Hacker News Reader

Comment by jazzyjackson | Hacker News Reader

In the sense that Chrome logs and syncs your browser history across all devices logged into your account, the search queries are plaintext, so google can probably read them.

Basically I left chrome when they made it annoying to use it without being logged in to the browser (Why would I want to be logged into a web browser?)

View on HN

Why would you need to be logged in? I'd wager that logging in simply makes the history available to you across devices. Google knows which device made the queries and knows you use the device, even without any further analysis it's a good bet you made the search.

I use an application level firewall to block Chrome's outgoing connections and it took a lot of effort to get the ruleset right, even now I'm not sure it is.

Which is why I use other browsers ;-)

How did you block outgoing connections without breaking web browsing?

Trial and error. I got a list of Google's IP ranges (using something like the technique in [1]) and input them into the app layer firewall and tried browsing using Chrome and nothing broke, but that's because when I use Chrome I don't browse to any Google sites.

I use uMatrix on my main browser and I'm well used to breaking sites, I suppose it's increased my patience for refreshing pages until I find the magic minimum for them to work.

I almost always have to turn off all kinds of blocking when doing a payment though, especially anything involving redirects, like plane tickets. Javascript is the biggest pain, IMO, next would be sites that use Recaptcha.

[1] https://snurps.blogspot.com/2013/10/how-many-ip-addresses-do...

I am not logged in to Chrome.

The above mentioned privacy issue with DuckDuckGo exists whether you are logged in or not into Chrome.

1. By default DDG keeps your query in URL (for example duckduckgo.com/?q=blue+widgets) so that exposes your DDG searches to Google through Chrome

2. Whatever browser you use, if anyone accessed your browsing history they would know exactly what you searched for

These can be changed in DDG settings by changing requests from GET to POST but there is probably lack of awareness among users who come to DDG because of the whole 'privacy' thing. More on DDG privacy issues https://choosetoencrypt.com/search-engines/duckduckgos-bigge...

But nobody yet has confirmed this issue. It's been mentioned but without any supporting evidence.

Does anyone have a link or other evidence that definitively shows that Chrome sends my browsing history to Google independently of my signed-in status? That's what was implied. That's what I find hard to believe. That's what has not yet been demonstrated in this thread.

No problem! We'll just check the source code for Chrome.

...

Ah. We can't. Chrome is closed-source, because Google wants to... Say, why is Chrome closed-source? What do Google add to Chromium that they don't want you to see?

Point well made, but my question stands! If the OP's allegation is true, someone has sniffed the packets. There's a blog post somewhere. There's something.

I just want that something here, for the record. As it stands, I am dismissing the allegation as baseless. I'm not sticking up for Chrome, which I do not trust, but this allegation has no evidence.

The local privacy of GET vs POST for submitting a query is a super cool distinction to point out, thanks

I went looking for this setting in DDG because I didn't understand you at first, but you're saying that DuckDuckGo could change their website to hide the query in a request body instead of the querystring, not that its a user-accessible feature, right?

Reply on news.ycombinator.com