Hacker News Reader

Comment by fpgaminer | Hacker News Reader

I've had this question for awhile ... What is the advantage to using DuckDuckGo, with respect to privacy? All I've found is that they say privacy is important and that they don't track users. But I see no way for them to prove that. So you still have to trust them not to spy on you. Perhaps on the whole that is better than alternatives. "Google is definitely spying on me" versus "DuckDuckGo might be spying on me". Is that the only difference, or am I missing something?

If that's the only difference, isn't Google-over-Tor a better option? Known privacy with world-class search results?

View on HN

Just did a surface audit.

They set and read no cookies. You can test this yourself.

They set etags on static assets, and those theoretically could be used to track you as an identifiable visitor.

How else would they track you? By IP address? That would make any kind of tracking useless -- how would you deal with trying to track 100,000 connections from behind NAT, individually, other than cookies or etags?

There's browser fingerprinting, but I don't see any evidence of that either.

What evidence of browser fingerprinting would you expect to see?

a bulky or obfuscated javascript file probing the standard fingerprinting areas of your browser

Correct. The standard reference is https://panopticlick.eff.org/.

> If that's the only difference, isn't Google-over-Tor a better option?

No, DDG is better because they don't limit or captcha you over Tor.

Also, brand names do matter. If DDG has staked their reputation on privacy, it's a safer bet. It would be difficult for them to be monetizing personal data when it's their stated policy not to. You'd have to hope the people you're selling this data to keep their mouths shut and so do DDG (ex)employees.

It's worth supporting companies who are using a privacy-centric business model.

Well, it's very unusual in this day for a company to proactively protect your privacy. Whether they actually do is unknowable without encryption.

Reply on news.ycombinator.com