Reviewing the new DuckDuckGo browser on Windows

Getting your Trinity Audio player ready...

DuckDuckGo’s Windows browser went into public beta last month, and TechHQ has been putting the privacy-focused search engine to the test – to discover the upsides and downsides of switching from dominant players such as Google Chrome.

Installing DuckDuckGo on Windows

Firstly, let’s start with the installation process. Windows users simply download the app installer, click install, and DuckDuckGo is loaded in the time it takes to drink a coffee.

Once installed, the browser launches and gives you the option to import your bookmarks and passwords (if you have them saved to your current internet search engine).

Users can then choose to set DuckDuckGo as their default browser. But let’s see what the software can do first, before making DuckDuckGo our our first pick for internet search. And completing the app walkthrough, the last of the first-time guide windows tells us that we’re all set.

DuckDuckGo badges itself as a ‘privacy browser’ and the search tool aims to ‘block trackers and upgrade the security of your connection when possible’.

Benefits of using DuckDuckGo

DuckDuckGo’s tagline is ‘Privacy simplified. All for free.’ And the full feature set can be viewed by clicking on the ‘Get Browsing Protection’ button, which promises the following –

• Search privately
• Browse more securely
• Browse more privately
• Instantly erase browsing activity
• Block annoying cookie pop-ups
• Block email trackers
• Block app trackers for your android device
• Watch Youtube with fewer distractions & more privacy
• See who’s trying to track you

Microsoft Edge Webview2?

Clicking the ‘About DuckDuckGo’ button shows the version number and gives details of the technology under the hood in the Windows app. The privacy-focused search engine uses Microsoft Edge Webview2, and DuckDuckGo is quick to point out that its engineers have spent lots of time addressing privacy issues specific to WebView2 – for example, by ensuring that crash reports are not sent to Microsoft.

Peter Dolanjski – Product Director at DuckDuckGo – emphasizes that their Windows app is not a fork of any other browser code. “All the code, from tab and bookmark management to our new tab page to our password manager, is written by our own engineers,” he explains.

DuckDuckGo’s UI team has done a great job with the ‘All Settings’ page, breaking down all of the user preferences across three easy-to-digest tabs – General, Appearance, and Privacy. And there’s some fun to be had here with a bit of color hex code research.

Color customization win

If you are a fan of the Chicago Bulls, Paris Saint Germain, Chiefs Esports Club, the Mercedes AMG Petronas F1 Team, or any sports outfit, then you’ll enjoy DuckDuckGo’s color customization options.

The web browser allows users to dive in and specify hex codes for the background color, header color, title color, visited title color, snippet color, URL color, hover, module, and dropdown background color. And thanks to resources such as Team Color Codes, modding DuckDuckGo to render in your favourite team kit requires just a few clicks.

Is this feature essential? No. Is it fun to mod your web browser so that it’s on-brand with the Mercedes AMG Petronas F1 team? Yes.

Busy behind the scenes

And bringing things back on topic, it’s interesting to note that – according to DuckDuckGo’s reporting stats, which appear below the search bar – the privacy-focused browser has been busy. While this reviewer was scrolling through teamcolorcodes.com, DuckDuckGo reportedly blocked 33 tracking attempts (which has climbed to 42 tracking attempts while writing the rest of this story) made by the website.

Choosing to batten down the hatches on privacy may come with some inconvenience if you do appreciate being remembered by the websites that you visit. But one of the advantages for users of DuckDuckGo is that they can start with privacy defenses set high, and then choose to lower them once they have visibility on who’s attempting to track them and why.

NPR has an extremely informative and brilliantly titled podcast episode – How the cookie became a monster – that celebrates 30 years of a piece of code designed originally to solve a fundamental usability problem of the internet. Without cookies, online shopping carts would have no memory of which goods had been put in the basket, and e-commerce would be incredibly tedious.

But, having paved the way for a better online shopping experience, web cookies were found to have other talents, helping companies to better target advertising to users, which browser developers such as DuckDuckGo have pushed back on.

The problem of web-based device fingerprinting

And cookies aren’t the only way of tracking users browsing websites on the internet – there’s device fingerprinting too, which has been around for many years. “What if today I could tell you that interested parties could track users without the need of cookies, or any other stateful client-side identifiers?” security researcher Nick Nikiforakis, now at Stony Brook University, US, told an audience of web users at Microsoft Research in 2016.

