correlation to other requests. It's > valuable information Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless. > IP+time is enough to get your personal identity > information from your ISP (physical location of the > endpoint, billing information), I have no idea if > Google's relationship with ISPs is good enough to > buy that or if it's only available to cops. Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification. I hope that ISPs do not release personal identity or billing data to arbitrary third parties. I know my ISP (sonic.net) claims they don't[1], and even privacy-insensitive companies such as AT&T have privacy policies that would forbid them from selling personal data[2]. Even if it were possible for random companies to obtain personal data from an ISP, I doubt that Google would have any interest in participating. [1] https://wiki.sonic.net/wiki/Category:Policies#Privacy https://wiki.sonic.net/wiki/Category:Policies#Privacy [2] http://www.att.com/gen/privacy-policy?pid=2506 http://www.att.com/gen/privacy-policy?pid=2506
  - infinity 13y ago
    >>Valuable for blackmail, but not really useful >>for anything else; the commercial value of >>information rapidly degrades over time. >>Knowing I want to buy a new fridge today is very >>valuable, knowing I wanted to buy one last month is >>nearly worthless. I think that blackmail is already bad enough. Considering which topics somebody might want to learn about on the internet, various diseases for example. >>I hope that ISPs do not release personal >>identity or billing data to arbitrary third parties. I hope that too. But this information is gathered and stored somewhere in flawed systems which are operated by humans which might decide to follow their own interests more than the interests of the customers. I know of at least one story where an employee of a search engine has been using his privileges to stalk other people.
  - icebraining 13y ago
    Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless. That depends on what they can get out of the data, besides the obvious. I'm thinking of the story about Target knowing that a girl was pregnant before even her father did[1]. Even longer trends can probably be derived, regarding personality traits, income, etc. That information is worth a lot even months or years after it was captured. [1]: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
  - saalweachter 13y ago
    I love targeted advertising because it is so blatantly obvious and hilariously over-optimistic. I search for a lot of random crap with more curiosity than intent to buy. I looked up the price for several windmills , the late 19th/early 20th century style, (~$1000, by the way). For weeks or months afterwards, I saw windmill ads on a sizable fraction of the websites I visited. To be fair, it's far more likely that I am going to by a windmill than a random ad viewer, but the probability is still staggeringly low. There had to be a hundred other products I was more likely to buy than the windmill, that would be more valuable to show me. But no! I had viewed their product and I! Must! Be! Targeted! I really wonder what the set of products that do well from targeted ads looks like.
btian 13y ago
Based on the leaked PRISM presentation, they could send your search log to NSA, and NSA can identify you based on your IP address that your ISP provides.
infinity 13y ago
The IP address from which you send your request to a search engines website may be regarded as a personally identifying information. In case that this information becomes publicly available the connection between your search terms and your IP address will be visible. In fact, this has happend in the past and there was a searchable database with the leaked information online where you could look up search terms. I don't know what data Google and Bing are collecting, but here is one quote from the wikipedia entry on internet privacy concerning the AOL search engine: A search engine takes all of its users and assigns each one a specific ID number. Those in control of the database often keep records of where on the Internet each member has traveled to. AOL’s system is one example. AOL has a database 21 million members deep, each with their own specific ID number. The way that AOLSearch is set up, however, allows for AOL to keep records of all the websites visited by any given member. Even though the true identity of the user isn’t known, a full profile of a member can be made just by using the information stored by AOLSearch. By keeping records of what people query through AOLSearch, the company is able to learn a great deal about them without knowing their names. Source: http://en.wikipedia.org/wiki/Internet_privacy http://en.wikipedia.org/wiki/Internet_privacy
elorant 13y ago
TOR is not that safe. If the exit node is compromised you’re f*cked for good. As for Google the thing is that they’re also an advertising network so basically they track you all around the web.
- icebraining 13y ago
  If the exit node is compromised you’re fcked for good.* It's not that simple, otherwise there wouldn't be any value in using an Onion architecture. Assuming you're using HTTPS, which every decent search engine supports, they either also need to create a fake but acceptable certificate for the domain, or to also control entry nodes and match the entering requests with the exit ones. The NSA might be able to do it, but it's not just a matter of controlling an exit node.
- betterunix 13y ago
  "TOR is not that safe. If the exit node is compromised you’re f*cked for good." Not if you are using TLS, which you should be using regardless of Tor.
- Estragon 13y ago
  What threat are you referring to here? Takeovers through the browser via HTML injected by the exit node?

