Domains visited get leaked to DDG servers

[Tritonio]

Android/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt

Line 60 in ed91c9e

private const val faviconBaseUrlFormat = "https://icons.duckduckgo.com/ip3/%s.ico"

This seems to be leaking all(?) the domains that users visit to your servers.

[tagawa]

Hi @Tritonio and thanks for your feedback. The purpose of the request you observed is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases and simplifies retrieval within our apps and our search engine.

At DuckDuckGo, we do not collect or share personal information. That's our privacy policy in a nutshell. For more detailed information on that, you can checkout our privacy policy at https://DuckDuckGo.com/privacy. The favicon service, as with all our services, adheres to this privacy policy in that the requests are anonymous and do not collect or share any personal information.

If you have further questions, please let me know.

[stefan01]

Hi @tagawa,
i do trust DDG not using the data in a bad manner, but still i don't get your decision.
The best privacy products are made from companies you don't need to trust using your data in a good way, because they collect no data.
So for a privacy product it is really hard for me to understand why you chose a minimal performance increase (?) over a critical privacy issue (in my opinion).
I think with this decision you are risking a major privacy distrust.

[donfuxx]

I understand that there are different favicon standards and that in some cases it can be difficult to locate it.
I believe that those are edge cases though and for a vast majority of websites a simple host/favicon.ico should work.
My suggestion for an increased privacy here is:

1. Attempt to load favicon directly from website by simply appending /favicon.ico to hostname (should be the most easy and most common case anyway)
2. In case of no success fallback to use omniscient ddg favicon endpoint

[stefan01]

Just to understand: Why can't the same algorithm, which is being used in the DDG endpoint, be utilized in the app?
If I understand correctly the only reasons are slightly increase performance, reduced network traffic and easier implementation.
Is that correct?

[masstransithonchkrow]

Hi there! If DDG reviews this, please use the header data on my web pages to determine what the favicon is. I do not have a default favicon for my site. My DeskThemePacks use PNGs for favicons based on the currently viewed theme's normal cursor.

By looking for favicon.ico where it doesn't exist, it affects both my site's performance and SEO.

[timmc]

If it was just search results, I wouldn't care.

But this appears to be in use for rendering tabs that you're visiting, regardless of how you got there:

Android/app/src/main/java/com/duckduckgo/app/tabs/ui/TabRendererExtension.kt

Line 44 in db72852

return Uri.parse(resolvedUrl())?.faviconLocation()

(ETA: Or am I misunderstanding how this app is used? I'm not a smartphone user, and only use DDG in a regular browser.)

[tonyxu-io]

It’s shocking to see how DDG staff responded to this issue. Doesn’t seem to care much about user privacy concerns.

[jeevank]

@CDRussell @tagawa This needs to be reopened and looked into. This is a serious privacy issue regardless of your "privacy policy"

[sheerun]

This made me really doubt privacy of DuckDuckGo. How it can be private and secure if you hire security experts who allow it to happen since 2019? "it can be displayed in certain places within the app or on the results page"

[davewood]

Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device.

https://github.com/mozilla-mobile/android-components

https://github.com/mozilla-mobile/Firefox-iOS 

[https://news.ycombinator.com/item?id=23708166]

[javabeanz]

privacy should be the whole raison d'etre of DDG. time for a fork DuckDucGone ?

[scabros]

I don't know why all the fuss... You all know that if you are using his app, you already "trust" that his search service is respecting your privacy, right? C'mon, they are being transparent, as usual.

[tonyxu-io]

I don't know why all the fuss... You all know that if you are using his app, you already "trust" that his search service is respecting your privacy, right? C'mon, they are being transparent, as usual.

@scabros - Please checkout the reply above: #527 (comment) This is not about using their search service, we all know search provider know exactly what you are searching for. But this particular issue is about using the browser, it's when user directly visit the website from browser address bar or reference link.

[svenssonaxel]

So essentially, the trade-off is between performance and auditability of privacy. I predict that the user segment DDG appeals to will overwhelmingly prefer the latter.

Yes, we already trust DDG, but only because we have to trust someone and others have proved to be untrustworthy. The issue isn't about whether the user trusts DDG, it's about minimizing the need for trust and maximizing the ability to verify privacy. Please consider reopening this issue.