Unlike cookies, users can’t delete properties of their machine, like device screen size and CPU type. Browser type and version, fonts, plug-ins, and other details – even blocked cookie requests – add up to a unique fingerprint of who we are the web. And – you’ve guessed it – these device fingerprints turn out to be a good proxy for all of those cookies and web trackers that privacy-focused users are spending their efforts blocking.

A landmark 2010 paper by Peter Eckersley of the Electronic Frontier Foundation (EFF) asked ‘How Unique Is Your Web Browser?’ [opens as PDF]. And if you are worried about privacy on the web, you may want to look away now as we recall the results. Based on device fingerprints collected from 470,161 browsers, during sessions initiated by volunteers who were aware of the nature of the experiment (with some even actively trying to obfuscate their behavior), 94.2% were uniquely identifiable, and 4.8% had fingerprints that were seen just twice.

If you’re thinking that it’s hard for regular folks to stay hidden on the web, you’d be right. What’s more, if you are in the minority in trying to stay hidden – for example, by using DuckDuckGo rather than Chrome, and running a security and privacy-enhanced operating system, such as GrapheneOS (if you have a Pixel phone) you could be increasing the number of tells, simply by appearing so different to the majority of other web users.

Whether you’d want to install Windows on a Dell laptop and run Google Chrome to blend in, is another question. But evading device fingerprinting entirely isn’t easy, and maybe the solution is to work with it and sow seeds of confusion.

DuckDuckGo blocks many fingerprinting scripts before they have a chance to load, but the browser has other tricks up its sleeve. “We override many of the browser APIs used for fingerprinting to make them return either no information or alternative information that’s less useful for fingerprinting,” write the developers.

Should you use DuckDuckGo as your main browser?

DuckDuckGo positions itself as a privacy-focused web browser. And it’s clear that the team takes this mission seriously. In 2022, DuckDuckGo’s annual donation program awarded a total of $1,100,000 to 24 privacy groups and organizations advocating internet user rights around the world. Beneficiaries include the EFF, the European Digital Rights network, Signal Technology Foundation, and many other names notable for defending the rights of web users to online safety and security.

But the choice of which web browser to use remains an individual one. And usability goes hand-in-hand with the app experience, especially if you spend a large amount of time online and regularly search the web as part of your job.

DuckDuckGo is looking for a senior C# developer to build cool stuff!#dotnet #csharp

Check out this job at DuckDuckGo: Senior Software Engineer, Windows Desktop App (Remote) https://t.co/D1l9lRSEX3

— Calvin A. Allen | Microsoft MVP (@_CalvinAllen) March 3, 2023

DuckDuckGo’s Windows beta is fairly easy to jump into if you’ve been using Chrome or Brave. And the search engine performs well in delivering useful results, closer to Chrome than Brave, based on this author’s experience.

DuckDuckGo is a so-called metasearch engine, gathering results through a variety of vendor APIs – aggregating the search capabilities of many different engines.

Concluding that using a privacy-focused browser offers full protection to users as they search the internet feels misleading, given the sophistication of modern device fingerprinting. But what DuckDuckGo does do well, is put privacy center stage and gets users thinking about the topic in more detail.

For example, being able to quickly click on the shield in the search bar to see requests blocked from loading, allows users to become familiar with the top third-party trackers. And it brings the discussion around to why our internet search behaviour needs to be tracked to such a high degree.

DuckDuckGo is open about its business model, which includes private ads displayed alongside search results, with a difference. “Search ads on DuckDuckGo are based on the search results page you’re viewing instead of being based on you as a person,” writes DuckDuckGo’s commercial team. “For example, if you search for cars, we’ll show you ads about cars.”

Cautionary tale

There are buttons to report ads that seem suspicious or irrelevant, and there are cases where bad actors have used lesser-known search engines to try and fool users into clicking on fake websites. The blockchain-based search engine Kin was conceived after an attempted phishing attack was discovered in an advert presented by the search engine DuckDuckGo.

But again, progress is made by raising awareness. And a newer feature on DuckDuckGo is email protection – a free email forwarding service that removes multiple types of hidden email trackers and lets users create unlimited unique private email addresses on the fly. In beta-testing, the developers found that 85% of emails being handled by the service contained hidden trackers used to build a profile on message recipients.

And that’s the last word – DuckDuckGo’s big selling point is getting people talking about privacy when browsing the web and receiving emails.