Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 18 submissions in the queue.
posted by chromas on Thursday January 10 2019, @04:12PM   Printer-friendly
from the time-to-switch-to-dodododogo dept.

Submitted via IRC for Bytram

Is this for real? DuckDuckGo has grown in popularity primarily on its claim: We don't track you. Is this no longer true?

DuckDuckGo now fingerprinting visitors

DuckDuckGo is using the Canvas DOMRect API on their search engine. Canvas is used to make unique geometry measurements on target browsers, and DOMRect API uses rectangles. This can be verified with the CanvasBlocker Firefox add-on by Korbinian Kapsner. DDG has recently been redirecting some website navigations to cute pictures with remarks about their privacy promises. The organization is now seeking to expand their Internet presence. DDG are without question data brokers, and commercial websites that make promises like DDG does will not survive for long if they actually keep them.


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 1) by nitehawk214 on Thursday January 10 2019, @04:19PM (2 children)

    by nitehawk214 (1304) on Thursday January 10 2019, @04:19PM (#784532)

    Why do they need an advanced web api that makes "geometry measurements" of the browser, just to show a simple text box and a list of links?

    --
    "Don't you ever miss the days when you used to be nostalgic?" -Loiosh
    • (Score: 3, Insightful) by ikanreed on Thursday January 10 2019, @04:24PM (1 child)

      by ikanreed (3164) Subscriber Badge on Thursday January 10 2019, @04:24PM (#784535) Journal

      How else are web devs supposed to give you a good social experience that you share with your friends on your internet search?!

      • (Score: 2) by FatPhil on Friday January 11 2019, @11:10AM

        by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Friday January 11 2019, @11:10AM (#784976) Homepage
        I know there's a 99% chance you're being sarcarsetic, but as plain ascii is an imperfect medium, I'll answer your rhetorical question with "using HTML and CSS dating back at least a decade".

        For the hobby webpage I'm writing, I'm deliberately trying to implement all the interactive shit that would be nice (drop-down menus, stepper inputs, etc.) that is typically done using javascript, but using nothing more than CSS, preferably CSS1, for maximum portability, and all without smell, so it doesn't look shit in w3m/lynx/elinks. I've also asked a blind friend to advise. Bosh! Everything works everywhere, hoorah for CSS and having a brain with oxygen being fed to it.

        There's already a perfectly rich language for telling the browser what you need it to display - playing dumb and asking the server for additional assistance half way through the process is almost always unnecessary.
        --
        Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
  • (Score: 5, Insightful) by Anonymous Coward on Thursday January 10 2019, @04:30PM (21 children)

    by Anonymous Coward on Thursday January 10 2019, @04:30PM (#784537)

    All I see is a forum post saying that duckduckgo is using some drawing library functions and therefore they are tracking you. Unless I am seriously misunderstanding what "the Canvas DOMRect API" is, the conclusion does not follow from the premise. Details would be nice.

    Anyway, DuckDuckGo search works perfectly fine without running any ECZEMAscript, which privacy-conscious users should be doing anyway.

    • (Score: 1, Interesting) by Anonymous Coward on Thursday January 10 2019, @05:27PM (6 children)

      by Anonymous Coward on Thursday January 10 2019, @05:27PM (#784566)

      I'd like to see a response from them. Considering that their main selling points are not tracking users and not bubbling them either. It seems suicidal for them to start tracking people.

      That's not to say that they haven't had a change of heart, but I would like to hear from them before assuming that they're using this to track people rather than for a productive reason. These features were not added to browsers for spying on users, that came later as a consequence of being there.

      • (Score: 1, Interesting) by Anonymous Coward on Thursday January 10 2019, @06:20PM (4 children)

        by Anonymous Coward on Thursday January 10 2019, @06:20PM (#784603)

        Considering that their main selling points are not tracking users and not bubbling them either. It seems suicidal for them to start tracking people.

        Yeah, it would be an immensely stupid move on DuckDuckGo's part, which is why claims that DuckDuckGo are doing exactly opposite of their raison d'être need to be backed up with evidence. On that front there appears to be no evidence whatsoever, at least not in this anonymous forum post.

        TBH the entire post looks more like a shill for another search engine.

        • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @09:21PM

          by Anonymous Coward on Thursday January 10 2019, @09:21PM (#784672)

          Any accusation needs to be backed by evidence on part of the accuser, no matter what their raison d'être happens to be.

        • (Score: 3, Interesting) by FatPhil on Friday January 11 2019, @02:29AM (2 children)

          by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Friday January 11 2019, @02:29AM (#784814) Homepage
          Does this not count:
          """
          brianstoner 2019-01-07 15:42:43 UTC #9

          Hi, I work for DuckDuckGo and wanted to clarify that We absolutely do NOT doing
          any fingerprinting whatsoever. Our privacy policy is very clear on this: ?We
          don?t collect or share personal information.? https://duckduckgo.com/privacy

          We use a variety of browser API?s to deliver a search experience that is
          competitive with Google?s. Many ?fingerprint? protection extensions take a
          scorched earth approach, blocking any browser API that could be exploited by a
          bad actor.
          """

          It's an admission they're using tech that can be associated with being evil.
          --
          Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
          • (Score: 0) by Anonymous Coward on Friday January 11 2019, @04:22AM (1 child)

            by Anonymous Coward on Friday January 11 2019, @04:22AM (#784887)

            Which doesn't make their use evil. For almost every API in the browser, there is a non-evil reason it was provided. If you are going to call everything that has at least one bad use, then you should add all of HTML, let alone CSS and JavaScript, to your list too.

            • (Score: 2) by FatPhil on Friday January 11 2019, @11:16AM

              by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Friday January 11 2019, @11:16AM (#784977) Homepage
              Yes, but it's (a) unnecessary; and (b) suspicious.

              Do you think that a website that is trying to get you to trust them will achieve that goal using unnecessary suspicious techniques?
              --
              Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
      • (Score: 2, Informative) by Anonymous Coward on Friday January 11 2019, @12:08AM

        by Anonymous Coward on Friday January 11 2019, @12:08AM (#784741)
    • (Score: 3, Informative) by mmh on Thursday January 10 2019, @05:56PM (12 children)

      by mmh (721) on Thursday January 10 2019, @05:56PM (#784586)

      See this site for an example and full explanation: https://browserleaks.com/canvas [browserleaks.com]

      Canvas is an HTML5 API which is used to draw graphics and animations on a web page via scripting in JavaScript.

      But apart from this, canvas can be used as additional entropy in web-browser's fingerprinting and used for online tracking purposes.

      The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may got different checksum even if they are pixel-identical. At the system level – operating systems have different fonts, they use different algorithms and settings for anti-aliasing and sub-pixel rendering.

      • (Score: 2, Interesting) by Anonymous Coward on Thursday January 10 2019, @06:12PM (11 children)

        by Anonymous Coward on Thursday January 10 2019, @06:12PM (#784596)

        Obviously these drawing features, like basically every feature implemented in web browsers, can be used for tracking purposes.

        But that does not imply that DuckDuckGo actually is using this feature to track users. The linked forum post does not provide any evidence of such tracking and simply says "DuckDuckGo is doing X. Bad actors who track their users also do X. Therefore DuckDuckGo is a bad actor and is tracking users". This is not a sound argument.

        • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @06:47PM (4 children)

          by Anonymous Coward on Thursday January 10 2019, @06:47PM (#784609)

          We're never going to get "evidence" that they're tracking us, and if they tracking us are they won't tell. But, since duckduckgo claims to not be tracking users and claims it is their reason for existing, they should avoid using technologies that are commonly used for tracking and invading privacy.

          If they want to show graphics, they should use <img src=...

          • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @07:10PM

            by Anonymous Coward on Thursday January 10 2019, @07:10PM (#784618)

            We're never going to get "evidence" that they're tracking us, and if they tracking us are they won't tell.

            I'm never going to get "evidence" that you brutally murdered your first girlfriend, and if you did murder her you won't tell.

            Come on. If you want to assume everyone and their dog is tracking their users regardless of what they say then by all means, take steps to avoid browser fingerprinting. At minimum this means using Tor and never executing scripts on websites. Just don't go pointing fingers at everyone without any evidence saying "that person runs a website and says they don't track users, therefore he's a bad person and tracks users" because that just makes you an asshole.

            But, since duckduckgo claims to not be tracking users and claims it is their reason for existing, they should avoid using technologies that are commonly used for tracking and invading privacy.

