54

It seems like all user input to the Dash home lens is send to Amazon by default in Ubuntu 12.10, is this correct?

2

4 Answers 4

Reset to default
25

They are proxying through productsearch.ubuntu.com with HTTPS encryption (though there's still a a heated bug discussion over whether the search should be included at all). Unfortunately, while no personally identifying information is sent to Amazon, the privacy policy for Ubuntu sharing information about proxied searches is still unclear.

Also, there are concerns that the image thumbnails of results that users download could allow Amazon to correlate queries to IP addresses.

Shuttleworth also wrote a blog post that tries to address the privacy issues with this feature.

2
  • 3
    The answer is, everything typed into the home lens will be send by default anonymized to Amazon (current version: Ubuntu 12.10 Beta 1) - jonobacon.org/2012/09/25/…
    – Paradiesstaub
    Commented Sep 24, 2012 at 23:44
  • Turns out #2 was just marked "visibility: private" by someone and Launchpad uses the 404 page for that. Someone else made it public again. I've archived a copy of the page contents as of now in case it happens again.
    – ssokolow
    Commented Sep 25, 2012 at 1:45
9

I do not believe Amazon will see every query in its original state since these queries are sent to productsearch.ubuntu.com and then continue on so your ip address is not reaching Amazon's API. However the other concern is how does Canonical handle these queries since they get them in the original form and have no issued a privacy policy explaining whether any search data is kept.

It is not unreasonable to think that Canonical keeps logs on all of its servers for some period of time and maybe even backups.

2
  • 14
    Given that Mr. Shuttleworth's response to all this (in a recent blog post) is essentially: if we wanted to spy on you, we could have already sent you a trojan, I have a bad feeling about how seriously Canonical takes this private user data. Such a flippant attitude to security and user trust does not normally end well...
    – Jonathan Chan
    Commented Sep 23, 2012 at 19:00
  • 2
    @JonathanChan yeah, that's what I thought too but we all make mistakes sometimes. I think his intentions are good here but this plan wasn't well communicated and isn't being managed well yet.
    – Tom Brossman
    Commented Sep 23, 2012 at 19:24
6

Dash search terms are not sent to Amazon directly. They're sent to Canonical, which then sends them to Amazon. That means Amazon doesn't get your IP.

However, as of the current implementation, thumbnail requests are directly sent to Amazon. So Amazon does get your IP in the end.

More details: https://perot.me/ubuntu-privacy-blunder-over-amazon-ads-continues

2
  • 5
    The Problem I see here is, that the default search sends data through the wire without the average user expecting it. Its a privacy problem. The IP thing is just one point here.
    – Paradiesstaub
    Commented Sep 28, 2012 at 10:18
  • 3
    I concur. The current implementation gives them little credibility when they claim that they anonymize your search terms.
    – Etienne Perot
    Commented Sep 28, 2012 at 17:24
1

That is correct. Dash in Unity leaks information to Amazon and others.

You can read more about the privacy issues and how to fix them in EFF's post Privacy in Ubuntu 12.10: Amazon Ads and Data Leaks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .