DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam.
Is there any proof that any web search engine will protect your privacy as it advertises?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There is no proof that DuckDuckGo operates as advertised. (There never is, on the web.) However, that is the wrong question.
No, I don't think that DuckDuckGo is a scam. I think that's crazy talk. Given the incentives and legal regime, I think you should assume DuckDuckGo follows their own privacy policies, until you find any information to the contrary.
I've thought and explored external verification, from someone like the EFF for instance, but I don't think that really would do much to assuage the core of the comment.
I had a look at the data being sent from my browser (Firefox 14.0.1 on Ubuntu 11.04) back to the DuckDuckGo servers when I do page searches (without changing any of DuckDuckGo's default settings) and found the following good points:
Of course there is still some information which a regular user of DuckDuckGo must assume is available to DuckDuckGo:
I'm sure I missed a few things in that last list, but its a good start. So from the first set of positive points we can see that DuckDuckGo is really doing everything they can.
The lack of cookies and any identifying parameters in the http GET string is some assurance that DuckDuckGo has no interest in tracking a user from one search to the next. I.e. as far as the cookies and URL information being sent back to the server, your first search on DuckDuckGo could have been somebody completely different to your second search on DuckDuckGo. However, you should not assume from this that DuckDuckGo are not capable of linking multiple searches to you - see later on for further detail on this.
I should explain that http GET is not actually more secure than POST - DuckDuckGo could have chosen POST and there would have been no compromises there. However the nice thing with GET is that the user can see the data that is being sent back to DuckDuckGo right there in their URL - i.e. they do not need to go digging to find post parameters being sent by the browser to DuckDuckGo.
Another point is that https is always on. this indicates that DuckDuckGo does not want their users to be vulnerable to man-in-the-middle attacks. Of course that is not to say that man-in-the-middle attacks will not happen if you use DuckDuckGo, but just that from the DuckDuckGo servers' side of things they appear to have done all they can to prevent them.
Having said all that, DuckDuckGo could still link your searches to a single person and possibly to you if you do not take precautions. the user agent is a form of identification simply because it does not change from one request to the next (unless you take precautions against this). Likewise the IP address of your internet-facing router will show up at the DuckDuckGo server.
For these last two points there are things you can do to hide your identity further - like installing a user agent randomizer or using Tor, but if you do not use these things then you will have to trust DuckDuckGo when they say they are respecting your privacy. As far as I can tell, they have done everything they can to assure me that they respect my privacy. Would I go and search for incriminating terms without using Tor and other security on my PC? Absolutely not!
It is not possible to prove that it will operate this way, but it is very easy to use it the way they advertise it.
I also agree with D.W. and started using it some days ago. I deleted google from my search engine list but had some problems trusting ddg too, since I'm a slightly paranoid person, but it provides a secure connection, I use it over tor and always have a look for my privacy. I couldn't find any problems yet. There is no ID to track you. They could fingerprint you with your privacy settings, but nothing more.
I joined their irc channel and asked some questions, you should do that too, it's
If you are afraid of a dataleak you can try to visit a page and look into the logs. Visit it once over google and once over ddg. Google will leak your search term over the referer.
It is never easy to prove these things, but people are moving to DuckDuckGo often for privacy reasons. It takes ages for a brand to gain a positive name and in the Internet age it can take as little as a few minutes to see your good name destroyed.
With the first news articles that DuckDuckGo breaches its promises to its users, they will start to leave as the news will spread in all media in a matter of minute. Also the name of its founder will be remembered for ages and he will probably be out of business forever when it comes to privacy services. You can put information on the Internet, but you can never remove it.
On DuckDuckGo, the links are what they say they are. If you want to keep DuckDuckGo from seeing what you're clicking on, and if you want the target to be unaware that you came in via DuckDuckGo, you can do so easily: just copy the link in step 3, paste it into your address bar, and there you are -- no further interaction with DuckDuckGo and no referrer URL sent to the target site. On Google, however, note that in #2 they show you the link you expect, but in step #3 the link suddenly changes to a google.com address with a ton of gobbledeygook. This is also the address that gets used if you click the link normally. The only way to get the real target address directly is to hover over it and retype it yourself instead of clicking it. The Google client-side script is specifically designed to make sure you hit the Google tracking server before being redirected to the page you really wanted, and moreover, TO HIDE THE FACT THAT IT IS DOING SO from the vast majority of users. This is the action Google took a few years ago that finally caused me to use DDG exclusively. I understand Google's need to monetize its service, but when it purposely hides this fundamental mechanism they prove they are not trustworthy.
So you can have your choice: use a site that says it's not tracking you, and seems to be carrying out its promise; or use a site that tracks you every way it can, tells you it's doing so, and makes it as hard as possible to evade it. The choice is obvious.
How you detect such breaches is left as an exercise for you.