Stop DuckDuckGo Clickjacking
DuckDuckGo still uses JavaScript to intercept your link clicks, and there’s no good reason for it. One consequence of this clickjacking is that your Safari browsing history gets messed up.
[…]
Today I’ve released version 15.3 of my Safari extension StopTheMadness in the Mac App Store. To stop DuckDuckGo clickjacking, install StopTheMadness, create custom website options for
duckduckgo.com, and then enable the “All mouse clicks” option.
Previously:
9 Comments RSS · Twitter
vintner, DDG prevents leaking your search terms by using Referrer-Policy: origin, and I can see via the Safari Web Inspector and via Little Snitch that it's not going through r.duckduckgo.com
Thanks for calling attention to the problem and the fix. The gaps in my Safari history when I search with DuckDuckGo have baffled me for quite a while.
DuckDuckGo still uses JavaScript to intercept your link clicks, and there’s no good reason for it. One consequence of this clickjacking is that your Safari browsing history gets messed up.
OMG.
After years, I finally understand why some of my history entries are messed up. I always blamed an obscure bug in Safari, but the above explanation makes sense.
Is the redirect through /l/ pages like https://duckduckgo.com/l/?kh=-1&uddg=https%3A%2F%2Flapcatsoftware.com%2Farticles%2Fduckduckgo.html ? This might be a DDG bug, I'm not noticing Firefox using the interstitial.
vintner, there may be a bug in Safari History. Firefox and Chrome do seem to behave differently, but the JavaScript is the same, as far as I can tell. It's just setting window.location
When I created the custom website options for DuckDuckGo.com and checked "all mouse clicks," I am no longer able to select dropdowns for Safe Search and "Any time, Past day, Past Week....", etc.
@JeffJohnson could you add some kind of preset-menu to the per-webpage rules. Or an entire setting for "good rules to have active for certain pages"? I fear that creating this setting may have it linger there until the end of time, potentially causing trouble some day where i completely forgot i've got this option in place.
Bruce, sorry about that! I've already submitted a fix to the Mac App Store, so keep an eye out for an update, as soon as it gets reviewed by Apple.
I thought DDG's clickjacking was to prevent leaking your search terms to the page via the referer header (https://help.duckduckgo.com/results/rduckduckgocom/). Turning it off in the settings doesn't seem to change the missing history, though.