▲ 323 points
back
167 comments
Duckduckgo - Based in US / very weak privacy laws
Servers - hosted using Amazon (AWS)
Bangs aren't safe. For example typing “!g kittens in basket” and hitting return, drops you off on the Google website to display your results (thus logging your IP, search term and browser info immediately).
DuckDuckGo is owned by Gabriel Weinberg who is is the founder, current CEO and controlling shareholder. Investors/shareholders include Union Square Ventures and several others. DuckDuckGo generates it’s income from advertising (Bing Ads) and collects affiliate revenue (Amazon, eBay).
Duckduckgo and Yahoo partnership https://web.archive.org/web/20160724030640/
https://duck.co/help/results/yahoo-technical-implementation
https://duck.co/blog/blog/post/311/yahoo-partnership
Duckduckgo has no audit
Duckduckgo gives out a HTTP header field that identifies the address of the webpage.
Both companies were asked "if you were ordered to compromise your service/customer privacy in any way would you"
DuckDuckGo – Gabriel Weinberg said: “No one is preventing me from doing that.”
I'm not sure what's the purpose of this comment? You're really grasping for straws here if you're trying to point out that DDG is same as google/bing etc.
> Bangs aren't safe. For example typing “!g kittens in basket” and hitting return, drops you off on the Google website to display your results (thus logging your IP, search term and browser info immediately).
That's the whole point of bangs is that they redirect you to the website. How do you imagine ddg redirecting you to google without giving google your ip address?
> DuckDuckGo is owned by Gabriel Weinberg who is is the founder, current CEO and controlling shareholder. Investors/shareholders include Union Square Ventures and several others. DuckDuckGo generates it’s income from advertising (Bing Ads) and collects affiliate revenue (Amazon, eBay).
Is that a bad thing? Ads are keyword based, why is that a bad thing?
> Duckduckgo gives out a HTTP header field that identifies the address of the webpage.
What does this even mean? Referer?
I feel you may be expecting DDG to be something it’s not meant to be.
The jurisdiction and infrastructure aren’t very relevant, DDG is about protecting yourself from advertisers, not the US government.
Bangs aren’t supposed to be safe. DDG is quite upfront about that.
> Remember, though, because your search is actually taking place on that other site, you are subject to that site’s policies, including its data collection practices. [1]
Yes, DDG did use Yahoo to power the searches, now they use Bing. Searches are forwarded anonymously. More than enough to protect you from advertisers.
They do advertise based on search keywords. This does not conflict with their mission. Same with affiliate links.
The lack of an audit is a fair criticism.
Can you elaborate on the header?
I would expect DDG to comply with government orders, because I don’t expect DDG to protect me from the government.
As a fan of DDG (I use it daily), I had no idea there was this much risk -- I was surprised enough to find out they offloaded search to Bing a while ago (but also I don't blame them, it's probably pretty hard).
Even with these hangups, I still think any near-viable option to Google should exist.
[EDIT] - just realized it's only been 20 minutes (not a day) -- looking forward to DDG's response
AT&T tried this and it didn't go well. For a time you could get a discount on your internet if you opted into their data tracking programs. From what I heard, there was a lot of complaining and little uptake, which is backed up by the fact that they cancelled the program less than a year later and just started charging everyone the lower price (and claimed that they stopped the tracking).
I think people don't want to be reminded that they're being tracked, which is possibly why it went poorly, but this will be a problem with any company that wants to do opt in tracking.
At 13m in, he uses the fact that around 10% have turned on DNT in theri browser as a proof that people actually care about tracking, but haven't multiple browsers started turning on DNT by default?
Discounting Internet by axing privacy is a nasty idea. Privacy should be available by default without any added price tags.
Verizon did it too, they would give you a token amount of "rewards points" or something like that which you could use on accessories or bull credit if I recall.
We use this term "personal data" so much. But what IS data?
If I happen to know that you like cheese sandwiches, is that really data? When did we decide that knowing something about somebody else was such a big deal?
I feel like this whole brouhaha about data has left me behind.
>When did we decide that knowing something about somebody else was such a big deal?
When data became a commodity that can be analysed, acted upon, sold and used to make predictions about groups or individuals.
It's easy to dismiss privacy because it's the absence of something: namely the absence of information that can be leveraged against you. It's a preventative measure to avert future harms like discrimination, data leaks to adversaries, and misguided decision-making. It's cheaper and more effective to cut that off at the source rather than trusting companies (who were sneaky in collecting that data in the first place) to be responsible stewards of that information.
Knowing something is one thing, but having a perfect memory of everything you've ever desired and liked is completely different.
The sheer scale of the intrusion as technology has advanced is the problem. You're not telling someone "I love pizza," they are stalking you across the internet and deciding that you must love pizza, because their mountains of data confirm it.
