Hacker News Reader

Comment by ancarda | Hacker News Reader

If you are using DuckDuckGo for privacy reasons, I strongly suggest you use https://startpage.com/ instead.

DuckDuckGo isn't much better than Google; both of them hijack your links. This gives an opportunity to track what you click on. If you watch carefully your links go to "r.duckduckgo.com" -- this page also doesn't use SSL. For example:

http://r.duckduckgo.com/l/?kh=-1&uddg=https%3A%2F%2Fen.wikip...

StartPage doesn't hijack links, it (optionally) uses POST and you never send a referer header so traffic looks organic.

View on HN

> StartPage doesn't hijack links, it (optionally) uses POST and you never send a referer header so traffic looks organic

... and looks like MSN Search results from 2006. Not just ugly and cluttered, which I don't mind too much, but dysfunctional too: no keyboard navigation between results nor editing the search query without using the mouse to focus the box. That is an immediate no-go for me.

I don't like the design either, it's definitely one of DuckDuckGo's strengths, especially the new redesign. It's very nice.

You can make it look like this: https://i.imgur.com/jMucQvl.png

I‘m not entirely satisfied with startpage either though. What we really need is a local search proxy that goes via Google/Bing however you like, e.g. 1) using clearnet without cookies and cleaning up links (Google, Startpage, Bing) 2) via Tor automatically falling back if you get captcha (with option to do the captcha if you don’t like results) 3) Like 1) except via some VPN/Proxy

The results from each source (or multiple) could be normalized and the local app can offer any kind of interface you like.

I’ll write it at some point, but if anyone wants to steal that idea — please do.

r.duckduckgo.com is actually there for privacy, to remove HTTP referers. See: https://duck.co/help/results/rduckduckgocom

If you search using POST, that isn't a problem. Also, referer headers aren't sent to unencrypted links so if https://duckduckgo.com sent me to http://example.com they would not see where I came from.

Those two combined offer better privacy as no website can know what you were searching for and only secure websites know you came from DuckDuckGo. This setup doesn't give DuckDuckGo a chance to track what I'm clicking on.

POST-based searches are rather inconvenient, as there's no easy way of saving the search page. As far as I'm aware, referer headers are still sent to HTTPS links, even if the origin differs. So https://duckduckgo.com would still send referers to https://example.com.

But if you still don't want your clicks going through the r.duckduckgo.com domain, you can turn it off in the settings.

Presumably you also disable Javascript by default, right?

I don't see it; links on ddg are always direct to me; perhaps it's only for advertising links or something like anonym.to to hide some referer you'd send otherwise. What browser are you using?

I'm using Firefox. I see a lot of r.duckduckgo.com entries in my history.

Edit: I can't replicate in Chrome or Safari but if I change my user-agent in Safari, it begins hijacking my URLs. The JavaScript is obfuscated so it's hard to tell if it's actually checking for Firefox or not. The function it calls is DDG.get_http_redirect

You can read more about that here: https://duck.co/blog/https-on-by-default

It has no privacy impact since we do not store or collect personal information.

>we do not store or collect personal information.

But the redirection is done over plain HTTP and not HTTPS. If you don't have a wildcard certificate, you could use /r?url=... instead of a subdomain.

Ideally, the best setup would be to use the "noreferrer" attribute on anchor tags. It's a relatively new standard but perhaps you could detect if it's supported and then use that rather than a redirector?

https://www.webkit.org/blog/907/webkit-nightlies-support-htm...

As I mention in a previous comment, if you are using the TOR hidden service (3g2upl4pq6kufc4m.onion/) the redirect goes over a TOR exit node without https. Ideally it should use the hidden service so no exit node is involved, or at the least use HTTPS.

Reply on news.ycombinator.com