rasterizer 13y ago

At least you can't blame them for missing a PR opportunity: https://plus.google.com/+JeffJarvis/posts/5X7nHcjijsC https://plus.google.com/+JeffJarvis/posts/5X7nHcjijsC

dgesang 13y ago

Here is a non-US-based alternative: https://startpage.com https://startpage.com

umsm 13y ago
Just because they say they don't collect your info, it doesn't mean that google doesn't get it. Look at the source of a search page and you'll notice that they include scripts directly from google.com...
- icebraining 13y ago
  Hum, neither NoScript nor a search in their source reveals such scripts. Can you point me to them?
  - umsm 13y ago
    Open up the source and search for google.com...
- babby 13y ago
  Google assuredly gets info, just not from the user. There aren't any google requests from Firebug's net tab, either, so perhaps you are mistaken.
  - umsm 13y ago
    Google knows what you were searching for, when, and for how long...

jpdoctor 13y ago

Why would anyone believe that DuckDuckGo isn't already penetrated?

jafaku 13y ago
Because look at the logo and the design, that duck is cool! And it says it's private! /s
- oneye 13y ago
  Or because their entire business differentiation from the beginning has been privacy. This does not mean that it is not compromised, of course. But its why people would believe it isn't compromised. And its a much better reason than your sarcastic imitation.
  - betterunix 13y ago
    "Or because their entire business differentiation from the beginning has been privacy." The same is true of Hushmail. How did that work out?
    - oneye 13y ago
      I have no idea. I (as I said) was not trying to assert that DuckDuckGo is not compromised, I was asserting that the reason that people believe it to be secure is because they've differentiated on privacy since the beginning. Mostly, I don't like seeing condescending, inaccurate statements.
      - betterunix 13y ago
        Well, the Hushmail story is pretty famous: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ There is nothing inaccurate about claiming that people believe that DDG is protecting their privacy because of how the website presents itself and the claims made by the company. That is exactly why people believed (and many continue to believe) that Hushmail is protecting their privacy. The way companies advertise themselves is not necessarily reflective of reality.

dmix 13y ago

Chrome integration possible?

kall 13y ago
you can integrate any search engine into chrome by right clicking in the search field and picking "Add as Search Engine". Then you can go to Settings and make it your default.
mmmelissa 13y ago
this is a joke... right?
- suyash 13y ago
  haha..I hope so..you need to use Firefox and not even Safari to be totally safe..even better Private Window browsing mode in Firefox.

oinksoft 13y ago

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation. Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

jsingleton 13y ago
I really like the how the goodies have improved (or at least the discoverability). There's some really useful / geeky stuff in there. https://duckduckgo.com/goodies#Science https://duckduckgo.com/goodies#Science https://duckduckgo.com/?q=how+much+magnesium+is+in+43+cubic+miles+of+fried+chicken https://duckduckgo.com/?q=how+much+magnesium+is+in+43+cubic+...
hkmurakami 13y ago
I second the observation that the results have improved considerably over the last year. There are still holes where I have to resort to using the !g option and use google (non-English searches would be the most prominent example) but I've set all my default search options to DDG and haven't regretted it!
jpdoctor 13y ago
> Also, DDG's results compared to a year ago are night-and-day. Still looks 2nd rate. I replicated one of my last searches (learning rails): rails find if element is in array First hit on google is the stackexchange answer with .include? (which I was spacing-out on) DDG yields the Array docs, which is correct but is a helluva lot of info when I'm looking for a concise answer.
- drakaal 13y ago
  http://www.samuru.com http://www.samuru.com is better for concise answers.
  - jpdoctor 13y ago

wnevets 13y ago

if the NSA is intercepting the communications, why would switching sites matter?

