DuckDuckGo email protection beta now open
spreadprivacy.com
spreadprivacy.com
Please let me pay for this service. It looks worth having and: 1) I'd like to know that it is funded by users, rather than advertisers and thus can resist privacy invasion presuures. 2) I'd like to have some basis for belief that it will be around longer than it takes the VC money to run out, (or the marketing budget, or whatever non-sustainable pot it comes from).
Our product vision is an "easy button" for privacy, an all-in-one privacy app. Email protection is part of that, along with search, browsing, etc. Put another way, we see email protection as part of our core product, and within our app we autofill duck addresses in email forms.
We will take your comment into consideration, though we prefer free services where possible so more people can get privacy protection, which is in line with our mission. This service comes with it a set of privacy guarantees here: https://duckduckgo.com/email/privacy-guarantees and we will not be putting ads on it.
If a product is subsidized by a company's other products, it's hard for me to believe it'll be around forever. For an email product, that's a huge problem, because I use my address in hundreds of contexts that take a long time to identify and migrate, much longer than a typical company's sunsetting notice.
EDIT: The parent comment was edited to note that they perceive DDG Email as part of the core product, not a separate product. That's helpful to know, but I'm still skeptical that that's sustainable in the long term. This would not be the first time a feature was cut from a product because it was too expensive to maintain. I'll be waiting to see their unified privacy solution really take off before I place any bets on this feature.
Just because you're a product doesn't mean the service is not sustainable. It should be very easy for them to figure out whether the feature is profitable or not compared to other acquisition methods.
Fastmail’s email servers are in the US and the company is in Australia. Both are in the five eyes jurisdictions, plus Australia has some draconian laws (see Assistance and Access Bill, though email itself is generally not a secure enough channel). ProtonMail is in Switzerland, which is better surveillance-wise, but it still complies (as one would expect a company to) with court orders and has disclosed the IP address of an activist due to a court order.
Fastmail supports IMAP, which means you can use any email client on a desktop or phone. ProtonMail does not support IMAP directly on desktops and requires a “bridge application” for IMAP. This is provided for paying customers. ProtonMail does not have any support for IMAP on smartphones, where you’re either left to using the browser or using the ProtonMail app.
While one may marginally improve some aspects of the service and has strategic value, the other actually moves the needle in terms of an end-user's overall privacy.
But presumably DDG has contractual agreements with Microsoft so “no longer has an index” is a hypothetical that isn’t really grounded in reality or something that would be likely to happen without warning.
And if Bing is no longer viable at some point for some reason, that would be a good reason to change the priority of building an index.
But clearly DDG feels secure enough in their current agreement, and as of now, we have no reason to believe otherwise.
You have "email protection" but do you have nice stuff like sandbox detonation and private intel partnerships with companies like Proofpoint? That as a premium might be worth charging. Heck, even public yara rule scanning and allowing inbox owners to set things like DMARC enforcement and custom rules and actions would be a nice premium.
This is also the reason I'm not particularly excited about DDG in general. They have exactly the same business model as Google, so there is no reason for me to feel confident they won't follow the same trajectory as Google.
Being funded by search ads was never an issue with google and privacy until they switch from contextual ads and morphed into personal ads.
DDG winning search on bing search isn't the same trajectory. At best lycos like would be the most likely trajectory.
DuckDuckGo in 2022 is an upstart search provider promising a clean, minimal, user-focused ad-supported search experience as an alternative to entrenched search engines like Google.
I'm old enough to remember when Google was the new and exciting thing (just give it a try and ignore the stupid-sounding name!). For the longest time there wasn't even such a thing as a Google account, it just saved preferences like safe-search locally using cookies, and ads were just a small distinctly colored text bar above the organic search results, directly related to your search keywords.
Not sure how paying for this service makes it any less likely that DDG will flip a switch to make that targeted advertising money though. That temptation will exist either with a paid service or a non targeted ad supported service.
I have very little tolerance for companies that double-dip though. I subscribed to the New York Times for a while, but cancelled, in part, because they still stuffed their pages with ads both explicit and implicit.