            Unfortunately, this is simply impossible for any web site, because essentially every technology related to the world wide web is a technology that is commonly used for tracking and invading privacy.

          • (Score: 1, Insightful) by Anonymous Coward on Thursday January 10 2019, @07:29PM (2 children)

            by Anonymous Coward on Thursday January 10 2019, @07:29PM (#784625)

            We're never going to get "evidence" that they're tracking us

            If they were tracking you using this method, then the required JavaScript would be executed on your computer. You could see everything they're doing on your computer if you so desired, and could validate for yourself whether or not their usage of canvas is for tracking purposes.

            • (Score: 3, Informative) by edIII on Thursday January 10 2019, @11:52PM (1 child)

              by edIII (791) on Thursday January 10 2019, @11:52PM (#784734)

              Absolutely incorrect. The fingerprinting works by analyzing the rendering differences. That's data that is sent back anyways, AFAIK.

              So there is no way to tell from a valid use of the canvas, versus a tracking one, on your computer. You would need to be server side to see what they're doing with that information. If it were solely for the purposes of some display time use of the canvas, then that information wouldn't be stored after the fact. If they're storing that metadata and associating with sessions and other tracking data, then yes, they're tracking us.

              The problem is that so many valid uses of client-side tech exist beyond tracking. In this case, it's perfectly possible the DDG is using canvas for advanced rendering of images and videos.

              Like another poster stated, DDG works with Javascript disabled.

              --
              Technically, lunchtime is at any moment. It's just a wave function.
              • (Score: 0) by Anonymous Coward on Friday January 11 2019, @05:34PM

                by Anonymous Coward on Friday January 11 2019, @05:34PM (#785139)

                Absolutely incorrect. The fingerprinting works by analyzing the rendering differences. That's data that is sent back anyways, AFAIK.
                So there is no way to tell from a valid use of the canvas, versus a tracking one, on your computer.

                Absolutely incorrect. The code which would send the canvas content back to the server runs, you guessed it, on your computer, and a "valid use" of the canvas won't be sending any canvas content back to the server at all.

        • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @06:49PM (5 children)

          by Anonymous Coward on Thursday January 10 2019, @06:49PM (#784610)

          Then surely DDG is denying this and providing an explanation of why they have started using canvases, right?

          • (Score: 2, Interesting) by Anonymous Coward on Thursday January 10 2019, @06:56PM (4 children)

            by Anonymous Coward on Thursday January 10 2019, @06:56PM (#784612)

            Then surely DDG is denying this and providing an explanation of why they have started using canvases, right?

            Yes, that is exactly what they are doing [betanews.com].

            Speaking to TechCrunch, DuckDuckGo CEO Gabe Weinberg says that the warning is a false positive:

            Fingerprinting-detection libraries unfortunately create false positives because they don't anticipate good actors using some browser APIs for non-nefarious purposes for which they were designed. We know this not only because we're falsely identified here (and have been elsewhere) but because we are building this type of detection into our mobile app and browser extension and don't similarly want to make false claims.

            So what is DuckDuckGo using the API for? Weinberg thinks it could be the search engine's use of getBoundingClientRect() to "determine size of browser and how to layout the page" that's causing the problem.

            • (Score: 1, Insightful) by Anonymous Coward on Thursday January 10 2019, @09:28PM (1 child)

              by Anonymous Coward on Thursday January 10 2019, @09:28PM (#784676)

              I wish people would stop using scripting for things that % weights in CSS and HTML are perfectly sufficient for.

            • (Score: 0) by Anonymous Coward on Friday January 11 2019, @01:21AM

              by Anonymous Coward on Friday January 11 2019, @01:21AM (#784777)

              We have a browser for laying out the page.

            • (Score: 0) by Anonymous Coward on Friday January 11 2019, @12:49PM

              by Anonymous Coward on Friday January 11 2019, @12:49PM (#785003)

              So what is DuckDuckGo using the API for? Weinberg thinks it could be the search engine's use of getBoundingClientRect() to "determine size of browser and how to layout the page" that's causing the problem.

              Ok, this makes no sense. There is no need to use a huge heavyweight system like DOM Canvas to "determine size of browser and how to layout the page" when CSS percentages and media queries have existed since the CSS 2.1 era.