You won't have much luck getting these algorithms to change their mind about you, since they're pulling it from your browser footprint, your IP, your connected networks, social media buttons, cookies, data sold by companies you've shopped with, etc...
If I told you that I like cheese sandwiches, then no. However, in normal, human interactions there's the reasonable expectation that if I tell you something, you won't go and sell it to the highest bidder who can then in turn do whatever they please with the information and further propagate it. Privacy isn't a huge problem in society because as humans most people have adequate social skills and understand what is and isn't appropriate to disclose and share. The problem is that tech companies don't treat their users as humans and don't follow basic conventions and common sense.
> When did we decide that knowing something about somebody else was such a big deal?
With the risk of pulling a semi-Godwin, you should visit the Stasi museum here in Berlin. It gives you a good insight into how powerful “knowing something about somebody” can be.
Echoing a comment I made a while back, there's a difference between transient (a humorous remark amongst friends) and permanent information (a humorous remark printed in a book).
Except that the internet has made all transient data permanent (i.e. my jokes from high school are free to see on Twitter), and our social systems simply can't haven't kept up with this change.
No, no one cares about your lunch today. But if I have your history of eating sandwiches every day, and sell it to your insurance company, who now increases your quote because an algorithm says that you have a higher risk for heart attacks or colon cancer; then it might matter.
If as an individual I know mentally that, it's most of the time ok. If I start taking notes on paper, the chances it gets weird increase. If I do it systematically for a lot of things in your life, we go into creep territory. Now if instead of an individual, a company does that, and instead of one person, it does that to millions, there is a problem.
The problem becomes even bigger depending of the company agenda and the political context.
It's a huge deal. I didn't tell you I like cheese sandwiches. You found out against my consent. You violated my consent,which is a huge deal for me.
I get to decide who knows whether or not I like cheese sandwiches. If I am a free person,equal with you under the law then how is it ok for you to violate my consent and persistently stalk me to find information about me for your own gain?
Would you be willing to send me, a stranger, your complete browser history?
Yes absolute that is (personal) data if it's attributable to a person such as myself.
It's not "not personal data" because it's trivial. It's not "not personal data" because I voluntarily gave it to someone.
I only want sites to store data they necessary to carry out their function and only for as long as they need it to do so (note: keeping lights on with ads does not count as function).
> We use this term "personal data" so much. But what IS data? [...] I feel like this whole brouhaha about data has left me behind.
Data and personal data are two different things. "Data" is any information. "Personal data" is information that is about you, connected to you, or identifies you personally. I recommend poking around at how GDPR defines personal data, for example, since it's at the heart of the new emerging global privacy debate.
https://www.itgovernance.eu/blog/en/the-gdpr-what-exactly-is...
https://gdpr-info.eu/issues/personal-data/
https://gdpr-info.eu/art-4-gdpr/
https://ico.org.uk/for-organisations/guide-to-data-protectio...
> If I happen to know that you like cheese sandwiches, is that really data?
Yes. It's both data, and personal data.
> When did we decide that knowing something about somebody else was such a big deal?
That's not the issue. The issue is companies knowing something about everyone else, and selling that knowledge to people you didn't give it to, and using that knowledge to do things you don't really want, starting with advertising.
......
Is data really that ephemeral to people? Maybe its bc i worked with intelligence systems in my first career, but the idea of controlled data seems pretty straightforward. What i choose to reveal about myself should be in my hands, and part of that decision is brokering trust that ot isnt shared.
What Is Data? Its a record. It isnt handwavy to me or most.
Ultimately your fondness for cheese sandwiches ends up in an aggregated dossier of all information about you. The type of bread you like. Your SSN. Your income.
If you don't think that's a big deal then you need to get to a point that it IS a big deal for you.
Suppose someone has collected data on my groceries. They now know I buy a lot of red meat, and may then figure I must be eating a lot of red meat. Suppose my insurance rates now go up.
Okay I hear you saying “well maybe your rates should go up if you eat a lot of red meat. You’re costing everyone else a lot of money.” I’d say you have some highly misguided morals, and I’d say that such a scheme would never lead to savings for people who don’t eat red meat, but almost surely additional costs for those who do. The thing to remember is these schemes never, ever benefit you. They make other people money, generally at your expense.
OTOH I'm not sure why stalking is legal, provided you do it in bulk.
A big example is Facebook looking at how long people spent on their feed, how much stuff they liked, how much they responded, if those responses were negative or positive, if they spent more time on negative content, etc;
Once they had a decent understanding of that they literally A/B tested if people stayed on Facebook longer if they made them sad or if them made them happy.
So yeah, if 'data' allows you to do clandestine psychology experiments on a massive scale, that is a big deal.
