6 ms·

Seems fine to me. Opt out is reasonable, I trust 1password to not fuck this up versus, say, LastPass. If you already trust 1password to store your credentials,

Seems fine to me. Opt out is reasonable, I trust 1password to not fuck this up versus, say, LastPass. If you already trust 1password to store your credentials, I see little to no impact to your risk exposure by having them collect anonymized telemetry. Curious if others have thoughts here? Their UI has changed a lot in recent years, maybe this will enable them to make more informed design decisions so that one day grandparents stop getting lost in their horrible menus.

AlexandrB 4y ago
> If you already trust 1password to store your credentials I don't, so I'm never upgrading to 1Password 8. The telemetry news only validates my decision. What I consider important in a security product and what AgileBits considers important diverged a while ago and that's ok I guess.
- dijit 4y ago
  1password 8 definitely feels like a massive UX downgrade over v7. Though I can’t put why into words.
  - flinner 4y ago
    The latest version seems optimized for keyboard shortcuts at the expense of easily accessible 1-click copying of username/password/one-time password. To me, this introduced a large additional cognitive load where instead of a click, click, click, I now have to remember that CMD+C is username, CMD+Shift+C is password, and (something else?) for One-Time Password.
  - kitsunesoba 4y ago
    I think it's that v8 feels less an app crafted for individuals and more like yet another generic SaaS made for corporate customers.
  - pinkcan 4y ago
    it's no longer a native app
  - krger 4y ago
    Only one word needed: Electron
  - mdaniel 4y ago
    Oh, I can: it's the experience of the edit button mysteriously appearing and disappearing, along with the unforgivable experience reported on r/1Password of some user having edits applied to the wrong item. There but for the grace of God go I, but I for sure have experienced the oft-reported edit button comes and goes nonsense We shall not even get started on their extension losing its mind for no good reason. Still better than Bitwarden, and they should thank their lucky stars for it or I'd take my money elsewhere
JohnFen 4y ago
> Opt out is reasonable I strongly disagree with this and think much less of companies who do it that way. That said, that battle is already lost anyway.
- xyzzy_plugh 4y ago
  Opt in is the same as not doing it at all. TFA explains their approach decently well and it seems sane to me. It's not like this is telemetry in some open source thing for nefarious reasons. It's literally for their customers. They already know who you are, it's not like they're using this for targeted ads.
  - JohnFen 4y ago
    > It's literally for their customers. This is said by every company that does telemetry.
  - alpaca128 4y ago
    > it's not like they're using this for targeted ads. Prove it. Right, you can't, because once telemetry runs you have no insight or control over what happens with the data. And trust is definitely not an option anymore after all that happened over the years.
  - anonymousab 4y ago
    > Opt in is the same as not doing it at all. That is more of a statement about the detestability of telemetry as a concept than anything else.
    - satvikpendem 4y ago
      No, it's about defaults in behavioral economics. The vast majority of people won't change the default settings on their devices. https://www.centenecenter.wustl.edu/by-the-power-of-default-using-behavioral-economics-to-change-behavior/ https://www.centenecenter.wustl.edu/by-the-power-of-default-...
ptx 4y ago
> little to no impact to your risk exposure by having them collect anonymized telemetry The key word there is "anonymized". What is the risk of the collected data accidentally being less anonymous than intended? What is the risk of accidentally collecting more data than intended? Microsoft has already had both types of accident [1][2], so I think it's fair to assume a risk close to 100% over time. Even if users opt out, what is the risk of the opt-out mechanism at some point containing a bug that causes it to fail? Or the risk of the user at some point failing to properly configure the opt-out mechanism? Is the company going to put as much effort into minimizing these risks as the end user would like? Is anonymization of telemetry going to be the top priority for the company? [1] https://github.com/dotnet/sdk/issues/6145#issuecomment-220105007 https://github.com/dotnet/sdk/issues/6145#issuecomment-22010... [2] https://news.ycombinator.com/item?id=23260548 https://news.ycombinator.com/item?id=23260548
allarm 4y ago
> opt out is reasonable It absolutely isn’t.
npteljes 4y ago
>I trust 1password to not fuck this up versus, say, LastPass. What makes them different?
- bombcar 4y ago
  LastPass has had at least one major public fuckup where they not only made a mistake, but they did not handle the mistake well. 1Password has not yet had that, they've made some missteps, but have handled it relatively well (based on my experience, and that I still use them).
  - npteljes 4y ago
    That is certainly true. 1Password might be a good one. But I'm thinking that they are both businesses, who offer their thing as services, both have taken investor money, management can change anytime... I think the risk category is similar.
porkbeer 4y ago
Opt out is not reasonable. At all.
bwoodruff 4y ago
I wrote more about the consent aspect here: https://news.ycombinator.com/item?id=35706897 https://news.ycombinator.com/item?id=35706897 tl;dr If we roll this out to customers, we'll be asking for consent, and won't be collecting telemetry data unless we have it. -Ben, 1Password