              So if this is correct, the DDG devs used a heavyweight library, one that can be used for fingerprinting and tracking purposes, to perform the function of a few CSS 2.1 declarations. That seems either incompetent, or else they do eventually plan to quietly begin fingerprinting, and this is just the first tentative step towards that goal (but with no fingerprinting yet, to get people to stop noticing they are using DOM canvas first by 'not fingerprinting'). Then, later, slowly, bits of JS code appear that start fingerprinting when no one is looking.

    • (Score: 4, Informative) by The Mighty Buzzard on Thursday January 10 2019, @07:59PM

      by The Mighty Buzzard (18) Subscriber Badge <themightybuzzard@proton.me> on Thursday January 10 2019, @07:59PM (#784640) Homepage Journal

      The bits in question appear to be part of the jQuery Throttle Debounce plugin [benalman.com] by Cowboy Ben Alman by a quick glance at line 43 of l110.js [duckduckgo.com]. Seems to be about as nefarious as a month old puppy with a spiked collar but I'm not going to do any serious digging today.

      --
      My rights don't end where your fear begins.
  • (Score: 3, Interesting) by urza9814 on Thursday January 10 2019, @04:44PM (5 children)

    by urza9814 (3954) on Thursday January 10 2019, @04:44PM (#784541) Journal

    Anyone here using YaCy or other open/distributed search engines?

    I recently installed YaCy on one of my servers and have been experimenting with it a bit. The results are usually slow and poor, but for some things it's alright. Probably I need to spend more than a week building up indexes. Very easy to automate an export of your Firefox history though (Firefox stores them as sqlite files) and feed that in as a crawler, so at least it'll index stuff you've already seen if you need to pull it back up.

    SSL support (without using default self-signed certs) has been giving me a ton of trouble though...to the point where trying to enable it has locked up the server process and screwed up the configuration so bad that I ended up just wiping the container and reinstalling -- more than once. This time I've allocated a hell of a lot more RAM though (8GB and counting...) which seems to be helping, so that might be my main issue.

    I was recently looking for alternatives too though...and did not find any. Anyone here know of any others?

    • (Score: 2) by cubancigar11 on Thursday January 10 2019, @04:55PM

      by cubancigar11 (330) on Thursday January 10 2019, @04:55PM (#784545) Homepage Journal

      My experiences with experimental technologies, so far, has been disappointing because I invariably find that the hassle of making "it" work just never ends. I don't have experience with YaCy though, so let me know how it turns out for you and if it is worth it. DISCLAIMER: I am back to using google after experimenting with ddg and bing for 1 year.

    • (Score: 2) by Runaway1956 on Thursday January 10 2019, @05:09PM (3 children)

      by Runaway1956 (2926) Subscriber Badge on Thursday January 10 2019, @05:09PM (#784556) Journal

      Look at Searx. https://github.com/asciimoo/searx/wiki/Installation [github.com]

      I got it working, then promptly screwed it up during configuration. It looks interesting, is why I tried it. But, when interest gets kicked in the head, it wants to take some time off. Maybe it's age - ten years ago, I would have doggedly stayed with it until it worked.

      • (Score: 2) by Runaway1956 on Thursday January 10 2019, @05:12PM (2 children)

        by Runaway1956 (2926) Subscriber Badge on Thursday January 10 2019, @05:12PM (#784557) Journal

        Sorry, THIS is the page I worked from for installation - https://asciimoo.github.io/searx/dev/install/installation.html [github.io]

        • (Score: 2) by urza9814 on Thursday January 10 2019, @05:55PM (1 child)

          by urza9814 (3954) on Thursday January 10 2019, @05:55PM (#784583) Journal

          I think I might have seen Searx in the Wikipedia list...but it's not really a search engine, it's just an aggregator. So my concerns would be:

          1) It's just forwarding requests to another search engine. If I set up my own instance, then it wouldn't be difficult to correlate my searches against my IP address (my server is in my living room, not some random cloud instance). I don't see how forwarding a request to Google through my own server would be any better than just using Google directly. And if I use someone else's installation, then I just have some lesser-known entity that I have to trust. For a project like this, those are probably less likely to be trying to monetize every single thing that they can, and therefore more trustworthy...but they're also harder to find if they do something illegal, and they might not be keeping up on maintenance and security. So probably more trustworthy but also more risky if they aren't.

