7 ms·

If you are using DuckDuckGo for privacy reasons, I strongly suggest you use https://startpage.com/ https://startpage.com/ instead. DuckDuckGo isn't much better

by ancarda 12y ago

If you are using DuckDuckGo for privacy reasons, I strongly suggest you use https://startpage.com/ https://startpage.com/ instead. DuckDuckGo isn't much better than Google; both of them hijack your links. This gives an opportunity to track what you click on. If you watch carefully your links go to "r.duckduckgo.com" -- this page also doesn't use SSL. For example: http://r.duckduckgo.com/l/?kh=-1&uddg=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FDuckDuckGo http://r.duckduckgo.com/l/?kh=-1&uddg=https%3A%2F%2Fen.wikip... StartPage doesn't hijack links, it (optionally) uses POST and you never send a referer header so traffic looks organic.

gabriel34 12y ago
I don't see it; links on ddg are always direct to me; perhaps it's only for advertising links or something like anonym.to to hide some referer you'd send otherwise. What browser are you using?
- ancarda 12y ago
  I'm using Firefox. I see a lot of r.duckduckgo.com entries in my history. Edit: I can't replicate in Chrome or Safari but if I change my user-agent in Safari, it begins hijacking my URLs. The JavaScript is obfuscated so it's hard to tell if it's actually checking for Firefox or not. The function it calls is DDG.get_http_redirect
  - yegg 12y ago
    You can read more about that here: https://duck.co/blog/https-on-by-default https://duck.co/blog/https-on-by-default It has no privacy impact since we do not store or collect personal information.
    - ancarda 12y ago
      >we do not store or collect personal information. But the redirection is done over plain HTTP and not HTTPS. If you don't have a wildcard certificate, you could use /r?url=... instead of a subdomain. Ideally, the best setup would be to use the "noreferrer" attribute on anchor tags. It's a relatively new standard but perhaps you could detect if it's supported and then use that rather than a redirector? https://www.webkit.org/blog/907/webkit-nightlies-support-html5-noreferrer-link-relation/ https://www.webkit.org/blog/907/webkit-nightlies-support-htm...
    - yetfeo 12y ago
      As I mention in a previous comment, if you are using the TOR hidden service (3g2upl4pq6kufc4m.onion/) the redirect goes over a TOR exit node without https. Ideally it should use the hidden service so no exit node is involved, or at the least use HTTPS.
lucb1e 12y ago
> StartPage doesn't hijack links, it (optionally) uses POST and you never send a referer header so traffic looks organic ... and looks like MSN Search results from 2006. Not just ugly and cluttered, which I don't mind too much, but dysfunctional too: no keyboard navigation between results nor editing the search query without using the mouse to focus the box. That is an immediate no-go for me.
- ancarda 12y ago
  I don't like the design either, it's definitely one of DuckDuckGo's strengths, especially the new redesign. It's very nice.
- deno 12y ago
  You can make it look like this: https://i.imgur.com/jMucQvl.png https://i.imgur.com/jMucQvl.png I‘m not entirely satisfied with startpage either though. What we really need is a local search proxy that goes via Google/Bing however you like, e.g. 1) using clearnet without cookies and cleaning up links (Google, Startpage, Bing) 2) via Tor automatically falling back if you get captcha (with option to do the captcha if you don’t like results) 3) Like 1) except via some VPN/Proxy The results from each source (or multiple) could be normalized and the local app can offer any kind of interface you like. I’ll write it at some point, but if anyone wants to steal that idea — please do.
weavejester 12y ago
r.duckduckgo.com is actually there for privacy, to remove HTTP referers. See: https://duck.co/help/results/rduckduckgocom https://duck.co/help/results/rduckduckgocom
- ancarda 12y ago
  If you search using POST, that isn't a problem. Also, referer headers aren't sent to unencrypted links so if https://duckduckgo.com https://duckduckgo.com sent me to http://example.com http://example.com they would not see where I came from. Those two combined offer better privacy as no website can know what you were searching for and only secure websites know you came from DuckDuckGo. This setup doesn't give DuckDuckGo a chance to track what I'm clicking on.
  - weavejester 12y ago
    POST-based searches are rather inconvenient, as there's no easy way of saving the search page. As far as I'm aware, referer headers are still sent to HTTPS links, even if the origin differs. So https://duckduckgo.com https://duckduckgo.com would still send referers to https://example.com https://example.com. But if you still don't want your clicks going through the r.duckduckgo.com domain, you can turn it off in the settings. Presumably you also disable Javascript by default, right?

