Hacker News Reader

Comment by Groxx | Hacker News Reader

Or, you could use https://encrypted.google.com which disables the referral[1]. You can also turn off the history[2].

Other info, like your IP address (which they partially anonymize after... 9/18/24 months (conflicting details)) and cookie[3] (which you can clear / block), is still stored. Odds are DDG does this too (edit: they don't, see replies), as it's mostly useful for overall statistics.

[1]: http://www.google.com/support/websearch/bin/answer.py?answer... [2]: http://www.google.com/support/accounts/bin/answer.py?answer=... [3]: http://www.google.com/privacy/faq.html#toc-terms-server-logs

View on HN

Other info, like your IP address...is still stored. Odds are DDG does this too, as it's mostly useful for overall statistics.

You could have checked this assertion by reading DDG's plain-language privacy policy:

When you access DuckDuckGo (or any Web site), your Web browser automatically sends information about your computer, e.g. your User agent and IP address.

Because this information could be used to link you to your searches, we do not log (store) it at all. This is a very unusual practice, but we feel it is an important step to protect your privacy.

Edit: TOS -> privacy policy

>This is a very unusual practice

So I was close. They even admit the odds were in my favor. Thanks for the fact!

Close, but wrong.

Which is why I edited my top post. No need to spread inaccurate information.

Since you're going on the offensive, a defensive move might be in order: no, I wasn't. I said "odds are", not "DDG does", because I didn't know for sure and did not intend to claim to. The odds are in my favor, the fact is an aberration on otherwise almost-uniform behavior by search providers.

Nope, you were just plain wrong.

The odds would have been in your favor if you have said "odds are a search engine chosen at random does this too".

But, instead, you said: "odds are DDG does this too", thus binding the odds to DDG.

Since the general stance of DDG is pro privacy, you should have reasoned that the odds were in favor of DDG NOT doing this.

(Not to mention that posting that you "were close" didn't provide anything to the discussion --apart from some ill-conceived face saving from your part).

It bound the odds to DDG in the face of a lack of information, where you can only extrapolate from what you know - other search providers. It would've bound straight to DDG if I knew one way or another, but I didn't. Context is very important for such phrasing.

I used it to say "thanks", which was the primary reason for me. The rest was perhaps ill-conceived, but it has been amusing to see the spikes up and down in its rank - it went > +10 for a while.

We do not store IPs or have any personally identifying cookies (actually no cookies whatsoever by default). We don't store user agents either, which have also been shown to be able to uniquely identify you. Also, "partial anonymization" has been shown time and time again not to work. More details on our privacy stuff here: https://duckduckgo.com/privacy.html

Yeah, there's been flack about Google's anonymization before. Specifically, they apparently remove the last 8 digits. Which allows you to (partially) reconstruct (some) people by tracing IP + cookie. A failed anonymization, absolutely, but blockable if you are already taking steps to actually guard your privacy online, as part-way-there is almost the same as nowhere-near when you have enough data.

Solved everywhere, of course, by anonymizing your IP address and blocking the cookie. And as you give your IP to the site you visit through DDG, as well as to their advertisers if you're not proactively blocking them (and those tools can fail / be nullified by a server transmission), extreme measures are the only effective means of actually protecting your privacy. As such, I don't find those two steps to be at all unexpected for someone who actually wishes to guard their privacy.

SSL doesn't disable the referrer header. It just happens to not be sent when the link you've clicked on isn't also using SSL. If the link you click on happens to be to an SSL site, they get the full referrer header as intended. A more appropriate way to hide the referrer is to just use a redirection that doesn't include the search terms.

Reply on news.ycombinator.com