          2) I block a lot of stuff on my home network. Including every Google domain I can find. Part of the reason I want to use YaCy is because every time I search on DDG, half the results are blocked. And I WANT them to be blocked, I just don't want them appearing in my results. If I run my own crawler then it can't index anything that my firewall prohibits, so that solves that issue nicely. Although I guess some kind of greasemonkey style script could potentially accomplish that goal as well if YaCy doesn't...

          • (Score: 1, Interesting) by Anonymous Coward on Thursday January 10 2019, @10:14PM

            by Anonymous Coward on Thursday January 10 2019, @10:14PM (#784691)

            Searx is nice because it's an aggregator AND it's open source. You can turn engines on/off easily and quickly, and setup takes about 10 minutes if you know how to use a web server and follow their simple instructions. So I can have it search using YaCy and whatever other engines I want. It's particularly nice when you're using it to search documentation.

  • (Score: 4, Insightful) by SomeGuy on Thursday January 10 2019, @04:53PM (1 child)

    by SomeGuy (5632) on Thursday January 10 2019, @04:53PM (#784544)

    If anyone believes a single word any company has to say about maintaining "privacy", then I have a bridge for sale you might be interested in.

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @06:51PM

      by Anonymous Coward on Thursday January 10 2019, @06:51PM (#784611)

      Oooh, a bridge you say? Where is it, does it already have tollbooths and how much are you asking?

  • (Score: 3, Informative) by Anonymous Coward on Thursday January 10 2019, @05:03PM

    by Anonymous Coward on Thursday January 10 2019, @05:03PM (#784551)

    They say they don't track you either, and I find they give better results than DDG.

  • (Score: 5, Interesting) by bzipitidoo on Thursday January 10 2019, @05:20PM (7 children)

    by bzipitidoo (4388) on Thursday January 10 2019, @05:20PM (#784563) Journal

    One thing I recall DuckDuckGo doing a while back was the same trick Google does. The links in the search results do not go directly to the sites. A link to example.com actually goes to https://www.google.com/url=http://example.com. [google.com] (Actually, the link is more complicated, but I'm simplifying here.) DDG used to do something similar, but it seems they've stopped that.

    Google meanwhile has gotten more insidious about it. In Firefox, it used to be that the user could see the actual destination by hovering over the link, no matter what the link text said. Now, even when hovering, the link looks like an innocent link directly to the site Google found. But it isn't. I did not know that was possible, and I find it disturbing that one of the chief quick and easy ways I use to check whether a link really goes where it says it goes can be beaten. Though I'm not terribly surprised. Think I may make a Firefox bug report about that, if someone else hasn't already. Now a way to see where the link really goes is right click on it and choose "copy link location". Can paste it, but don't have to. After selecting "copy link location", hover over the link again, and you will see that it really goes to google.com.

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @05:53PM (2 children)

      by Anonymous Coward on Thursday January 10 2019, @05:53PM (#784578)

      Just checked and hovered the mouse cursor over some links on a random search on google. It's still showing the links are to google though. Maybe it's a recent firefox bug (or "feature") that's doing that as I'm on firefox 63 currently.

      • (Score: 3, Interesting) by bzipitidoo on Thursday January 10 2019, @07:29PM

        by bzipitidoo (4388) on Thursday January 10 2019, @07:29PM (#784624) Journal

        I'm using Firefox 64. I wonder if it's the JavaScript. I am not using NoScript, and I can certainly believe Google serving up a heavily JavaScripted page if it detects that you allow it, and a plain HTML page if you block scripts. And if it is JavaScript, probably it can set the hover text to anything it wants. One other clue I noticed is that there is no "https://" at the start of the hover text that a Google search presents to the user.

        Now, how much time do I want to spend on further investigation? Lot of other things to do....

      • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @09:50PM

        by Anonymous Coward on Thursday January 10 2019, @09:50PM (#784684)

        I thought it was well-known that Google includes javascript that will activate on mousedown on the link, which will then change it to the tracking url.

    • (Score: 3, Informative) by isj on Thursday January 10 2019, @06:08PM (1 child)

      by isj (5249) on Thursday January 10 2019, @06:08PM (#784595) Homepage

      The redirected links can be used for tracking. Google probably does that. Don't know about DDG.