by ancarda 12y ago

gabriel34 12y ago

I don't see it; links on ddg are always direct to me; perhaps it's only for advertising links or something like anonym.to to hide some referer you'd send otherwise. What browser are you using?

ancarda 12y ago
I'm using Firefox. I see a lot of r.duckduckgo.com entries in my history. Edit: I can't replicate in Chrome or Safari but if I change my user-agent in Safari, it begins hijacking my URLs. The JavaScript is obfuscated so it's hard to tell if it's actually checking for Firefox or not. The function it calls is DDG.get_http_redirect
- yegg 12y ago
  You can read more about that here: https://duck.co/blog/https-on-by-default https://duck.co/blog/https-on-by-default It has no privacy impact since we do not store or collect personal information.
  - ancarda 12y ago
    >we do not store or collect personal information. But the redirection is done over plain HTTP and not HTTPS. If you don't have a wildcard certificate, you could use /r?url=... instead of a subdomain. Ideally, the best setup would be to use the "noreferrer" attribute on anchor tags. It's a relatively new standard but perhaps you could detect if it's supported and then use that rather than a redirector? https://www.webkit.org/blog/907/webkit-nightlies-support-html5-noreferrer-link-relation/ https://www.webkit.org/blog/907/webkit-nightlies-support-htm...
  - yetfeo 12y ago
    As I mention in a previous comment, if you are using the TOR hidden service (3g2upl4pq6kufc4m.onion/) the redirect goes over a TOR exit node without https. Ideally it should use the hidden service so no exit node is involved, or at the least use HTTPS.

lucb1e 12y ago

> StartPage doesn't hijack links, it (optionally) uses POST and you never send a referer header so traffic looks organic ... and looks like MSN Search results from 2006. Not just ugly and cluttered, which I don't mind too much, but dysfunctional too: no keyboard navigation between results nor editing the search query without using the mouse to focus the box. That is an immediate no-go for me.

ancarda 12y ago
I don't like the design either, it's definitely one of DuckDuckGo's strengths, especially the new redesign. It's very nice.
deno 12y ago
You can make it look like this: https://i.imgur.com/jMucQvl.png https://i.imgur.com/jMucQvl.png I‘m not entirely satisfied with startpage either though. What we really need is a local search proxy that goes via Google/Bing however you like, e.g. 1) using clearnet without cookies and cleaning up links (Google, Startpage, Bing) 2) via Tor automatically falling back if you get captcha (with option to do the captcha if you don’t like results) 3) Like 1) except via some VPN/Proxy The results from each source (or multiple) could be normalized and the local app can offer any kind of interface you like. I’ll write it at some point, but if anyone wants to steal that idea — please do.

weavejester 12y ago

r.duckduckgo.com is actually there for privacy, to remove HTTP referers. See: https://duck.co/help/results/rduckduckgocom https://duck.co/help/results/rduckduckgocom

ancarda 12y ago
If you search using POST, that isn't a problem. Also, referer headers aren't sent to unencrypted links so if https://duckduckgo.com https://duckduckgo.com sent me to http://example.com http://example.com they would not see where I came from. Those two combined offer better privacy as no website can know what you were searching for and only secure websites know you came from DuckDuckGo. This setup doesn't give DuckDuckGo a chance to track what I'm clicking on.
- weavejester 12y ago
  POST-based searches are rather inconvenient, as there's no easy way of saving the search page. As far as I'm aware, referer headers are still sent to HTTPS links, even if the origin differs. So https://duckduckgo.com https://duckduckgo.com would still send referers to https://example.com https://example.com. But if you still don't want your clicks going through the r.duckduckgo.com domain, you can turn it off in the settings. Presumably you also disable Javascript by default, right?