Hacker News Reader

Comment by jk2faster | Hacker News Reader

I used ecosia for a period of few months, and stopped when I read this their privacy policy(https://info.ecosia.org/privacy#privacy-policy-section-7):

> For example, when you do a search on Ecosia we forward the following information to our partner, Bing: IP address, user agent string, search term, and some settings like your country and language setting.

So when a search is done, our IP address is send to Bing.

I really love the idea of planting trees from profit, and have nothing against ecosia. Just commented to inform readers. <edit> Before getting downvoted into oblivion, I would like to make it clear that I'm not saying ecosia is unethical or that everyone should stop using it because of this. For some it matters, for some it doesn't and ecosia seems a great choice for those whom this doesn't matter. I'm just posting it so that those who do care(about their IP being send to Bing) can be aware(since I wasn't for a few months). </edit>

View on HN

I'm a strong advocate for digital privacy and opposed to the majority of data collection that occurs, but this comment is FUD. None of the info that you listed would be private if you used Bing normally, so if you're worried about them having that info you'd need to stop using search engines all together

>So when a search is done, our IP address is send to Bing.

Explain why you believe that's a negative? If you use Bing normally they would know your IP as well

>user agent string

Again, using bing normally will allow them to see this information

>search term

Obviously required to be sent to bing

>some settings like your country and language setting

Again, this is information that would be available to Bing if you use their service normally

>Explain why you believe that's a negative? If you use Bing normally they would know your IP as well

I'm a bit uncomfortable in letting MicroSoft associate my IP with what I search daily. I use GitHub and Linkedin and most of the time I'm logged in to at least one of those services. Now I don't know for sure if Bing associates these searches to my account based on the IP(someone can shed some light on this?). StartPage and DuckDuckGo both use third party searches but they don't share user IP(https://support.startpage.com/index.php?/Knowledgebase/Artic...)

For other details like search term, country etc... I absolutely understand that they are needed to be send. I just quoted them as a sentence.

If it wasn't for the IP sharing, I would be a happy ecosia user :)

I definitely understand the desire to not have one's IP tied to their search history/browsing in some cases, but as this service makes no mention of being an anonymous or private search engine I don't think your critique is an actual issue with the service. Your use case simply doesn't match the purpose of this search engine

You're right, privacy is not their selling point. But they do have many phrases like "We don’t store your searches permanently" and "We don’t sell your data to advertisers" in their website, which are technically true but I misunderstood that they don't store my IP either because of those. I came across the text I quoted in the parent comment months later when I came across a thread in r/privacy and I passed it on. StartPage and DuckDuckGo still makes money from ads and doesn't share user IP. It would have been great if Ecosia functioned similarly, and in that case many people like me who are concerned about sharing IP with Bing(or other services) can join Ecosia for search.

DuckDuckGo also uses Bing and they don't send the IP AFAIK

AFAIK that is impossible

Definitely not impossible. Microsoft offers a pay-as-you-go Bing Search API (https://azure.microsoft.com/en-us/pricing/details/cognitive-...).

I can only assume ecosia share this data with Microsoft because doing so has allowed them to land a more lucrative deal.

I would assume they send the IP so that Bing will return location specific search results for weather, local businesses and such. I see no reason to assume malicious intent.

What’s stopping them from performing an offline IP location lookup and requesting location specific search results without sharing the IP with Microsoft?

I'm not sure if that is a feature that the Bing API supports. I couldn't find anything about looking up coordinates in the docs: https://docs.microsoft.com/en-us/azure/cognitive-services/bi....

Yeah their documentation is dreadful, but they could just append loc:countryCode to the query before making the API request: e.g. ‘attractions loc:dk’.. at least that works for me despite some people mentioning this filter is no longer supported.

Not sure how DDG and other search engines that rely on Bing does it, but it’s certainly possible without sharing the users’ IP with Microsoft.

StartPage does it with Google and is explained here: https://support.startpage.com/index.php?/Knowledgebase/Artic...

So it is probably possible.

If anyone is wondering why they send Bing the IP address, it's most likely because the Bing API uses the searchers IP address if you want location specific search results like weather, local restaurants, etc.

> Results are customized to the location or market of the user. The location or market can be determined implicitly (via IP address) or configured explicitly.

https://azure.microsoft.com/en-us/services/cognitive-service...

> We don’t create personal profiles of you based on your search history. We actually anonymize all searches within one week.

> Many web services collect user data in order to sell it without asking your permission. We don’t sell your data or your searches to advertising companies.

> We protect your searches from potential eavesdroppers with a securely encrypted connection. This way we make sure that nobody between you and us can see your searches.

If they’re just handing everything off to Bing wholesale, are these quotes either misleading or straight up lies? The first one I’m confused about with the “anonymize all searches within one week”. I don’t know what that means. The second seems like Bing could still do those things. And the last one would be a lie considering Bing can see it.

https://info.ecosia.org/privacy

You just need to read it differently ...

We don’t create personal profiles of you based on your search history. (but our partner Bing might)

We don’t sell your data or your searches to advertising companies. (but our partner Bing is and hands us a piece of the rewards)

I guess the responsibility is on the user to dig through the FAQ or privacy policy to discover they use Bing and then read between the lines?

It’s disingenuous and misleading to the average user. They should be criticized for it.

I absolutely agree that they should be criticized for it, or at least explain their deal with Bing. If one can trust Google not to create ad profiles from Google Analytics data, one can also trust Bing to not use ecosia data to build user profiles. But for that to be a trust decision, we'd need to know whether they actually have any such deal with Bing.

> And the last one would be a lie considering Bing can see it.

How would that be a lie. They protect from eavesdroppers, as in someone intercepting the connection and trying to extract data being transmitted within a system. Bing is part of the whole system, not a third party trying to eavesdrop. Finally, they say they don't allow anyone between you and them - which is different from allowing between them and a third party, but I'm sure they would use an encrypted connection even when communicating with Bing.

That’s true. I guess I jumped the gun on that one. However, “nobody between you and us” still feels disingenuous because you have to dig quite a bit to find out that they use Bing on the backend and then leave concluding that “us” also includes Microsoft as the responsibility of the user. The average user isn’t going to make that connection because they’re not likely to be reading through the privacy policy or digging through the FAQ to discover they use Bing.

I think their page touting “privacy” should clearly indicate that they use Bing and that your privacy is ultimately beholden to Microsoft, not Ecosia, especially since Ecosia is happy to send unique identifiers to Bing for personalized search results as default.

It feels like a deftly move to offload their own responsibility to then be able to tout privacy as a selling point because they themselves don’t do anything with your information, Microsoft does.

Their value proposition is planting trees and not privacy. They get a cut of the Bing ad revenues and a cut of that is invested in trees. Its a simple model. I learned about it 1-2 years ago and was expecting more of these ‘feel good’ labelled search engines.

Which search engine are you using now instead of Ecosia?

I'm much more comfortable to give some information to Microsoft then giving more information to Google so they can add it to my profile they already have.

I use DuckDuckGo and StartPage. StartPage uses Google's result without sharing user IP(https://support.startpage.com/index.php?/Knowledgebase/Artic...). I think ecosia can do something similar to that and I would be extremely glad to switch.

How is this different to using Bing as a search engine directly?

It is not. I've been using DuckDuckGo before switching to them, for me privacy is a big deal. When I first saw ecosia, I thought it was similar to DDG in terms of privacy(Probably because they had pro-privacy phrases).

I know it's not a problem for most, especially if they are using search engines like Bing or Google. And I believe it's better to use ecosia than using say, Bing or Google.

There isn't other than the planet benefits

Reply on news.ycombinator.com