marshray 13y ago
1. The NSA isn't the only threat to privacy on the net. 2. DDG is SSL, so there's some hope that the traffic is not visible to a passive observer, even the NSA.
- wnevets 13y ago
  Google is also SSL. There was a post on here a day or two ago with the theory that PRISM is really about intercepting and cracking SSL certs

aacook 13y ago

This is great news for DuckDuckGo and I'm all for it, however, DuckDuckGo isn't completely private right? From what I see, DuckDuckGo obtains much of its data from 3rd parties, such as Bing/Microsoft and Yahoo. http://help.duckduckgo.com/customer/portal/articles/216399-sources http://help.duckduckgo.com/customer/portal/articles/216399-s... "While our indexes are getting bigger, we do not expect to be wholly independent from third-parties. Bing and Google each spend hundreds of millions of dollars a year crawling and indexing the deep Web. It costs so much that even big companies like Yahoo and Ask are giving up general crawling and indexing. Therefore, it seems silly to compete on crawling and, besides, we do not have the money to do so. Instead, we've focused on building a better search engine by concentrating on what we think are long-term value-adds -- having way more instant answers, way less spam, real privacy and a better overall search experience."

jaryd 13y ago
While we do use 3rd parties to fulfill some of our organic results we always make those calls from our machines. We never pass along IP addresses. This means that while our other sources might see your queries, they are not tied with PII (personally identifiable information).
- aacook 13y ago
  I misunderstood. Excellent.
Skalman 13y ago
I think you're not quite understanding how it works. They retrieve the data from e.g. Bing behind the scenes and the 3rd parties have no way to connect a query to an individual user. That said, maybe there'd be an issue if you enter personally identifiable information as a query. But who does that?

lurkinggrue 13y ago

Not that this is going to help. The NSA is probably tapping the fiber at the ISP's backbone in front of Google. Why do you think it is called PRISM? It's probably named for the way they are splitting the fiber and recording everything.

zachrose 13y ago
Or it could be an API for issuing FISA warrants and collecting the requested data. (The NSA may very well be doing both.)
- lurkinggrue 13y ago
  They are probably doing both.
adamtj 13y ago
In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of "https://duckduckgo.com" https://duckduckgo.com", it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.
- jackpirate 13y ago
  >Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.
  - betterunix 13y ago
    http://www.wired.com/threatlevel/2010/03/packet-forensics/ http://www.wired.com/threatlevel/2010/03/packet-forensics/
  - icebraining 13y ago

codereflection 13y ago

I've been using DDG for nearly a year now, and have rarely turned back to Google. I only do so when I really cannot find what I'm looking for on DDG, and I try to tell DDG about the bad results (which I've actually seen get fixed). Getting bad results happens infrequently though, so the benefit of using DDG really outweighs the occasional inconvenience.

suyash 13y ago

And as far as browser is concerned, I would recommend go with Firefox vs Google or Safari. Mozilla is a non profit and I feel I can trust it the most.

hkmurakami 13y ago
I take it you mean Firefox over Chrome or Safari? (I agree. The only thing I use Chrome for is Facebook)
- suyash 13y ago
  even better prefer to use Private Window in Firefox. Chrome is only good for it's debugger so I rather prefer Canary.
kostya-kow 13y ago
The only safe thing to do would be to compile Firefox or Chromium yourself.
- suyash 13y ago
  Well the safest of all would be to write your own highly secure browser and use TOR.

pschastain 13y ago

DDG is has been my primary search engine for about a year now, and I do what I can to proselytize for it. Their results aren't always as comprehensive as the bigger engines, but I can usually find what I need.