I really want the option to turn off certain sites (eg. w3schools) entirely from search results, not just demote them.
Open this page in the DuckDuckGo app to continue.”
Reminds me of Reddit shenanigans…
Please stop censoring search results, no matter how morally/politically opposed to them the organization may be. Privacy + Censorship is not a good mix.
The truth needs no defense.
We (DuckDuckGo) subsequently made a help page to explain it in detail: https://help.duckduckgo.com/duckduckgo-help-pages/results/ne.... Tl;dr: we don’t censor, we don’t move things so far down that they are effectively censored, we don't evaluate individual stories or narratives for "truth", and we don’t rank based on any political agenda or opinions. This is just a summary though so would read the help page for details.
I also put out a clarification thread about various misconceptions that included this topic amongst others (like the fact that no, we’re not owned by Google), but the help page referenced above is the best and most thorough explanation of our news rankings. https://twitter.com/yegg/status/1515635886855233537
This is censorship, since DDG is now deciding what is considered "Disinformation".
Your clarification thread does not state DDG is not down-ranking these sites based on what DDG feels is "disinformation". It merely asserts DDG is not purging results - these are two very different things.
Just to be clear, I too support Ukraine, and am aghast at the deliberately misleading information ("disinformation") coming out of the Russian War Machine. However, as I previously wrote, the truth needs no defense. Hiding away things we don't like doesn't make them go away, it just makes them go underground. We need this information freely available so it can be discussed and disproven out in the open.
If users wanted curated search results, they might as well use Google or Bing...
Lastly, to repeat, Privacy + Censorship (of any kind) do not go together. This was quite a large misstep for DDG, and has burned a lot of trust.
That said, the help page I referenced is the most detailed explanation of how our news rankings work: https://help.duckduckgo.com/duckduckgo-help-pages/results/ne....
To be clear, that means we do not have a definition of "disinformation". I'm to blame for tweeting something that was highly ambiguous but we were never actually doing what we've been accused of doing.
It's a very tough situation, needing to assure people that you honestly aren't doing what you claimed and just misspoke.
1- https://www.chicagotribune.com/opinion/commentary/ct-neo-naz...
Edit: My bad, I missed a legit link in parent comment. That said, that link should have been front & center. (Edit 2: it now is. Good on you!)
I prefer paying 10$ a month and forget about mail server issues and wondering if my mail is going to the spam folder..
That being said, there’s probably not much need to pay more than $5/mo. I’m very happy with Fastmail at $60/yr.
Which support custom domain and more features, and not locked to a specific browser.
Both open source and self-hostable, SL is by Proton(Mail).
Contrapositive yes, converse no. Companies could still make money from both sides of a market. Look at the lack of net neutrality. Look also at how ISPs used to be able to sell your data, despite you paying them !
Newspapers is free or dirt cheap. You basically pay the paper and distribution costs if anything. Those that do charge to read it online don't show ads to subscribers.
> Cable tv
The main selling point of cable TV was no ads. Eventually they started adding ads, and that's probably the reason cable tv is fading away.
> Netflix
Doesn't have ads right now, and if they do in future, people will just move away.
This lowers my trust in DDG.
It's the same approach all companies use, once they grow. "Everyone is telling you they are the good guys, but they are throwing invasive technology at you! Fight back! ... by installing our invasive technology! Trust us, we are the good guys!"
That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system.
Putting generated addresses into forms... I would do that manually.
If I really would do that multiple times a day (But who signs up for services so often?) I would use a bookmarklet for it.
Bookmarklets are way less intrusive than extensions. And have other usability advantages. I can nicely put them into my bookmarks for example.
But it still feels wrong to me. Instead of giving company A their email, you are suggesting people give company B full access to all their browsing data. The "Trust us we are the good guys" approach just does not click with me.
"Why do you need my house keys to deliver mail?"
"So we can put packages inside the house in case it's raining hard and you are not at home."
