Hacker News Reader

Comment by Yrlec | Hacker News Reader

I am one of those that have changed to DDG after the scandals. So far it feels like I find my results as quickly as I used to do with Google. One nice feature that I just found: under the Privacy tab at https://duckduckgo.com/settings you can change so that the query is sent as a HTTP POST parameter instead of a GET parameter. That way your ISP can't find out what you are searching for (assuming you have https enabled).

View on HN

It shouldn't matter if you are using GET or POST - how would your ISP find out anything about your request if you are using HTTPS?

You are correct, I was drawing the wrong conclusions from how the HTTP headers are sent. It doesn't affect how much info the ISP gets. However, POST parameters are somewhat more secure, since less info about your query is cached by your browser: http://stackoverflow.com/questions/198462/is-either-get-or-p...

POST parameters also usually won't show up in logs, unlike GET parameters.

Whose logs?

Web server logs typically don't record POST parameters. It's possible that the web server could record them anyways, though.

SSL encrypts everything in the url after the ? so GET or POST matters little.

Not just the query string values, it encrypts the path to the resource (and headers, etc) as well. However, another HNer pointed me to an article on side-channel attacks which is helpful to keep in mind when considering privacy:

https://news.ycombinator.com/item?id=5492338

Consider using Fiddler some time without HTTPS decryption enabled and go roaming around HTTPS sites. You'll see how much information it can extract from the transaction.

I find the option to ‘save’ options in the URL much nicer. If I want to change my default language, safe mode etc. with Google, I need to enable Cookies. With DDG, I can save these in the search engine settings in Opera :)

Reply on news.ycombinator.com