WestCoastJustin 13y ago

You can see the stats here: http://duckduckgo.com/traffic.html http://duckduckgo.com/traffic.html

paulsutter 13y ago

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the_PRISM_presentation.jpg http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the slide), when "Upstream" access is just as big a concern. EDIT: rephrased my concern about direct vs upstream

nwh 13y ago
If you're using HTTPS, they can't even see your URLs or headers. That's sort of the point.
- lurkinggrue 13y ago
  Email is unencrypted in transit.
  - eridius 13y ago
    What does that have to do with using a search engine? I'm pretty sure you aren't emailing them your queries.
    - skeletonjelly 13y ago
      Maybe that's all Stallman's queries
  - diminoten 13y ago
    ...unless you encrypt it.
  - bigiain 13y ago
    That's not universally true - there's a remarkable amount of TLS/SSL encrypted email-in-transit, either via STARTTLS ESMTP commands or SSL over port 465 (and 993/995 for IPAM and POP3). I don't think there's a way to guarantee your mail always travels over TLS/SSL secured connections, but I suspect more of it does than you think.

tocomment 13y ago

Is there a way to make ddg the default on the iPhone?

cinquemb 13y ago

Anyone else wondering if DDG will come out with their version of email? Maybe something that uses end to end encryption (maybe working together with Mozilla Foundation)?

fourstar 13y ago
This is where they would kill it. Search would be supplementary, but if they pivoted and focused on email (eventually rebranding it), then that's a home run in my book. I'd like to see this, and would be interested in beta testing if/when it happens.
lignuist 13y ago
I would prefer if someone else did it. Not because I do not trust DDG, but because I don't like the idea of one company providing everything (or too much). Why step into the footsteps of the dinosaurs?
- cinquemb 13y ago
  Fair enough. >Why step into the footsteps of the dinosaurs? I'd think adding E2EE to email would be like what pagerank did to the search engine. Why build from the ground up when you can build on the shoulders of the giants?
  - lignuist 13y ago
    If only someone solved the problem of bringing PGP to the masses. Maybe the need has to reach a critical mass.
    - cinquemb 13y ago
      I agree, and that's why I was thinking that a company that is still growing and is known for their privacy practices could be good (beach-head?) at doing this (at least being able to advertise it on their own services to get some traction and feedback). It's not like google or anyone else is going to do it. And looking at DDG traffic, it seems like it is a growing need. Then again, how to you monetize encrypted emails? contextual encyrpted ads? ;)

bpatrianakos 13y ago

I have a private writing app and I can confirm that this NSA thing has been good for me too and I'm betting lots of services concerned with privacy. I saw a 5X increase in users in the past week and reviews in blogs are getting more numerous. I wonder though if now all services regardless of their real focus will start marketing privacy as a feature and muddy the waters, making it hard for consumers to discern who is really about privacy and who just uses it as a marketing ploy.

rosser 13y ago

An observation: Ghostery blocked 22 trackers on this article. Does it somehow make tracking my every move online okay if it's done for profit? EDIT: phrasing.

guelo 13y ago
With all the tracking by advertisers it makes one wonder if the Feds have approached them for access to those databases.
devindotcom 13y ago
I know, it's ridiculous. But people do want to see how many likes the story has, and cross-service comments are pretty next-wave, so you have to have widgets now for 5 social sites, 7 comment systems, global analytics, live analytics, sitewide ad, contextual ad, site cookie and maybe add two more because I haven't thought of them... that's 19 right there! We really need something better than having these MASSIVE amounts of callouts. It's like those pictures of Internet Explorer totally taken over by toolbars, except it's a different set on every single site on the web. Bah!
- gohrt 13y ago
  It turns out that if you block all the trackers and 3rd part widgets, the website continues to function as the use desires, and nothing of value is lost.
  - rosser 13y ago
    For some sites, yes. Space.com and Business Insider are two that I've noticed tend not to work if some of their trackers are blocked.
humanspecies 13y ago
Everyone was ok with google's tracking for ads and commercial purposes, even though it felt kinda weird, we had a feelign it wasn't evil somehow. Now I can't even look at Google anymore, they're like a spouse that cheated on you. You knew the spouse may have been watching you, but at least they weren't fucking with someone else while you trusted them.