"That's OK, I have a good porch and would rather you put everything not fitting in the mailbox there"
"Studies show that users prefer dry packages and may be concerned with theft. We need this in order to provide secure delivery in all conditions, take it or leave it"
No: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
> Use the `optional_permissions` key to list permissions that you want to ask for at runtime, after your extension has been installed.
That you promise to behave well does not change that. It is the "Trust us" argument again. If we could trust companies, we could give them our real emails.
I'm assuming you realize that there is more than one company, and that one can trust different companies to different extents. I trust DDG more than I trust most other companies. I trust DDG more than I trust Amazon, and I've given Amazon my email--a decision I sometimes regret!
But DDG proposes "Trust us with all your browsing data, including your private emails, your bank statements, all your passwords, everything you read and write rather than manually type the temp email". To me that seems pretty extreme.
I suggest that DDG proposes, "Trust us with access to many things, most of which we promise we won't even look at, none of which we will ever keep." Given that the extremeness is the result of browser makers, I think DDG has earned my trust. Your mileage may vary.
When I tried today I was not waitlisted, but I also wasn’t challenged to identify myself that I saw. I created my forwarder. I’m puzzled how, if this is connected to my device ID in some way, I will be able to access it on my next device.
They could offer an external UI, but this is a beta and DDG is not an ISP. If you want email forwarding, you already have plenty of choices — and catch-all addresses and plus signs.
Every email from an email alias includes a link. That link is used to look at the details of that email alias and gives you the option to deactivate it. You'd think there would be some login verification to prevent just anyone from using that link, but no, anyone that has this link, can now deactivate your email alias. The password itself is formatted in json, compressed with deflate, and simply tacked on to the end of the link's URL. When you click on the link, the destination webpage takes the end of the URL, decompresses the deflate, and serves a deactivate button to deactivate the email alias. When you click on that button, the email alias's address and password are sent to DDG's API and your email alias is disabled.
Well I can't tell in how many ways that can be harmful, but for example if Bob is tricked to click to the legit link from the website and enter his personal information, then I can change the alias to my own email, reset the password and have full access to Bob's verified account, so yeah, that's one big flaw IMO.
1. Deactivation requires email verification
2. Email aliases are tied to your DDG account and you can only use the email link when you are logged into your account
> Email Protection is not available in this browser
> Email Protection is also available on desktop with the DuckDuckGo app for Mac (beta), as well as DuckDuckGo extensions for Firefox, Chrome, Brave, and Edge.
What, I need to install a piece of software to my computer or an extension to my browser to use a service? That's invasive and, without a very good explanation (that is nowhere to be seen on that page), massively hurts my trust in the company.
> That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system.
This is a satisfactory explanation. But it's neither on the signup page, nor on the announcement page.
... and it's still really easy to accuse you of just trying to get some app installs - which would be fine if you admitted it.
I wish there was a way for these relay services to be effective since they are much, much easier to get someone to use than telling them to just up and move from gmail to fastmail.
I can't for the life of me, however, figure out how to get 1Password to auto-gen a masked email from their iPhone app or desktop app.
Is this possible?
However, during that time I filed two support tickets and neither left me feeling particularly warm and fuzzy about the faces behind the business that I was pledging my annual subscription to. The response in the latter instance in fact was so bad that it's what motivated me to look elsewhere rather than renew. I was prepared to pay more just to know that I wasn't doing business with bullies/jerks. I ended up going with a smaller provider. Without checking, my annual expenses are actually around half as much, IIRC.
I really wanted to switch to Fastmail a few years back but 1) its registration page was intermittently down for me and 2) when I caught it during uptime, it sent me to phone SMS verification which I found invasive given it is a paid service. I was ready to give it a chance anyway, but no SMS got delivered to me in the end.
Your profile doesn't list a way to contact you privately.
As of last year, it's supposed to be one of the services listed on <https://www.fsf.org/resources/webmail-systems>, but it's not. I just reached out to Greg Farough to follow up on why.
By the way, according to my Mail's connection doctor on mac, it appears to use IMAP when talking to gmail as of now. I wasn't aware Google was phasing out proper IMAP support, my concern was more about them being known to ban accounts with little recourse.
