Hacker News Reader

Comment by throwaway2016a | Hacker News Reader

throwaway2016a

"DuckDuckGo is the search engine that doesn’t track you." so obviously this article has marketing lean.

While private browsing is not actually private I feel going so far as to say it does not stop websites from collecting info on you is maybe a bit too far.

The site can still collect information about you, yes. But unless you sign in while in private browsing or the site is using some sort of user-agent / IP trickery it won't be automatically tied to your accounts. None of the cookies or local storage are shared across private/non private browsing.

Personally, I use it mostly to see what websites look like when I'm not logged in or if I want to access something that can only be accessed while logged out without actually logging out which is surprisingly common.

View on HN

There are plenty of things a browser can see without being logged in.

Consider checking this page: http://webkay.robinlinus.com/

Private Browsing simply prevents cookies and nothing else, and for the average person we find that is not what's expected from something defined as "private" browsing.

> Private Browsing simply prevents cookies and nothing else

Not true, at least for Firefox. In Private Browsing mode, Firefox will avoid saving temporary files and other data to disk, keeping everything in RAM instead, which is wiped when Private Browsing mode is exited. This includes history, cookies, and cache data. I believe localStorage behaves differently as well.

Firefox also makes an effort to block tracking scripts/servers in Private Browsing mode, using Disconnect's filter list.

The Private Browsing new tab page explains this all pretty succinctly: https://i.imgur.com/MGp53eP.png

You're right there. In this whitepaper we had different questions for each of the browsers to make sure this distinction was noted.

However, users still in general think that private browsing modes do things like prevent their IP address from being seen, or prevent a search engine from recording their searches. So there is still a gap in their expectations.

> I believe localStorage behaves differently as well.

My recollection is that the browser claims to support localStorage, but attempts to use it fail. I don't know why it couldn't just be backed by non-persistent storage.

I'm a full stack web developer. I'm well aware of what the HTTP headers and Javascript methods can expose even while in private. I was oversimplifying fingerprinting a bit.

"I feel going so far as to say it does not stop websites from collecting info on you is maybe a bit too far."

This is not a personal attack. Just have to address this. If you think that you cannot be identified because you use a "private" window in a browser when you were using a logged in browser 30 minutes before from the same IP with the same OS and the same screen size, with the same background apps making the same http requests, you are mistaken. Your entire search history is fingerprinted, associated, shared, and sold. And this is just scratching the surface. As a mild example, Facebook associates IP's with Facebook accounts, then tracks Chromecast requests from those IP addresses to sell that information to media streaming companies. Everything you do, everything you like, everywhere you visit, is one metadata search away. Duck Duck Go cant fix all that, but they can keep no IP correlated search history. And that says alot considering that in todays market that information is worth millions.

I can see my origional point was too broad to be defensible. But I was trying to explicitly talk about fingerprinting when I said...

> unless you sign in while in private browsing or the site is using some sort of user-agent / IP trickery it won't be automatically tied to your accounts

I am aware fingerprinting exists. I have done fingerprinting.

I am also aware that for advertisers fingerprinted data is not as valuable as login keyed data and a lot of places don't bother to do it. Acting on fingerprinted data often triggers the "creepy factor" and actually turns off the consumer from the product. I know several advertisers that will not allow using it for that reason.

I was not saying it can't be done. I didn't imply it did. In fact I believe a study a few years ago showed that fingerprinting is something like 99% accurate if you can execute javascript code to read things like screen resolution.

I was taking objection to assuming it is absolute that it does not prevent tracking and that it is automatically useless.

Does it stop Google? No way. Facebook, doubtful. But does it stop some sites? Absolutely. On many sites it is very effective.

Thanks for that perspective. As a web user, I'm aware of fingerprinting techniques but I've been wondering how prevalent the practice actually is.

Do you have a source for "Facebook associates IP's with Facebook accounts, then tracks Chromecast requests from those IP addresses"

That's not really possible for a webpage or mobile app to do (at least not on iOS, anything goes on Android I guess).

I wish I could find the article. I read it about a year ago. It was a pretty lengthy write up on Facebook's offline tracking habits... just disregard until I can prove it!

> Your entire search history is fingerprinted, associated, shared, and sold.

I've often been curious about this. I've heard this sentiment many times, but I've never heard of where/how anyone could actually buy a search history. Surely there must be some accounts of how the other side of the equation works.

Also, how much does it cost? All the facebook/google help pages I've seen focus on ads, where no personal information is shared.

I was not specific enough with that. I should have said something like, when everything that is collected by different companies and agencies is combined, your entire search history is fingerprinted, associated, shared, and sold. Most are not combining. But some are, and they seem to be getting better at it.

> so obviously this article has marketing lean.

The domain belongs to the DuckDuckGo blog.

Yup! I think we were pretty clear about that from the get-go. Giant duck at the top and everything.

It's part of our overall mission to raise the standard of trust online. We're nothing if not transparent on this!

To be clear, I assumed everyone knew it was DuckDuckGo's blog because of the logo and everything. I didn't see it as safe to assume everyone knows what they do.

For what it's worth I applaud their efforts and their product. I just think this article is biased (and that's OK).

Reply on news.ycombinator.com