mikemoka 13y ago

I like DDG, but has it ever mentioned how this TRACKING data is used? http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org%2Fpractice-tests%2F http://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.dmv.org... (every time you click on a search result you actually click on a link like this,which redirects you to the actual page) Is it just for pagerank?

zwegner 13y ago
This irritated me, as it makes me somewhat skeptical of the "we don't track" claim. However, I noticed that if you use their HTML version (i.e., use duckduckgo.com/html/<query> instead), that they don't do the click-tracking. The only downside I've noticed is that there's no infinite-scrolling mode, you have to hit "next". Whether they're still tracking the search queries, though, I have no idea...
gohrt 13y ago
DDG just claims they don't store your history. Presumably they could use redirected clicks as quality signal, without tying it to your browser cookies.
boyter 13y ago
It might be used internally for additional ranking signals. But the privacy policy states it can never be tied back to you as an individual so nothing to worry about. From memory the main reason they do this is to allow downstream websites to determine if a user was referred to them by DuckDuckGo without the actual search term. IE you know they came from DDG but with no leakage. I run searchcode.com (which provides a lot of the code doco and sample results) and since this was done I can now determine how much referral traffic actually comes from DDG but have no idea what you were searching for when you click through.
claudius 13y ago
You can turn that on/off in the settings dialog, essentially it is meant to hide the search queries from the target website.
deleted 13y ago
[deleted]

mratzloff 13y ago

Whenever I think about DDG, I think "Oh, you think Gabriel Weinberg suddenly cares about your privacy after he sold a truckload of user information to Classmates.com?"

arindone 13y ago

Anyone going to say it? DuckDuckGo searches are still really low quality. I WANT them to be a legitimate competitor in the space (in fact, I've been having similar hopes for Bing for years) but it's just not there yet.

beefsack 13y ago

It's been around for a long time, but I really love the TTY mode of DDG: https://duckduckgo.com/tty/ https://duckduckgo.com/tty/

ninetenel 13y ago

Somewhat related but I've been canceling my subscriptions (Office365 in my case) to services I can't properly secure.. I'm also in the process of selling my surface pro and going back to a Linux laptop (OneNote 2013 sucks with touch on the Desktop for me .. and Microsoft's Windows8 version won't allow you to not use Skydrive) Also, I pay Microsoft .. why won't they let me save my OneNote docs in a secure way using their Windows8 apps?

Lyaserkiev 13y ago

One thing that I prefer about DDG is that it doesn't try to guess what language I want to search in other than by my input. It is ridiculous that google forces me to go through worse results based solely on my location, it shouldn't matter where you are from.

isaacb 13y ago

It really only took me about a week to get used to DuckDuckGo, and now using Google just feels wrong.

josteink 13y ago

Things like PRISM makes me completely want to back out of the Google ecosystem. Part of that would be replacing Gmail. That can be done, but what good (free) options exists for a webmail solution? I'd also love this instant to cut gtalk (or "hangouts" which it is called now. hopeless), but Google just declared hate on XMPP, so setting up your own node will land you on your own tiny island. The trend is clear though: Google is stuffing the exit-holes while the US government is requiring more and more of Google's data. If you haven't started moving out yet, you better get started. And for the love of God, ditch Chrome. Support someone who supports the open web and respects your privacy.

ausjke 13y ago

I tried duckduckgo and it did not work as well as google, yet. I especially dislike its name, it's odd and too long to type, and again, duck 'walks' slowly, not a good sign. can this be renamed to something better, and shorter? sometimes name does matter.