10 ms·

Metadata is still data? Sure, it's not your password, but the title isn't "1Password Leaks Your Passwords". And it's not just when it's uploaded. It's when anyo

by Velox 11y ago

Metadata is still data? Sure, it's not your password, but the title isn't "1Password Leaks Your Passwords". And it's not just when it's uploaded. It's when anyone has access to your keychain. The primary feature of a password manager is that it is supposed to be resistant to attack.

Laaw 11y ago
No, metadata is not data. It's metadata.
- Velox 11y ago
  Metadata gives information about other data. The length of your password would be metadata rather than data. I'm pretty sure no one really wants that out in public?
  - ghshephard 11y ago
    Nice thing about 1Password (and other password managers) - password length isn't that important. My HN password is 30 characters, 5 of which are symbols, 5 of which are digits. That's lots of metadata, but probably doesn't help you in the slightest in guessing my password. Agree with you that its problematic that 1password was leaking things like site names and URLs though.
- MaulingMonkey 11y ago
  Metadata is data about data.
  - mtone 11y ago
    In my opinion, the names and URLs in a password manager are data, not metadata. I personally typed or copy-pasted all the entries in my keepass vault, it's primary information associated with the passwords, highly personal, and that it's not the definition of metadata. The fact that a tool automates the gathering of some data (URLs) for the user doesn't automatically make it metadata. Metadata would the character encoding, version, encryption, ids required to read the file, as well as added/modified dates (potentially sensitive metadata).
- aylons 11y ago
  It's data about data. So, still data. The title may be a bit sensationalized ("your data" sound like "all your data", but it really is "some of your data"), but it is not false.
  - Laaw 11y ago
    There's a reason it's not called 'data', is my point. It's false, insofar that it's not the 'data' you give to 1Password.
    - johncolanduoni 11y ago
      Do you not give the website your password is used at to 1Password?
      - Laaw 11y ago
        1Password isn't leaking passwords.
        johncolanduoni 11y ago
        I know, but the website address is still data that I input into the application. My point was that it doesn't only leak fluffy metadata that I don't directly input into the application.
        Laaw 11y ago
        Well, that's not metadata, it's just data.
        johncolanduoni 11y ago
        ... yes, and that's why your claim that "It's false, insofar that it's not the 'data' you give to 1Password." is wrong. Which was my point. Also, whatever the unusual definition of data you use that results in metadata being excluded is irrelevant (and it is unusual, look up the definition of data in any dictionary). The important part is that 1Password was not making it clear that it does not encrypt certain parts of the "information" you put into it.
msbarnett 11y ago
Passwords are my data in 1Password. If you say to me that 1Password is leaking my data, I'm thinking it leaks my passwords. The headline is misleading. "1Password Leaks Your Metadata" would be both more accurate and less clickbait.
- DanBC 11y ago
  People have different risk assessments.
  - msbarnett 11y ago
    I'm not saying this isn't a significant risk, or shouldn't be treated as such. I'm merely saying that the headline implies that the primary data in 1Password is leaked, when it is not. In what possible way would this headline not be more accurate if it were "1Password Leaks Your Metadata"? How would that be diminishing different peoples' risk assessments?
    - DanBC 11y ago
      If you think a title is poor you should probably email the mods to suggest a better title. They seem receptive to that kind of thing.
- kobayashi 11y ago
  I disagree. As per the porn example in the article, and many other fathomable situations, metadata in a password manager can be as important, and sometimes more sensitive, than the password itself.
  - coldtea 11y ago
    Exactly. People wouldn't care for a politician's password to IloveSexWithHorses.com (unless they like beastiality themselves and can't afford an account of their own). The fact that he subscribes to such a site though, would be worth gold in expose articles and/or blackmail...
  - 11y ago

by Velox 11y ago

Laaw 11y ago

No, metadata is not data. It's metadata.

Velox 11y ago
Metadata gives information about other data. The length of your password would be metadata rather than data. I'm pretty sure no one really wants that out in public?
- ghshephard 11y ago
  Nice thing about 1Password (and other password managers) - password length isn't that important. My HN password is 30 characters, 5 of which are symbols, 5 of which are digits. That's lots of metadata, but probably doesn't help you in the slightest in guessing my password. Agree with you that its problematic that 1password was leaking things like site names and URLs though.
MaulingMonkey 11y ago
Metadata is data about data.
- mtone 11y ago
  In my opinion, the names and URLs in a password manager are data, not metadata. I personally typed or copy-pasted all the entries in my keepass vault, it's primary information associated with the passwords, highly personal, and that it's not the definition of metadata. The fact that a tool automates the gathering of some data (URLs) for the user doesn't automatically make it metadata. Metadata would the character encoding, version, encryption, ids required to read the file, as well as added/modified dates (potentially sensitive metadata).
aylons 11y ago
It's data about data. So, still data. The title may be a bit sensationalized ("your data" sound like "all your data", but it really is "some of your data"), but it is not false.
- Laaw 11y ago
  There's a reason it's not called 'data', is my point. It's false, insofar that it's not the 'data' you give to 1Password.
  - johncolanduoni 11y ago
    Do you not give the website your password is used at to 1Password?
    - Laaw 11y ago
      1Password isn't leaking passwords.
      - johncolanduoni 11y ago
        I know, but the website address is still data that I input into the application. My point was that it doesn't only leak fluffy metadata that I don't directly input into the application.
        Laaw 11y ago
        Well, that's not metadata, it's just data.
        johncolanduoni 11y ago
        ... yes, and that's why your claim that "It's false, insofar that it's not the 'data' you give to 1Password." is wrong. Which was my point. Also, whatever the unusual definition of data you use that results in metadata being excluded is irrelevant (and it is unusual, look up the definition of data in any dictionary). The important part is that 1Password was not making it clear that it does not encrypt certain parts of the "information" you put into it.

msbarnett 11y ago

Passwords are my data in 1Password. If you say to me that 1Password is leaking my data, I'm thinking it leaks my passwords. The headline is misleading. "1Password Leaks Your Metadata" would be both more accurate and less clickbait.

DanBC 11y ago
People have different risk assessments.
- msbarnett 11y ago
  I'm not saying this isn't a significant risk, or shouldn't be treated as such. I'm merely saying that the headline implies that the primary data in 1Password is leaked, when it is not. In what possible way would this headline not be more accurate if it were "1Password Leaks Your Metadata"? How would that be diminishing different peoples' risk assessments?
  - DanBC 11y ago
    If you think a title is poor you should probably email the mods to suggest a better title. They seem receptive to that kind of thing.
kobayashi 11y ago
I disagree. As per the porn example in the article, and many other fathomable situations, metadata in a password manager can be as important, and sometimes more sensitive, than the password itself.
- coldtea 11y ago
  Exactly. People wouldn't care for a politician's password to IloveSexWithHorses.com (unless they like beastiality themselves and can't afford an account of their own). The fact that he subscribes to such a site though, would be worth gold in expose articles and/or blackmail...
- 11y ago