Hacker News Reader

Comment by wicket | Hacker News Reader

I don't think this really changes anything. It's more important to Google that DuckDuckGo users don't disable Chrome's prediction service, that way they can still collect search data on them. Adding DuckDuckGo as a search engine option whilst they leave the prediction service option intact means that this is nothing more than a publicity stunt. It's actually quite deceiving for many users who do not realise they are still sending data to Google.

View on HN

Eh? "Use a prediction service" is about whether you send data as you type _to your default search engine_, not to Google. If you change to DuckDuckGo as your default search engine, toggling "use a prediction service" on and off will not send any more or less data to Google, because omnibox typing is never sent to Google in that case regardless.

Source: I am the former Chrome omnibox owner. You can find the relevant code for this starting at https://cs.chromium.org/chromium/src/components/omnibox/brow... ; look for how GetDefaultProviderURL() works and when that query is sent. You can also watch packets with your favorite network analyzer.

Was playing around with the omnibox debug tool (chrome://omnibox) the other day, pretty cool how it inter-ranks literal search, search suggests, history into one.

Hold up, are you saying that users who use DDG are still sending _all_ their searches to Google? I'm not disagreeing but I'd love to see a source for this. It seems to me that if you switch, Chrome should use the DDG autosuggest API [0].

[0] https://duck.co/help/features/autosuggest

Correct; if you are using DDG as your default search engine, and you enable "use a prediction service", suggest queries are sent to the "suggest_url" configured for that engine. For DDG, that URL is here: https://cs.chromium.org/chromium/src/components/search_engin...

Thank you both for pointing this out. Traditionally this has not been the case. When adding a search engine manually, "suggest_url" is not available as an option, so the prediction service would always send data to Google. It seems like a good thing that they've fixed it for the new DuckDuckGo option, but it's a shame that you still cannot configure this manually.

You're correct that manual configuration of the suggest_url is unavailable ( http://crbug.com/8395 ), but incorrect that the prediction service sends data to Google in the case where that's not configured. In that case, the prediction service is inactive. If you add a manual engine and change your DSE to it, then effectively "use a prediction service" has little effect. (It will only kick in if you do keyword-triggered searches, a.k.a. tab-to-search, on engines that do have a configured suggest_url.)

I agree it would be nice to let people configure this (see comment 12 on that bug), but we're pretty careful about getting privacy right (despite wide-ranging internet claims to the contrary) and "falling back" to Google in that case would be a pretty major gaffe.

I'm not sure that the behaviour you describe has always been present. I may be mistaken, it's been a long time (years) since I've added a search engine to Chromium, but I seem to remember having to manually disable the prediction service. Anyway, in any case, I'm glad that the behaviour is now sane and that there are privacy minded folks like your self working on Chromium. Thank you. It's very reassuring.

I've worked on Chrome since the beginning (I'm a founding team member) and I designed and built the omnibox and wrote most of this code. I'm confident we haven't ever done what you're describing.

We haven't always been perfect. When we first launched, for example, we didn't exclude some cases from suggest querying that we should have, and that was my oversight. I can't remember the specifics (things like https:// URLs or input while in incognito mode, IIRC) but I landed a patch a couple days after the 2008 launch to clean it up.

The Chrome team as a whole is very privacy focused. There's a lot of people in public (including in this article's comments) who think Chrome is some sort of Google data collection device, but having seen things from the inside, I would trust Chrome with my data over any other browser. It makes reasonable tradeoffs by default (e.g. not enabling features like sync or server-side spellcheck that tend to send more data), and what stuff is there that people might not want (e.g. omnibox server-side suggestions) can all be easily disabled.

I have seen the server-side infrastructure, and can say that the data, if it arrives on a Google server, is typically very carefully handled. Claims like "your browser history is available to every employee and sold to partner companies" are categorically wrong.

I just want to point out that you're making a false equivalency. "I would trust Chrome with my data over any other browser" - you don't _have_ to trust other browsers with your data. You can run them without any data collection at all.

False dichotomy. You provide all browsers with data by using them; the question is what they do with that data. Chrome is not materially different than other browsers in the level of control you're able to have over what gets sent elsewhere. You can very easily set it so the only thing the server sees is a "check if an update is available." If you're using Chromium instead of Chrome, then you don't have the updater, so even that is not present.

See also https://en.wikipedia.org/wiki/Google_Chrome#Listening_capabi... , which is a reasonable summary with more detail than what I've given above. For full details, see https://www.google.com/chrome/privacy/whitepaper.html .

>nothing more than a publicity stunt

It's the complete opposite to that, and you said it yourself. Their aim is to quietly retain/recapture users while keeping antitrust at bay, and they did well precisely in not publicizing it.

I had a feeling that google was getting a sense of the search traffic no matter which 'search engine' you configured.

I suspect people that actually care about privacy aren't using Chrome though.

Reply on news.ycombinator.com