AlexandrB 4y ago

> If you already trust 1password to store your credentials I don't, so I'm never upgrading to 1Password 8. The telemetry news only validates my decision. What I consider important in a security product and what AgileBits considers important diverged a while ago and that's ok I guess.

dijit 4y ago
1password 8 definitely feels like a massive UX downgrade over v7. Though I can’t put why into words.
- flinner 4y ago
  The latest version seems optimized for keyboard shortcuts at the expense of easily accessible 1-click copying of username/password/one-time password. To me, this introduced a large additional cognitive load where instead of a click, click, click, I now have to remember that CMD+C is username, CMD+Shift+C is password, and (something else?) for One-Time Password.
- kitsunesoba 4y ago
  I think it's that v8 feels less an app crafted for individuals and more like yet another generic SaaS made for corporate customers.
- pinkcan 4y ago
  it's no longer a native app
- krger 4y ago
  Only one word needed: Electron
- mdaniel 4y ago
  Oh, I can: it's the experience of the edit button mysteriously appearing and disappearing, along with the unforgivable experience reported on r/1Password of some user having edits applied to the wrong item. There but for the grace of God go I, but I for sure have experienced the oft-reported edit button comes and goes nonsense We shall not even get started on their extension losing its mind for no good reason. Still better than Bitwarden, and they should thank their lucky stars for it or I'd take my money elsewhere

JohnFen 4y ago

> Opt out is reasonable I strongly disagree with this and think much less of companies who do it that way. That said, that battle is already lost anyway.

xyzzy_plugh 4y ago
Opt in is the same as not doing it at all. TFA explains their approach decently well and it seems sane to me. It's not like this is telemetry in some open source thing for nefarious reasons. It's literally for their customers. They already know who you are, it's not like they're using this for targeted ads.
- JohnFen 4y ago
  > It's literally for their customers. This is said by every company that does telemetry.
- alpaca128 4y ago
  > it's not like they're using this for targeted ads. Prove it. Right, you can't, because once telemetry runs you have no insight or control over what happens with the data. And trust is definitely not an option anymore after all that happened over the years.
- anonymousab 4y ago
  > Opt in is the same as not doing it at all. That is more of a statement about the detestability of telemetry as a concept than anything else.
  - satvikpendem 4y ago
    No, it's about defaults in behavioral economics. The vast majority of people won't change the default settings on their devices. https://www.centenecenter.wustl.edu/by-the-power-of-default-using-behavioral-economics-to-change-behavior/ https://www.centenecenter.wustl.edu/by-the-power-of-default-...

ptx 4y ago

> little to no impact to your risk exposure by having them collect anonymized telemetry The key word there is "anonymized". What is the risk of the collected data accidentally being less anonymous than intended? What is the risk of accidentally collecting more data than intended? Microsoft has already had both types of accident [1][2], so I think it's fair to assume a risk close to 100% over time. Even if users opt out, what is the risk of the opt-out mechanism at some point containing a bug that causes it to fail? Or the risk of the user at some point failing to properly configure the opt-out mechanism? Is the company going to put as much effort into minimizing these risks as the end user would like? Is anonymization of telemetry going to be the top priority for the company? [1] https://github.com/dotnet/sdk/issues/6145#issuecomment-220105007 https://github.com/dotnet/sdk/issues/6145#issuecomment-22010... [2] https://news.ycombinator.com/item?id=23260548 https://news.ycombinator.com/item?id=23260548

allarm 4y ago

> opt out is reasonable It absolutely isn’t.

npteljes 4y ago

>I trust 1password to not fuck this up versus, say, LastPass. What makes them different?

bombcar 4y ago
LastPass has had at least one major public fuckup where they not only made a mistake, but they did not handle the mistake well. 1Password has not yet had that, they've made some missteps, but have handled it relatively well (based on my experience, and that I still use them).
- npteljes 4y ago
  That is certainly true. 1Password might be a good one. But I'm thinking that they are both businesses, who offer their thing as services, both have taken investor money, management can change anytime... I think the risk category is similar.

porkbeer 4y ago

Opt out is not reasonable. At all.

bwoodruff 4y ago

I wrote more about the consent aspect here: https://news.ycombinator.com/item?id=35706897 https://news.ycombinator.com/item?id=35706897 tl;dr If we roll this out to customers, we'll be asking for consent, and won't be collecting telemetry data unless we have it. -Ben, 1Password