4 ms·

I am one of those that have changed to DDG after the scandals. So far it feels like I find my results as quickly as I used to do with Google. One nice feature t

by Yrlec 13y ago

I am one of those that have changed to DDG after the scandals. So far it feels like I find my results as quickly as I used to do with Google. One nice feature that I just found: under the Privacy tab at https://duckduckgo.com/settings https://duckduckgo.com/settings you can change so that the query is sent as a HTTP POST parameter instead of a GET parameter. That way your ISP can't find out what you are searching for (assuming you have https enabled).

chrj 13y ago
It shouldn't matter if you are using GET or POST - how would your ISP find out anything about your request if you are using HTTPS?
- Yrlec 13y ago
  You are correct, I was drawing the wrong conclusions from how the HTTP headers are sent. It doesn't affect how much info the ISP gets. However, POST parameters are somewhat more secure, since less info about your query is cached by your browser: http://stackoverflow.com/questions/198462/is-either-get-or-post-more-secure-than-the-other http://stackoverflow.com/questions/198462/is-either-get-or-p...
  - arnoooooo 13y ago
    POST parameters also usually won't show up in logs, unlike GET parameters.
    - dotmanish 13y ago
      Whose logs?
      - Zikes 13y ago
        Web server logs typically don't record POST parameters. It's possible that the web server could record them anyways, though.
prollyignored 13y ago
I badly want numbers for search results on ddg. Load 100 results at a time.
claudius 13y ago
I find the option to ‘save’ options in the URL much nicer. If I want to change my default language, safe mode etc. with Google, I need to enable Cookies. With DDG, I can save these in the search engine settings in Opera :)
primaryobjects 13y ago
SSL encrypts everything in the url after the ? so GET or POST matters little.
- Hannan 13y ago
  Not just the query string values, it encrypts the path to the resource (and headers, etc) as well. However, another HNer pointed me to an article on side-channel attacks which is helpful to keep in mind when considering privacy: https://news.ycombinator.com/item?id=5492338 https://news.ycombinator.com/item?id=5492338
- sukuriant 13y ago
  Consider using Fiddler some time without HTTPS decryption enabled and go roaming around HTTPS sites. You'll see how much information it can extract from the transaction.

by Yrlec 13y ago

chrj 13y ago

It shouldn't matter if you are using GET or POST - how would your ISP find out anything about your request if you are using HTTPS?

Yrlec 13y ago
You are correct, I was drawing the wrong conclusions from how the HTTP headers are sent. It doesn't affect how much info the ISP gets. However, POST parameters are somewhat more secure, since less info about your query is cached by your browser: http://stackoverflow.com/questions/198462/is-either-get-or-post-more-secure-than-the-other http://stackoverflow.com/questions/198462/is-either-get-or-p...
- arnoooooo 13y ago
  POST parameters also usually won't show up in logs, unlike GET parameters.
  - dotmanish 13y ago
    Whose logs?
    - Zikes 13y ago
      Web server logs typically don't record POST parameters. It's possible that the web server could record them anyways, though.

prollyignored 13y ago

I badly want numbers for search results on ddg. Load 100 results at a time.

claudius 13y ago

I find the option to ‘save’ options in the URL much nicer. If I want to change my default language, safe mode etc. with Google, I need to enable Cookies. With DDG, I can save these in the search engine settings in Opera :)

primaryobjects 13y ago

SSL encrypts everything in the url after the ? so GET or POST matters little.

Hannan 13y ago
Not just the query string values, it encrypts the path to the resource (and headers, etc) as well. However, another HNer pointed me to an article on side-channel attacks which is helpful to keep in mind when considering privacy: https://news.ycombinator.com/item?id=5492338 https://news.ycombinator.com/item?id=5492338
sukuriant 13y ago
Consider using Fiddler some time without HTTPS decryption enabled and go roaming around HTTPS sites. You'll see how much information it can extract from the transaction.