Hacker News new | ask | show | jobs
by dredmorbius 476 days ago
Best I understand is that DDG may do localisation based on IP geolookup, but not specific geolocation.

The DuckDuckGo help pages address this specifically:

There may be cases when you want more accurate location-based results like local weather and restaurants. We can still serve results for searches like these (including instant answers and ads) while keeping you anonymous.

To do this, DuckDuckGo Search simply guesses your location using a GEO::IP lookup with the IP address that’s automatically sent to us via your device; then we throw away both the guessed location and the IP address, per our Privacy Policy, saving none of that info on our servers. Our default search experience was designed so that we don’t need to request any additional information than what you are already sending.

This process isn’t always accurate enough; for example, DuckDuckGo Search may end up assuming you’re hundreds of miles away from where you actually are, especially on mobile phone networks that route traffic through a central hub. That’s why we built an option that lets you improve the accuracy of your local search results.

<https://duckduckgo.com/duckduckgo-help-pages/privacy/anonymo...>

I keep my browser security settings pretty locked down, and explicitly reject sharing location data.[1] Yet if I do a generic search (say, "restaurant"), there are ... roughly localised results. Bouncing the modem (and obtaining a new IP) changes the location indicated. I've tested this with several queries that should provide pretty fine-grained localised results and ... as I reset my network connection these move around within the general local area.

NB, I'd written the following before checking DDG's help docs, and my assumptions appear accurate: Given the ways in which IP address location can be inferred, even with non-persistent IPs, I'd suspect that before accusing DDG of specific geolocation snooping.

(The fact that IPs can be and are used as proxies for location is itself problematic, but ... is far broader in scope than DDG's visible practice.)

Unless you've got something stronger to go on, or specific network traffic / cookie analysis, I'm going to call excess paranoia here. Not a bad sense to cultivate, but also one you don't want firing off half-cocked.

________________________________

Notes:

1. Firefox: Settings -> search "location", click "settings". I've just verified no sites permitted, new requests blocked.

1 comments

Sorry, I updated the title. By location I meant IP.

If we have location-based results it means that they shares (let's say) the gussed city name with Microsoft. Saying *we throw away both the guessed location and the IP address* is bullshit. They share it with Microsoft, and Microsoft keeps it.

>it means that they shares (let's say) the gussed city name with Microsoft.

I'm not sure I understand or maybe I'm missing something, sharing the guessed city is not "technically" sharing your IP address? (I understand that it's still sharing more info than what you thought)

Let's say the steps are:

1. You type in "exhibition" to ddg

2. DDG sends "exhibition in <guessed city>" to Bing using its own random datacenter IP address

3. Sends you back results

Did it now "share your IP address with Microsoft"?

You are right. But, it shares my gussed city name, which most of the time is very accurate.

Then it says we throw away the IP and gussed city name, which is correct. But they have shared the city name with Microsoft.

I will update the title to fit the described problem.

As a general rule, the more unpopulated your locale is and the more niche your searches from that location are the easier it is for Microsoft to create a profile of you despite ddg's own intentions. For example, you would probably be the only Real Betis fanatic who builds their own smart home devices suffering with tongue cancer and who happens to live in <smallGermanTown>, and Microsft could establish that profile as long as ddg sends the town info to Microsoft with every separate search within some time window.
Sharing the city name with Microsoft if it’s uncorrelated with an IP address is not a privacy concern. To Microsoft, all they can see is “an anonymous ddg query about restaurants in <city>.”
As others have noted, and DDG themselves have clarified, it's possible to request a geospecified result without disclosing to Microsoft Bing either your IP address or anything personally identifying.

Your initial accusation here and follow-up are unwarranted.