Hacker News Reader

Comment by TekMol | Hacker News Reader

Prompting the user to install a browser extension to use an email forwarder looks like a dark pattern to me.

This lowers my trust in DDG.

It's the same approach all companies use, once they grow. "Everyone is telling you they are the good guys, but they are throwing invasive technology at you! Fight back! ... by installing our invasive technology! Trust us, we are the good guys!"

View on HN

We offer an all-in-one privacy app. The extension/app generates the addresses and autofills them into email forms, and so you need the extension/app for those key parts of the functionality. Once signed up you can use it somewhat though without the extension/app by giving out your personal duck address directly, and trackers will be stripped from messages sent to it and then forwarded to your regular inbox.

That said, we may indeed offer sign up outside the app/extension, but right now as a forwarding service, we are very sensitive to abuse of the system and so limiting it a bit helps to ensure we are on top of any abuse that doesn't bring down the whole system.

But the app changes my default search page and new tab home page without my permission. I installed the app to get my duck email address then immediately disabled it.

I'm not sure which "app" you are referring to in this case, but generally private search is a key part of being private online. In every browser but Chrome, you can, however, subsequently change the search engine if you want. It's not our fault you can't do it in Chrome -- that is their restriction.

I would not install an extension to give me a generated address. I would expect your website to give it to me.

Putting generated addresses into forms... I would do that manually.

If I really would do that multiple times a day (But who signs up for services so often?) I would use a bookmarklet for it.

Bookmarklets are way less intrusive than extensions. And have other usability advantages. I can nicely put them into my bookmarks for example.

As said, we may support this in the future. We did a lot of testing and found unequivocally that most people would prefer to have generated addresses automatically available in context within email fields when they use signup forms vs. having to go back to another website to get them (which most wouldn't actually do).

I agree with you in so far, that you would probably have 1000 times less users if you would cater to people like me.

But it still feels wrong to me. Instead of giving company A their email, you are suggesting people give company B full access to all their browsing data. The "Trust us we are the good guys" approach just does not click with me.

Understood, though just to be clear, email field identification happens client side, so we don't get your browsing history. More fundamentally though, we make a browser, and our privacy policy is to never create search or browsing histories.

Could you, if it's possible, at least remove the full browsing data permission on the extension?

That is required to provide all our various web tracking protections: https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we...

Right. The idea would be that users might not want that subset of functionality at all. In those cases, why not degrade gracefully?

"Why do you need my house keys to deliver mail?"

"So we can put packages inside the house in case it's raining hard and you are not at home."

"That's OK, I have a good porch and would rather you put everything not fitting in the mailbox there"

"Studies show that users prefer dry packages and may be concerned with theft. We need this in order to provide secure delivery in all conditions, take it or leave it"

Wouldn't that require making and maintaining separate versions of the app for every possible subset of permissions? That sounds like a nightmare not just for DDG but also for new users that have to figure out which version they need to install.

> Wouldn't that require making and maintaining separate versions of the app for every possible subset of permissions?

No: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

> Use the `optional_permissions` key to list permissions that you want to ask for at runtime, after your extension has been installed.

I said you get access to peoples browsing data. Your extension can access everything on every page people visit. And can send that data eveywhere.

That you promise to behave well does not change that. It is the "Trust us" argument again. If we could trust companies, we could give them our real emails.

> If we could trust companies, we could give them our real emails.

I'm assuming you realize that there is more than one company, and that one can trust different companies to different extents. I trust DDG more than I trust most other companies. I trust DDG more than I trust Amazon, and I've given Amazon my email--a decision I sometimes regret!

If the approach DDG proposes would be to "Trust us with your email rather than company B", that would be a fair argument.

But DDG proposes "Trust us with all your browsing data, including your private emails, your bank statements, all your passwords, everything you read and write rather than manually type the temp email". To me that seems pretty extreme.

That is not exactly what they propose. That is, however, the proposition, because of the way browser makers bundle permissions.

I suggest that DDG proposes, "Trust us with access to many things, most of which we promise we won't even look at, none of which we will ever keep." Given that the extremeness is the result of browser makers, I think DDG has earned my trust. Your mileage may vary.

The Waitlist suggested access to this was tied to device identifier.

When I tried today I was not waitlisted, but I also wasn’t challenged to identify myself that I saw. I created my forwarder. I’m puzzled how, if this is connected to my device ID in some way, I will be able to access it on my next device.

It is not connected to your device id. The waitlist worked on your device by storing a local token, and we never had your device id. On other devices/browsers you will need to authenticate via an email code/link forwarded through the service.

So you offer a privacy app that needs to see everything I'm doing online, just like a VPN, but at the html level. And that "html vpn" is free, funded by god knows who. I wouldn't use it, but I admit this might be a valid business idea. I'll also add that this "vpn" app trades a bit of DDG's reputation for attention.

No, unlike a VPN, our web tracker blocking all happens on your device. See our help page for details: https://help.duckduckgo.com/duckduckgo-help-pages/privacy/we.... We are are funded through private search ads.

Not sure if including the password used to deactivate the email alias, in every email sent, is the best idea btw

Yep. The moment I saw the "extension" requirement, I stopped.

I really don’t see the issue here. It’s completely understandable that DDG would not want to offer an easy API for this. This is likely seen as a “DDG app” feature exactly like Safari’s Hide My Email and like every browser’s password manager.

They could offer an external UI, but this is a beta and DDG is not an ISP. If you want email forwarding, you already have plenty of choices — and catch-all addresses and plus signs.

It is cognitive dissonance, with DDG. A large proportion of their users are exactly the sort of people who will not thoughtlessly install unnecessary extensions into their browsers. It is increasing attack surface, when minimizing should be a goal of privacy services. By the time you end up at DDG, you usually have been trained not to click on untrusted links and not to install dodgy browser extensions 'for your chance to win', and then confronted with a push to install what appears to all intents and purposes to be a dodgy browser extension.

Reply on news.ycombinator.com