I've been using them for 18 months and the support has been not perfect, but 100x that of e.g. Amazon support chat
https://chrome.google.com/webstore/detail/duckduckgo-privacy...
Having used Firefox Relay a bit, I'm pretty happy with it but the free tier is relatively limited. DDG email seems to allow unlimited addresses but after a quick look it's not obvious that you can turn them off if an account is getting too much spam.
Puppies and rainbows and safety and privacy... all you have to do is channel all of your information through one entity!
Also, friendly reminder that Safari collects your browsing history and admits so in their TOS [2]. Whereas DDG merely has access, but says they do not collect anything
Apple does this well with their email masking service; all emails have an @icloud.com domain, the same as primary emails. A service can't simply block @icloud.com without blocking millions of primary/default addresses.
well, that's cool I guess
For example, see discussion in this thread[0]. Even though the article itself seemed misleading, many commenters raised some good points.
Is this an e-mail provider? A client? Something else?
If I have X Provider and I access it using Y client (ie, Thunderbird), what exactly does this add/replace/enhance? Where does "Relay" fit in since some people here mention it?
Competitors would include Cloudflare¹ and Apple².
¹ https://blog.cloudflare.com/introducing-email-routing/
² https://support.apple.com/guide/icloud/what-you-can-do-with-...
I will have nothing to do with any of their products and no longer recommend them to others.
The problem with minitru is that 2 plus 2 does not, in fact, equal 5. It's not that saying one fact is true is somehow immoral.
The issue has never been about truth itself. It's always been that you should allow no single entity to be the arbiter of what is the truth, because everyone has an agenda, and organizations have multiple people with multiple agendas.
*In the military this is considered objectively true, and drawing dicks on things is one of humanity's oldest memes.
Can you provide a citation for this?
"At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation.": [1]
At this point, DDG is a front for Microsoft using 'privacy' buzzwords. Might as well use Brave Search then.
[0] https://help.duckduckgo.com/duckduckgo-help-pages/results/so...
[1] https://twitter.com/yegg/status/1501716484761997318
[2] https://www.vox.com/recode/22981115/duckduckgo-free-speech-p...
[3] https://www.reddit.com/r/duckduckgo/comments/hx5dn5/proof_du...
At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation.
https://twitter.com/yegg/status/1501716484761997318
-----
> In addition to down-ranking sites associated with disinformation, we also often place news modules and information boxes at the top of DuckDuckGo search results (where they are seen and clicked the most) to highlight quality information for rapidly unfolding topics.
https://twitter.com/yegg/status/1501717193855283201
----
It should be obvious why this is problematic ...
Or search google yourself to get a broader picture.
This is the gist of what everyone is upset about, of those who are upset. The entire point of DDG was that the search results were never to be tampered with for personalization reasons, censoring results due to political reasons seems to be a slippery slope.
I don't see how capturing personal information from users for any reason has anything whatsoever to do with omitting perceived misinformation from all users across the board. One can agree or disagree with the decision, but they are two entirely different issues in entirely different areas, and one is in no way a "slippery slope" toward the other.
Also, search engines have _as their sole purpose_ sorting their list of links by some measure of quality. Removing useless nonsense is what we go there for.
We (DuckDuckGo) subsequently made a help page to explain it in detail: https://help.duckduckgo.com/duckduckgo-help-pages/results/ne... Tl;dr: we don’t censor, we don’t move things so far down that they are effectively censored, we don't evaluate individual stories or narratives for "truth", and we don’t rank based on any political agenda or opinions. This is just a summary though so would read the help page for details.
I also put out a clarification thread about misconceptions that included this topic amongst others (like the fact that no, we’re not owned by Google), but the help page referenced above is the best and most thorough explanation of our news rankings. https://twitter.com/yegg/status/1515635886855233537
It's your deep financial ties to Microsoft that's worrying. And it seems you're willing to turn your back on privacy/tracking for your friends when Microsoft asks.
As for our private search engine, it is in actually way more than Bing at this point. We have approximately a millions lines of search code at this point, many tens of millions of dollars invested in them and a staff of about 200.