      But redirected links can also be used to protect your privacy because the redirection removes/changes the Referrer: header which could include your search terms.

      So link redirection isn't necessarily evil.

      • (Score: 1, Informative) by Anonymous Coward on Thursday January 10 2019, @06:44PM

        by Anonymous Coward on Thursday January 10 2019, @06:44PM (#784608)

        Yes, DuckDuckGo supports using POST requests (to hide query terms from referrer URIs) and link redirectors (for the same purpose). You can enable or disable either or both of these privacy options as desired [duck.co]. Apparently the redirectors are not required in modern browsers to avoid referrer leakage [duck.co].

        The "html" version of the search appears to always use POST requests and never uses link redirectors, regardless of the settings.

        Personally I use a browser which never sends Referer headers across domains to avoid this kind of leakage.

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @06:38PM

      by Anonymous Coward on Thursday January 10 2019, @06:38PM (#784606)

      Using Palemoon, an initial hover over a google link will show the actual destination sans tracking. However, if I first copy the link to the clipboard subsequent hovers over that link will show the google tracking. Either pretty sneaky by google or an odd Palemoon bug.

        Firefox (63.0.3) has the same behavior.

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @08:11PM

      by Anonymous Coward on Thursday January 10 2019, @08:11PM (#784649)

      Yup, that's sleazy. Totally sleazy on google's part.

  • (Score: 4, Interesting) by Freeman on Thursday January 10 2019, @05:25PM (4 children)

    by Freeman (732) on Thursday January 10 2019, @05:25PM (#784565) Journal

    I just noticed yesterday that uBlock Origin was blocking something on DuckDuckGo. I looked at what it was blocking and it seems like what they're doing is tracking what browser is accessing the site. Perhaps they're doing more, but I'd be somewhat surprised. Really, I don't care, if they know what kind of browser is accessing their site. I also don't care, if they know what OS I have, etc. So long as they're not tracking my IP/MAC Address/Physical Location/Name/Ethnicity/Gender/Language/Financial Status/Marital Status/Etc/Etc/Etc. In reality, a lot of that I don't care about either, but most of that would require snooping into my private life and I don't want that. I especially don't want them to be building a profile for Full Name at Longitude/Latitude, with these socioeconomic statuses, and these beliefs. Though, at this point, it may all be for naught as Google, Facebook, and their ilk have without a doubt already amassed stupendous amounts of private data on everyone who's used their systems and even plenty who haven't.

    --
    Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
    • (Score: 1, Informative) by Anonymous Coward on Thursday January 10 2019, @06:14PM (1 child)

      by Anonymous Coward on Thursday January 10 2019, @06:14PM (#784598)

      They don't have to do anything on the page to determine Browser or OS, you've already sent them that in the User Agent.

      • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @09:32PM

        by Anonymous Coward on Thursday January 10 2019, @09:32PM (#784678)

        UA sniffing for feature detection is unreliable, and a prime reason why many sites appear "broken" in anything beside chrome/ff.

    • (Score: 2) by bzipitidoo on Thursday January 10 2019, @08:00PM (1 child)

      by bzipitidoo (4388) on Thursday January 10 2019, @08:00PM (#784641) Journal

      > In reality, a lot of that I don't care about either

      Okay, I'll try for the "most creepy" post award for today.

      Who could you be? You might be Freeman Dyson! Nah, you probably just admire him. Or maybe you admire Morgan Freeman?

      Maybe you're KFreeman732, a sports writer on Twitter? Nah, doesn't fit.

      Maybe you have an account or two on the green site? Mr. Freeman (933986)? r.freeman (2944629)? Freeman-Jo (580965)? josh_freeman (114671)? Need a little language use analysis to check your use against those users to see if you might be any of them.

      Well, my search-fu, energy, and nosiness isn't up to any more poking around at the moment. Now if someone were to give me a little cash incentive... but why would anyone bother? As for me, my main defense is much the same, no one cares who I might be, and running down my real name, which I think should be fairly easy, isn't going to be terribly illuminating. https://www.youtube.com/watch?v=AERwgNvgMmc [youtube.com]

      • (Score: 2) by Freeman on Thursday January 10 2019, @11:08PM

        by Freeman (732) on Thursday January 10 2019, @11:08PM (#784713) Journal

        This user is based on a popular video game character that hasn't spoken a word. At least as far as I know. I never got to Half-life 2 Episode 2.

