<story><title>Tell HN: DuckDuckGo&apos;s privacy extension is adding an inline popup to web forms</title><text>I didn&amp;#x27;t really believe my eyes when I saw it the first time, I thought it had to be some ad specific to the website.&lt;p&gt;But it appears every form accepting an email on any website I visit now gets a small duck icon next to it that pops up a big bold-print message box to &amp;quot;Protect your inbox &amp;quot; complete with a cheeky prompt to either &amp;quot;get email protection&amp;quot; or &amp;quot;maybe later.&amp;quot; Refusal is not even an option. This is definitely new for me as of today.[0]&lt;p&gt;I found DuckDuckGo via Hackernews and have generally been a happy user of both the search engine and the privacy extension. Why could they possibly be doing this? It seems like a self-destructive act from a branding standpoint, I can&amp;#x27;t imagine their target customer demographic is amicable to this kind of thing.&lt;p&gt;[0]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;i.redd.it&amp;#x2F;p1tcoikka0ka1.png&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;i.redd.it&amp;#x2F;p1tcoikka0ka1.png&lt;/a&gt;&lt;p&gt;Edit: It&amp;#x27;s even on Hackernews! I genuinely can&amp;#x27;t recall a browser extension acting like this since the mid-00s adware toolbar days. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;i.imgur.com&amp;#x2F;vYjZAUK.png&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;i.imgur.com&amp;#x2F;vYjZAUK.png&lt;/a&gt;&lt;p&gt;Edit again: This post originally just said &amp;quot;injecting ads into web forms,&amp;quot; I edited the title to clarify - apologies if that was misleading.</text></story><parent_chain><item><author>yegg</author><text>Founder&amp;#x2F;CEO of DuckDuckGo here. This title implies we are injecting third-party advertising into web forms, which is not the case. (Edit: that last sentence is now moot since the title has been updated. Thank you.)&lt;p&gt;This is part of the onboarding for our optional DuckDuckGo Email Protection feature that comes with the extension. (Note if you just use our private search engine, you do not need our extension at all.) The feature generates email aliases for you on sign up forms (so you don&amp;#x27;t give out your real email address), which then forwards to your regular inbox with email trackers removed in the process: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;spreadprivacy.com&amp;#x2F;protect-your-inbox-with-duckduckgo-email-protection&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;spreadprivacy.com&amp;#x2F;protect-your-inbox-with-duckduckgo...&lt;/a&gt;. It is mentioned in the add-on description as one of the extension&amp;#x27;s primary features, e.g., at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;addons.mozilla.org&amp;#x2F;en-US&amp;#x2F;firefox&amp;#x2F;addon&amp;#x2F;duckduckgo-for-firefox&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;addons.mozilla.org&amp;#x2F;en-US&amp;#x2F;firefox&amp;#x2F;addon&amp;#x2F;duckduckgo-fo...&lt;/a&gt;.&lt;p&gt;(x-posting part of another comment here for context on this feature: Popping up a level, the goal of our product is to be the &amp;quot;easy button&amp;quot; for privacy, and email protection is a big part of it, since as we (and others) have gotten much better at web tracking protection (e.g., see &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;help.duckduckgo.com&amp;#x2F;duckduckgo-help-pages&amp;#x2F;privacy&amp;#x2F;web-tracking-protections&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;help.duckduckgo.com&amp;#x2F;duckduckgo-help-pages&amp;#x2F;privacy&amp;#x2F;we...&lt;/a&gt;), unscrupulous actors have done more and more email tracking, using your email address as a unique identifier to track you across sites and putting email trackers within emails to do similar.)&lt;p&gt;Update: I am listening to the feedback presented here, though please know there is a whole team of people working on this feature, trying to bring needed email protection to our mainstream user base. Email protection as a concept is hard for people to understand and the team felt that this in-context onboarding was the best way to explain it. However, we will now revisit this given the feedback.</text></item></parent_chain><comment><author>toxic</author><text>So, it&amp;#x27;s an ad for a service where email goes through your servers before reaching mine, for the purpose of removing tracking and hiding my address.  This isn&amp;#x27;t onboarding, this is cross-promotion of another service and it&amp;#x27;s really F&amp;#x27;ing gross.&lt;p&gt;Messing with the integrity of a web page&amp;#x27;s content without your users&amp;#x27; consent is a gross violation of trust.  Doing it inside of a browser extension is adware.  Doing it as a privacy-focused company is... a fast way to destroy your image as a privacy-focused company.&lt;p&gt;If you&amp;#x27;re manipulating the display of a page that I&amp;#x27;m visiting, without an opt-in, and you&amp;#x27;re being shady about calling it advertising, why should I expect that you&amp;#x27;re going to treat email with the level of integrity required&amp;#x2F;expected?&lt;p&gt;This is a hard red line that you&amp;#x27;ve crossed, especially as a privacy-focused company, and instead of backing down, you&amp;#x27;re blaming your UI design?  Stop.  There is no amount of UI work that makes it OK to silently insert your ad into someone else&amp;#x27;s content.&lt;p&gt;If you want to cross-promote (please don&amp;#x27;t, but if you must), you need to do it in a way that makes it clear it&amp;#x27;s coming from the extension, and not manipulating third-party content without user consent.  The second you start inserting your message into a page that I&amp;#x27;m reading, is the second that I uninstall your extension and never use it again.&lt;p&gt;Which is a shame. I like your search product, and I thought that I liked your company&amp;#x27;s philosophy and goals.  Oh well.</text></comment>