Questioning 'what is data' feels disingenuous, hoping the essence is lost in the smoke and noise.
What is asymmetrical information permanently captured?
Is ignorant coercion the same as consent?
If you're a person and I've never met you, it would be creepy if you knew what kind of cheese sandwiches I particularly like.
So, yes, it is personal data.
How we spend our time and money is important personal data. I bet that nobody will part with this information in a totally transparent way to people they personally know.
The whole reason for having this amount of surveillance is to control behavior.
People generally prefer freedom over being controlled and manipulated.
We use this term "personal data" so much. But what IS data?
If I happen to know that you like cheese sandwiches, is that really data? When did we decide that knowing something about somebody else was such a big deal?
It's whatever I want it to be, and I should be able to change my mind about it. It's not hard.
When my health insurance goes up because of it?
I've been hammering this into people's heads for over a decade now. Anything you put public is not "personal data". If you go to town square and yell that you like cheese cake do you then expect everyone to forget it upoin request. Should the local cake shop forget that you just said you like cheese cake?
As privacy and floss advocate "personal data" just makes absolutely zero sense. There's private data and public data. Private data is your passwords and stuff not exposed to public internet - everything else is public data and it's no longer "yours" unless it's copyrightable content.
Not only should we opt in but there should be a (digitally) signed chain of custody showing the exact derivation of any information held by 3rd parties that in itself, or when combined with others, can identify and reveal information about individuals.
Be real. You are saying that data should not be collected at all.
The problem for businesses, of course, is that nobody would opt in. Data collection is something literally nobody wants, and the only reason it survives is because most people don't know what these companies are doing, or aren't able to keep up with the ways to decline being included in it.
Data monetization is an inherently harmful and unwanted business practice.
No one would partake in something they don’t like if they’re made aware of it and have a choice... well, good?
Let’s take it a step further and have AdBuddies from Maniac
Or make a kind of asset out of a persons likeness and data. Endow individuals with ownership of their likeness and data. Give them something they can demand payment for storing, using, and selling.
I’m thinking something like the minimum civil court valuation per month of storage or use. Likeness and data would be defined by a jury of their peers.
If anyone is convinced what they are doing is good for end users they would let them make the choice. But expending time and energy to design and code deceptive dialogs with misinformation and avoid transparency betrays the opposite. You don't need an ethics course for this, it's willful fraud and deception.
Our societies are shaped as much by technology as by the incessant greed of a few often couched in euphemisms like 'innovation' and 'drive' to justify their value but these only accrue to a few. Behavioral targeting and surveillance have negative externalities for everyone not making money from it, and even for them in the wider societal and long term context.
If this is the behavior we are incentivizing then either we provide strong regulations to counter greedy and unethical behavior or accept these as our fundamental driving values without fabricating a 'feel good' alternative reality as a fig leaf or feigning shock at mercenaries in our midst.
TLDR; Most money made from advertising is still contextual, however because it's possible for G/FB to monopolize behavioral advertising and there is no regulation to prevent it, they do it anyway. Opt out is stupid: I'd like food that isn't tainted, please. Filter bubbles are bad news macro-politically. Regulation is rarely effective but still a good idea. Corporate fines should be two orders of magnitude larger. Instagram does evil things to your brain.
It’s already there. That’s one of the European GDPR core rules.
we should, but can we? of course not... it need to be a law
What a badly copy-edited headline (from the original article). Maybe just me, but my first reaction reading it was "Why is the CEO of Duck Duck Go advocating opting-in to data tracking?
Actually, he was saying we should _have to_ opt in to data tracking, if it's something you want. [/Pedant]
The irony here is that this article has at least 20 trackers.
PS: Firefox Quantum is great
The opt-in/opt-out arguments is a valid one and DDG IS my primary search engine and I love it. BUT, I must say this pseudo-activisim by DDG has become too much now, they're building this pure and altruistic image whereas obviously they will directly benefit from regulation and hurting Google!
Does anyone remember outcry of advertisers after Microsoft made absolutely useless and toothless Do-Not-Track option opt-in instead of opt-out? They were stinking and whining for months and finally got what wanted. The answer is no, unless some "communists" will regulate this spy community of advertisers they will never agree to lessen data collection (including the switch to opt-in).
I don't think it's up to the user to decide how data about them gets used.
Regulation like GDPR only makes it more difficult (impossible) for competition to emerge. It basically secures the future dominance of big players like Google and Facebook.
Making people pay a monthly fee to get their data collected and analyzed seems like the next big business model. We will soon reach a limit on the usefulness of passively collected data and will need to switch to a more active model.
I would prefer to have complete access to data about myself, but it would be unreasonable to expect a monopoly on it.