        --
        Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
  • (Score: 5, Touché) by Thexalon on Thursday January 10 2019, @05:55PM (3 children)

    by Thexalon (636) on Thursday January 10 2019, @05:55PM (#784584)

    Back in the dark days of around 2001, Google were the people who wouldn't track you half as much as their competitors at the time (Yahoo, Lycos, Altavista, etc), had the motto "Don't be evil", and were seen as the geeky alternative to Microsoft. Then came the IPO, some suits decided that tracking people more closely would help make their ads more pricey, and off they went to the point where they're one of the worst when it comes to how closely they track people.

    Facebook was once the relatively good guy as well, because MySpace had become thoroughly evil back in 2006 or so.

    I expect the same thing to happen to DuckDuckGo, and to any other alternative available. It's a long-standing formula: Be a good guy to gain market share, then once you have market share become a bad guy to "monetize".

    --
    The only thing that stops a bad guy with a compiler is a good guy with a compiler.
    • (Score: 2) by looorg on Thursday January 10 2019, @07:57PM (1 child)

      by looorg (578) on Thursday January 10 2019, @07:57PM (#784639)

      So in conclusion -- over time everything corrupts and becomes evil? Who will slay the duck?

      • (Score: 2) by Freeman on Thursday January 10 2019, @11:12PM

        by Freeman (732) on Thursday January 10 2019, @11:12PM (#784715) Journal

        The Borg will assimilate the duck, and women will inherit the earth. Or something like that. I may have mixed up my metaphors somewhere along the way.

        --
        Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
    • (Score: 0) by Anonymous Coward on Friday January 11 2019, @02:01AM

      by Anonymous Coward on Friday January 11 2019, @02:01AM (#784794)

      Not only that; in those days, Google was different from other search engines because they didn’t take payola from sites to artificially bump them up in the rankings. Until then it was S.O.P. for most search engines.

  • (Score: 5, Informative) by Barenflimski on Thursday January 10 2019, @06:04PM (3 children)

    by Barenflimski (6836) on Thursday January 10 2019, @06:04PM (#784593)

    Over there at betanews, they have an article stating that DuckDuckGo announced that it is only using this to render the screen, and that its wrong for anyone to think they are tracking people. They then referred people to their Privacy Policy. [duckduckgo.com]
    Article: https://betanews.com/2019/01/07/duckduckgo-fingerprinting-accusation/ [betanews.com]

    From what I can tell, DOMRect API is fairly widely used. Its purpose is to render your window correctly by telling the server how your screen is formatted. It is not a tracking API out of the box.

    For that matter, any API that returns information back to the originating server could be used maliciously, and information could be written to a DB, or logs for future use.

    This is not the intended purpose of the API, and DuckDuckGo claims they aren't using any information in this way.

    My thought is, why would they try to be sneaky fingerprinting browsers, when they could simply log people on the back-end without ever showing anyone even the smallest slice of code? It simply doesn't pass the smell test to me that they would be sneakily tracking users this way.

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @06:13PM

      by Anonymous Coward on Thursday January 10 2019, @06:13PM (#784597)

      By Brian Fagioli.

    • (Score: 1, Interesting) by Anonymous Coward on Thursday January 10 2019, @09:36PM

      by Anonymous Coward on Thursday January 10 2019, @09:36PM (#784680)

      Offloading your work to the client is what everybody does today, sneaky or not, because it's saving clocks on your server that go right into your client's electricity bill. You're basically fucking your clients trice: They foot the bill for power consumption, they get tracked and by virtue of having to enable scripting to be abused by your site, they also open themselves up for a variety of script-weaponized exploits (so basically all of them at this point).

    • (Score: 0) by Anonymous Coward on Thursday January 10 2019, @10:24PM

      by Anonymous Coward on Thursday January 10 2019, @10:24PM (#784693)

      Its purpose is to render your window correctly by telling the server how your screen is formatted.

      What a load of horseshit that is. In years of doing large-scale web application development not once did such a thought cross my mind. There is absolutely no fucking reason the server should care about intrinsic characteristics about the client. You take HTTP requests, you serve HTTP responses. That's it. Need to know about the user's display for formatting? That's what fucking CSS is for!