<story><title>Tell HN: DuckDuckGo&apos;s privacy extension is adding an inline popup to web forms</title><text>I didn&amp;#x27;t really believe my eyes when I saw it the first time, I thought it had to be some ad specific to the website.&lt;p&gt;But it appears every form accepting an email on any website I visit now gets a small duck icon next to it that pops up a big bold-print message box to &amp;quot;Protect your inbox &amp;quot; complete with a cheeky prompt to either &amp;quot;get email protection&amp;quot; or &amp;quot;maybe later.&amp;quot; Refusal is not even an option. This is definitely new for me as of today.[0]&lt;p&gt;I found DuckDuckGo via Hackernews and have generally been a happy user of both the search engine and the privacy extension. Why could they possibly be doing this? It seems like a self-destructive act from a branding standpoint, I can&amp;#x27;t imagine their target customer demographic is amicable to this kind of thing.&lt;p&gt;[0]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;i.redd.it&amp;#x2F;p1tcoikka0ka1.png&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;i.redd.it&amp;#x2F;p1tcoikka0ka1.png&lt;/a&gt;&lt;p&gt;Edit: It&amp;#x27;s even on Hackernews! I genuinely can&amp;#x27;t recall a browser extension acting like this since the mid-00s adware toolbar days. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;i.imgur.com&amp;#x2F;vYjZAUK.png&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;i.imgur.com&amp;#x2F;vYjZAUK.png&lt;/a&gt;&lt;p&gt;Edit again: This post originally just said &amp;quot;injecting ads into web forms,&amp;quot; I edited the title to clarify - apologies if that was misleading.</text></story><parent_chain><item><author>yegg</author><text>Founder&amp;#x2F;CEO of DuckDuckGo here. This title implies we are injecting third-party advertising into web forms, which is not the case. (Edit: that last sentence is now moot since the title has been updated. Thank you.)&lt;p&gt;This is part of the onboarding for our optional DuckDuckGo Email Protection feature that comes with the extension. (Note if you just use our private search engine, you do not need our extension at all.) The feature generates email aliases for you on sign up forms (so you don&amp;#x27;t give out your real email address), which then forwards to your regular inbox with email trackers removed in the process: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;spreadprivacy.com&amp;#x2F;protect-your-inbox-with-duckduckgo-email-protection&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;spreadprivacy.com&amp;#x2F;protect-your-inbox-with-duckduckgo...&lt;/a&gt;. It is mentioned in the add-on description as one of the extension&amp;#x27;s primary features, e.g., at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;addons.mozilla.org&amp;#x2F;en-US&amp;#x2F;firefox&amp;#x2F;addon&amp;#x2F;duckduckgo-for-firefox&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;addons.mozilla.org&amp;#x2F;en-US&amp;#x2F;firefox&amp;#x2F;addon&amp;#x2F;duckduckgo-fo...&lt;/a&gt;.&lt;p&gt;(x-posting part of another comment here for context on this feature: Popping up a level, the goal of our product is to be the &amp;quot;easy button&amp;quot; for privacy, and email protection is a big part of it, since as we (and others) have gotten much better at web tracking protection (e.g., see &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;help.duckduckgo.com&amp;#x2F;duckduckgo-help-pages&amp;#x2F;privacy&amp;#x2F;web-tracking-protections&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;help.duckduckgo.com&amp;#x2F;duckduckgo-help-pages&amp;#x2F;privacy&amp;#x2F;we...&lt;/a&gt;), unscrupulous actors have done more and more email tracking, using your email address as a unique identifier to track you across sites and putting email trackers within emails to do similar.)&lt;p&gt;Update: I am listening to the feedback presented here, though please know there is a whole team of people working on this feature, trying to bring needed email protection to our mainstream user base. Email protection as a concept is hard for people to understand and the team felt that this in-context onboarding was the best way to explain it. However, we will now revisit this given the feedback.</text></item></parent_chain><comment><author>Slighted</author><text>&amp;gt;This title implies we are injecting third-party advertising into web forms, which is not the case.&lt;p&gt;Its okay everybody, the CEO came out and said its *not* actually advertising but just simply an unsolicited, intrusive pop-up that tries to get users to use more of their services so its all good!</text></comment>