Src: Why is my real IP address appended to the search query link?

[Tobi823]

I searched for "berlin" and the resulting yahoo URL contains:

• my real IPv4-Address (here replaced by 255.255.255.255
• multiple unique IDs
• Android version and Chrome version

https://de.search.yahoo.com/yhs/search?hspart=dcola&hsimp=yhs-019&type=gsp_kiwi_00_00_ssg06&param1=1&param2=cat%3Dweb%26sesid%3Dfce7115c3664dc731c84b01653cfc5f8%26ip%3D255.255.255.255%26b%3DChrome%20Mobile%26bv%3D88.0.4324.152%26os%3DAndroid-8.1-Oreo%26os_ver%3D8.1%26pa%3Dgencoll20%26sid%3Dc0002c9c2b110778941070974a25f44a%26abid%3D%26abg%3D%26a%3Dgsp_kiwi_00_00_ssg06%26sdk_ver%3D%26cd%3D%26cr%3D%26uid%3D%26uref%3D&p=berlin

This looks very suspicious and not privacy friendly

[nyanpasu64]

Searching "asdfasdf" on the "Bing" search engine actually points to https://kiwisearchservices.com/?a=gsb_kiwi_00_00_ssg05&base=https://www.google.com/&q=asdfasdf&mode=isdb_manual&oq=asdfasdf&aqs=chrome..69i57.3785j0j4&sourceid=chrome-mobile&ie=UTF-8.

The "yahoo" search engine actually points to kiwisearchservices.net. Somehow your search engine database points to search.kiwibrowser.org, not kiwisearchservices.(com/org): https://github.com/kiwibrowser/src/blob/adc9fc36e517485ccb0cc8c9d82aa0f14db1c7a2/components/search_engines/prepopulated_engines.json.

Either way, you need to stop spying on/stealing/keylogging the searches performed by users, and lying to users that they're using Yahoo or Bing when you're actually intercepting their searches.

[kiwibrowser]

Hello,

It's actually quite simple, Kiwi earns money for every search it forwards to Yahoo or Microsoft Bing.

The parameters and integration method are defined by the search engines themselves, we don't have our words at all how the integration is done.

They have a standard guide on how to integrate, either you follow this guide, or you don't work with them.

In practice, without a couple of millions of dollars in revenue, or very close contacts with internal people at Microsoft or Yahoo it's near impossible to get an exception that would make it possible to work without redirect (I assume this means bypassing all the fraud and billing checks, but this is just my interpretation).

Arnaud.

[Tobi823]

Thanks for your fast response and explanation.

Although i don't like it, i understand that the money for the app development has to come from somewhere (even Firefox is paid to use "Google" as the default search engine).

Maybe add a note about this behaviour to the README.md for the next curious computer science student :)

[nyanpasu64]

"getting money for shipping with yahoo and bing as default" is understandable, but redirecting user searches through your own server feels untrustworthy and a privacy risk. and i don't know if my initial tone, insinuating that the browser was keylogging and endangering users, was justified or unnecessarily antagonistic.

i've seen other shady Chrome extensions pull the same "change your search engine to something called Yahoo, that sends your queries through a different domain" trick before, and such functionality is banned for Chrome extensions, and such extensions violate the TOS... so maybe Kiwi Browser is also shady (though not necessarily violating the Play Store TOS)... or maybe you're telling the truth and (what I see as endangering users) is actually standard Microsoft/Yahoo practice.

[kiwibrowser]

You are absolutely right on the consequences but not the intentions.

I get your concerns but I'm not sure how to technically solve them without the cooperation of the search engines themselves.

I've spent countless of hours on the project and on quite deep topics (it was the first open-source browser that added the possibility to install Chrome extensions) and you seem to be very technical as well, so we understand the same thing; it's better to avoid redirects, but again, I don't see how (as of today).

As for the extensions comparison, we can agree there is a fundamental difference between:

• a Chrome extension / toolbar that will install itself and override your preferred search settings without your consent,
  and
• a browser that the user installs by its own will, that recommends you to use Bing / Yahoo / anything and let the user decide.

Technically, however, the integration is very similar.

If there was a possibility to put www.bing.com/?source=kiwi directly, I would do it 100%, but to get such access without any filters or redirect is extremely difficult because you need someone at Microsoft to say "ok we can make exception for Kiwi like we did for Vivaldi".
It's definitively a constraint and not a choice :(