4 ms·

It would be really wonderful if the password manager didn't contain surveillance software, monitoring every time the plugin has been opened via Google Analytics

by netik 10y ago

It would be really wonderful if the password manager didn't contain surveillance software, monitoring every time the plugin has been opened via Google Analytics. Can you remove that? https://github.com/bitwarden/browser/tree/master/src/scripts https://github.com/bitwarden/browser/tree/master/src/scripts

ihuman 10y ago
Couldn't you just fork it and delete that?
- netik 10y ago
  Sure, but that doesn't help everyone, that only helps me.
  - pYQAJ6Zm 10y ago
    Not if you follow with a PR … and the author accepts it, of course.
    - netik 10y ago
      Well, that's a damn fine point. I guess I'll submit a pull request.
xxkylexx 10y ago
I had a feeling people might make a fuss about this. I am really just using it to learn about how the product is being used at the moment since it is so new and I would like to improve the experience for people. I have intentions on adding an opt-out flag in settings for this.
- netik 10y ago
  If you do that, it should be one of the first questions asked when the plugin first starts up and be absolutely transparent about what data is collected. It's less about 'making a fuss' and more about 'providing additional data to adversaries.' Remember, the NSA piggybacked on Google Analytics tokens for years to track users.
  - smcnally 10y ago
    > Remember, the NSA piggybacked on Google Analytics tokens for years to track users. Makes all the sense in the world they'd do so, and I have no recollection of that. Do you have the links to share while I look myself for same? TY
    - netik 10y ago
      Yes, that's in the Snowden docs: https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10... http://www.digitaltrends.com/web/nsa-google-cookies/ http://www.digitaltrends.com/web/nsa-google-cookies/
- Freak_NL 10y ago
  Tempting and understandable from the developer's perspective, but it is absolutely unacceptable in a password manager. The notion of usage telemetry gathering does not align with the high level of privacy and security a password manager should represent. If you want more feedback than just the bugs and feature requests reported, why not ask the users in your software via a friendly dialogue screen after a week or so?
- dandelion_lover 10y ago
  What about Piwik Analytics? https://piwik.org/ https://piwik.org/
  - anc84 10y ago
    While it would reduce the privacy exposure that's not the point. It would still by spying on its users.
    - z0xcd 10y ago
      See: https://github.com/bitwarden/browser/pull/24 https://github.com/bitwarden/browser/pull/24
- justindocanto 10y ago
  You made software to make peoples secrets more secure but you added tracking, making everything less secure? What were you thinking? All it would take for all of your customer's privacy and security (mostly their security via obfuscation) to be compromised is for one person to gain access to your google login. If somebody does that, they are instantly gaining access to countless private URLs nobody would know about otherwise in a beautiful easy-to-use interface called Google Analytics. And then you have "intentions" to do opt-OUT tracking? You are currently demonstrating your decision making (when it comes to security) is very poor. You really need to think more about your users if you're going to be serious about this project.
- lucb1e 10y ago
  Note that this tracking without prior consent is illegal in the EU. It's a law not everyone seems to like, but it cannot have had much support from big corps so I doubt it was lobbied in. It's something they apparently care about. I hate all the "will you accept our cookies" screens but overall, I'm actually a proponent of the law. Functional stuff like login cookies are fine (don't need consent) so those screens actually warn us "this website wants to make a behavioral profile or sends your data to third parties who want to do that, you wanna continue?"
- curried_haskell 10y ago
  People might make a fuss? I love the work you've done here--we're all looking for a great solution to the password manager problem. But for the love of all that is holy, do not include tracking software in a password manager vault. Do not even include the tiniest thought or idea that it might be phoning home somewhere. Because with this small, innocent action you ruin all the trust you build in your product.
deleted 10y ago
[deleted]

by netik 10y ago

ihuman 10y ago

Couldn't you just fork it and delete that?

netik 10y ago
Sure, but that doesn't help everyone, that only helps me.
- pYQAJ6Zm 10y ago
  Not if you follow with a PR … and the author accepts it, of course.
  - netik 10y ago
    Well, that's a damn fine point. I guess I'll submit a pull request.

xxkylexx 10y ago

I had a feeling people might make a fuss about this. I am really just using it to learn about how the product is being used at the moment since it is so new and I would like to improve the experience for people. I have intentions on adding an opt-out flag in settings for this.

netik 10y ago
If you do that, it should be one of the first questions asked when the plugin first starts up and be absolutely transparent about what data is collected. It's less about 'making a fuss' and more about 'providing additional data to adversaries.' Remember, the NSA piggybacked on Google Analytics tokens for years to track users.
- smcnally 10y ago
  > Remember, the NSA piggybacked on Google Analytics tokens for years to track users. Makes all the sense in the world they'd do so, and I have no recollection of that. Do you have the links to share while I look myself for same? TY
  - netik 10y ago
    Yes, that's in the Snowden docs: https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10... http://www.digitaltrends.com/web/nsa-google-cookies/ http://www.digitaltrends.com/web/nsa-google-cookies/
Freak_NL 10y ago
Tempting and understandable from the developer's perspective, but it is absolutely unacceptable in a password manager. The notion of usage telemetry gathering does not align with the high level of privacy and security a password manager should represent. If you want more feedback than just the bugs and feature requests reported, why not ask the users in your software via a friendly dialogue screen after a week or so?
dandelion_lover 10y ago
What about Piwik Analytics? https://piwik.org/ https://piwik.org/
- anc84 10y ago
  While it would reduce the privacy exposure that's not the point. It would still by spying on its users.
  - z0xcd 10y ago
    See: https://github.com/bitwarden/browser/pull/24 https://github.com/bitwarden/browser/pull/24
justindocanto 10y ago
You made software to make peoples secrets more secure but you added tracking, making everything less secure? What were you thinking? All it would take for all of your customer's privacy and security (mostly their security via obfuscation) to be compromised is for one person to gain access to your google login. If somebody does that, they are instantly gaining access to countless private URLs nobody would know about otherwise in a beautiful easy-to-use interface called Google Analytics. And then you have "intentions" to do opt-OUT tracking? You are currently demonstrating your decision making (when it comes to security) is very poor. You really need to think more about your users if you're going to be serious about this project.
lucb1e 10y ago
Note that this tracking without prior consent is illegal in the EU. It's a law not everyone seems to like, but it cannot have had much support from big corps so I doubt it was lobbied in. It's something they apparently care about. I hate all the "will you accept our cookies" screens but overall, I'm actually a proponent of the law. Functional stuff like login cookies are fine (don't need consent) so those screens actually warn us "this website wants to make a behavioral profile or sends your data to third parties who want to do that, you wanna continue?"
curried_haskell 10y ago
People might make a fuss? I love the work you've done here--we're all looking for a great solution to the password manager problem. But for the love of all that is holy, do not include tracking software in a password manager vault. Do not even include the tiniest thought or idea that it might be phoning home somewhere. Because with this small, innocent action you ruin all the trust you build in your product.

deleted 10y ago

[deleted]