DuckDuckGo tries to explain why its browsers won’t block some Microsoft web trackers – The Register

DuckDuckGo promises privacy to users of its Android, iOS browsers, and macOS browsers yet it allows certain data to flow from third-party websites to Microsoft-owned services.

Security researcher Zach Edwards recently conducted an audit of DuckDuckGo's mobile browsers and found that, contrary to expectations, they do not block Meta's Workplace domain, for example, from sending information to Microsoft's Bing and LinkedIn domains.

Specifically, DuckDuckGo's software didn't stop Microsoft's trackers on the Workplace page from blabbing information about the user to Bing and LinkedIn for tailored advertising purposes. Other trackers, such as Google's, are blocked.

"I tested the DuckDuckGo so-called private browser for both iOS and Android, yet neither version blocked data transfers to Microsoft's Linkedin + Bing ads while viewing Facebook's workplace[.]com homepage," Edwards explained in a Twitter thread.

The situation is the same for DuckDuckGo's macOS browser, a company spokesperson confirmed.

Responding to Edwards, DuckDuckGo CEO Gabriel Weinberg emphasized its browsers do not allow ad-tracking data to flow to DuckDuckGo's Microsoft Bing-powered search engine, which last year faced separate criticism for inheriting Redmond's censorship of Tiananmen Square imagery.

According to Weinberg, users of DuckDuckGo Search who see ads delivered through Microsoft Advertising do not provide data when those ads are loaded on the page. If a user clicks on an ad, Microsoft Advertising gets the user's IP address and user-agent string for ad attribution and billing, though there is apparently no linking of that click to a user profile, as DuckDuckGo explains on its website.

With regard to the company's browsers, he said DuckDuckGo blocks Microsoft third-party cookies (used for ad tracking) on third-party websites, but acknowledged there are some trackers (scripts used for tracking) that DuckDuckGo's browsers do not block due to contractual commitments with Microsoft.

"For non-search tracker blocking (e.g. in our browser), we block most third-party trackers," said Weinberg. "Unfortunately our Microsoft search syndication agreement prevents us from doing more to Microsoft-owned properties. However, we have been continually pushing and expect to be doing more soon."

What we're talking about here is an above-and-beyond protection that most browsers don't even attempt to do

"What we're talking about here is an above-and-beyond protection that most browsers don't even attempt to do that is, blocking third-party tracking scripts before they load on third-party websites," added Weinberg in a statement emailed to The Register.

"Because we're doing this where we can, users are still getting significantly more privacy protection with DuckDuckGo than they would using Safari, Firefox and other browsers."

In other words, DuckDuckGo offers better than average privacy protections in its browsers but looks the other way for Microsoft-owned scripts for Bing and LinkedIn so they can continue loading on third-party websites like Workplace and gathering data.

DuckDuckGo, said Weinberg, does not promise anonymity when browsing "because that frankly isnt possible given how quickly trackers change how they work to evade protections and the tools we currently offer."

Anonymity is also contractually precluded, as DuckDuckGo had noted in recent revisions to its browser descriptions in Google Play, the iOS App Store and the Mac App Store presumably to avoid scrutiny from regulatory agencies for promising privacy and not disclosing exceptions.

The added text says, "Note About our Tracker Blocking: While we block all cross-site (third party) cookies on other sites you visit, we cannot block all hidden tracking scripts on non-DuckDuckGo sites for a variety of reasons including: new scripts pop up all the time making them difficult to find, blocking some scripts creates breakage making parts or all of the page unusable, some we are prevented from blocking due to contractual restrictions with Microsoft."

In a post to Hacker News, and an even longer essay on Reddit, Weinberg attempted to explain the constraints involved, to the extent possible without violating its contractual commitment to Microsoft to keep deal terms private.

"This is just about non-DuckDuckGo and non-Microsoft sites in our browsers, where our search syndication agreement currently prevents us from stopping Microsoft-owned scripts from loading, though we can still apply our browser's protections post-load (like third-party cookie blocking and others mentioned above, and do)," he wrote on HN.

Weinberg insists DuckDuckGo is trying to change the terms of its search syndication deal with Microsoft but can only say so much.

"Our syndication agreement also has broad confidentially provisions and the requirement documents themselves are explicitly marked confidential," he said.

Speaking of anonymity... Users of the Tor Browser in the pro-privacy Tails 5.0 operating system have been told to stop using the software until the release of 5.1, as a vulnerability in the underlying Mozilla Firefox browser can be exploited by "a malicious website to bypass some of the security built in Tor Browser and access information from other websites."

"This vulnerability will be fixed in Tails 5.1 (May 31), but our team doesn't have the capacity to publish an emergency release earlier."

Follow this link:
DuckDuckGo tries to explain why its browsers won't block some Microsoft web trackers - The Register