  • (Score: 2) by digitalaudiorock on Thursday January 10 2019, @07:35PM

    by digitalaudiorock (688) on Thursday January 10 2019, @07:35PM (#784629) Journal

    I'm not sure I even understand yet what this is alleging, but they sure aren't tracking what links you click any more than ever, because the links go directly to the target site. I don't see any way they can have any clue what's being used there. I'm not missing anything there right?

    Google on the other hard sends all your clicks through google and redirects after.

  • (Score: 4, Funny) by DannyB on Thursday January 10 2019, @07:38PM (1 child)

    by DannyB (5839) Subscriber Badge on Thursday January 10 2019, @07:38PM (#784630) Journal

    The best way to ensure you are not tracking anyone is to keep track of who you are not tracking. When someone visits, you check your list to see if they are on it, and if so, then you know you are not tracking them. If they are a new visitor and are not in your list yet, then to ensure you are not tracking them, you add all of their information to your database to update the list of who you are not tracking.

    Got it.

    (and since it is done on the internet, that makes it a victimless crime.)

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
    • (Score: 2) by pipedwho on Friday January 11 2019, @02:04AM

      by pipedwho (2032) on Friday January 11 2019, @02:04AM (#784795)

      (and since it is done on the internet, that makes it a victimless crime.)

      A victimless crime, like punching someone in the dark.

  • (Score: 5, Interesting) by darkfeline on Friday January 11 2019, @01:53AM (3 children)

    by darkfeline (1030) on Friday January 11 2019, @01:53AM (#784790) Homepage

    HA! Let me laugh harder.

    Do you guys even know who the founder of DDG is? Gabriel Weinberg. You know what his previous startup was? The Names Database. This was a website that aimed to connect people who had lost contact by gathering lots and lots of e-mail addresses. Getting access could be done by either paying money, or submitting lots of e-mail addresses of other people. Gabriel later sold the startup with all of the data for pure profit.

    https://en.wikipedia.org/wiki/Names_Database [wikipedia.org]

    Did you seriously trust this guy to protect your privacy?

    Anyone with a clue knew about this and shouted it from the rooftops from day one, but it got drowned out by the loud noise from the DuckDuckGo marketing cannonfire ("shills"). Probably got them banned from most forums. A quick Google search does nothing but does turn up a mysterious "Some results may have been removed under data protection law in Europe." Hmm, I wonder what that means. Certainly not that the GDPR was used to censor undesired facts about someone's proclivity to violating user privacy for profit.

    So for those of you for which this is news: Surprise! If nothing else, at least Google is honest about what data it collects (and which so far hasn't been shown to be violated).

    --
    Join the SDF Public Access UNIX System today!
    • (Score: 0) by Anonymous Coward on Friday January 11 2019, @02:53AM

      by Anonymous Coward on Friday January 11 2019, @02:53AM (#784831)

      What that means is that you searched for something gogl's algorithm considers a person's name and they print that message by default now for all such queries.

    • (Score: 0) by Anonymous Coward on Friday January 11 2019, @07:59AM (1 child)

      by Anonymous Coward on Friday January 11 2019, @07:59AM (#784948)

      Thanks, that certainly something to think about! Didn't know that.

      I've been using ddg but I guess now I'll have to again evaluate other options. Any pointers? (Definitely not google.)

      • (Score: 0) by Anonymous Coward on Monday January 14 2019, @09:56AM

        by Anonymous Coward on Monday January 14 2019, @09:56AM (#786390)

        It's actually a metasearch engine. Like SoylentNews here, the individual sites can benefit from donations.

        They act as an aggregator for google/bing/etc with a little subscript box indicating which site the result was from, usually. Additionally it supports archive.org for cached pages, and has proxy support, although I don't remember who it is through.

        Point being, there is no central organization running it. It is open source and available to run yourself, and it provides all the major features and search capabilities of others (like searching for images, files, etc) without requiring any javascript at all, although it does have it available for real-time updates of certain option changes.

        It has become my go to search engine for a lot of items, although you will sometimes see duplicates as you go through the search results, since it doesn't, as far as I know, cache the results and submits the queries each time you click to see the next page.

(1)