EDIT: The site has been updated to point to this!
Go on.....
DDG is signing themselves up for a hard challenge, though I think they're up to it. Once you offer a service like this, you take upon yourself the burden of maximizing the outbound signal-noise ratio for emails, or you run the risk that other email providers identify your node as damaged and route around it. So they'll have to be on top of uses of their service for spam and aggressively police and kill those accounts. I'm excited to see what special sauce they're bringing to the field in this space.
I already use spamgourmet (a old great free service in the same features) and despite the fact it has several very different domains, it's rejected sometimes.
Something as high profile as ddg will be flagged very quickly.
The only one that can get away with it is gmail with the "+" aliases, because nobody can afford to reject it.
This blogpost does a REALLY POOR job to explain what, why and how to use this. Hope someone can clean this up and simplify what this service does.
What I'd pay for in an email client is a way for it to help me sort through the giant stream of stuff I constantly receive.
For example when I buy something online I get 4 different email threads in Gmail: 1. order confirmation 2.it was shipped 3.it's arrived 4.fill up this survey
I want my email client to cluster all those into one. Basically sift through my crap and summarize what's important and delete the unimportant stuff because I hate having to constantly keeping my inbox tidy.
These all support custom domains, except for Firefox Relay, which only supports a custom subdomain.
It’s getting a bit of traction even with the rubbish website :).
Edit - I use DDG on several devices, but happen to not use it on the one where I installed this extension.
But one thing was nice, I registered my mail with a hotline agent via phone. I told them my mail is name-$YOURCOMPANYNAME@domain. They replied, oh you are a colleague, then I can give you discount :)
- Startup script that fetches the aliases from DB and modifies a mail client configuration so that all randomly generated addresses are annotated with a short descriptive text indicating to whom the address was issued and makes it so that replying sets the From header to the alias.
This combo works well for me.
First, there two different kind of on-demand addresses.
1. Registration, these emails are stored in the password manager
2. Throw away, one time addresses
Second, I maintain a two mail folder method: inbox and archive. Sent mails are put into inbox, too. This makes mail threads a whole. From there they are either purged if spam or moved over to archive.
From here I can answer your question, how I manage all those generated addresses. The folders are indexed. So I am able to find anything (if not encrypted). In particular I can retrieve all my used addresses.
Especially as the extension seems to try and install some adblock style stuff which I already use ublock for and overwrites the default search engine with no option to disable it. Every time I need to generate a new email I need to re-enable the extension, copy the email address and then disable the extension again. Not nice UX.
Sadly, the current situation with mobile and desktop software makes it much easier to run this in a datacenter. Access to my email's content, and especially binding my identity on many web sites to the duck.com domain, likely is worth something, too.
As a Safari and Hide My Email user I completely welcome this service. If anything, it pushes more companies to do the same.
Makes no sense, despite the offered message content sanitization that should be best done in the MUA.
Removed three trackers, but left several in place.
i have been selfhosting on racknerd for like last 2 years and beyond the first month, i have been pretty much put it on auto mode.
i use mailinabox so i get to use roundcube and it has a banner
"To protect your privacy remote resources have been blocked."
this is by default for all links and images unless i explicitly allow someone so isn't that the same thing?
I'm surprised to see that Safari is not supported.
the only way the fastmail one works is there's paying customers on that domain (and a lot of them)
They can’t block all domains other than gmail and outlook, can they?
> That duck address is unavailable. Try something more unique.
:(
(Disclosure: I work on one of them, Firefox Relay.)
OSS alternative with freemium/paid subscription model (but without email tracker removal unfortunately)
https://github.com/simple-login/app
AA and SL do look like the two more solid options compared to anything else I've seen so far.
[0]: https://proton.me/news/proton-and-simplelogin-join-forces
It doesn't yet have all the same features as SimpleLogin/AnonAddy, but unlike them it does remove email trackers.
I should note though, that while it is open source (and freemium), it's reliant on quite some infra that makes it pretty much impossible to self-host, if that's something you're looking to do.