4 ms·

The worry about telemetry in a product like this is how it's implemented. It's more code that could have bugs in it. What assurances do we have that it will exe

The worry about telemetry in a product like this is how it's implemented. It's more code that could have bugs in it. What assurances do we have that it will execute safely in a way that it can't possibly access the password database, even in the event of (for example) compromise of the CI pipeline that builds the telemetry SDK? > No customer vault data can be seen or collected. We’re only interested in how people use the app itself, what features and screens they interact with – not what they store in their vaults, what sites they autofill on, or anything like that. This seems contradictory to me. How can the code see what screen is open without interacting with the app? This implies there is some kind of sandboxing layer. How can the 1Password software engineers possibly be confident enough in this sandboxing to assert that "no customer data can be seen?" That may be their intent, but bugs happen, especially in code that runs at a layer above the app to analyze how users interact with it. I will be opting out. Hopefully the opt-out mechanism doesn't have a bug in it either. And when there is inevitably a bug in the telemetry, I hope 1Password is okay with admitting that their opt-out system created two classes of users: those who did nothing, and thus remained vulnerable to bugs in the telemetry layer, and those who opted out of it.

1123581321 4y ago
They do separate the UI application from the kernel that manages access to the data. I guess the biggest risk would be that you click reveal, which has the kernel expose a password to the UI, and then the UI phones home with its entire raw contents.
- julian37 4y ago
  Surely the UI code is what responds to clicking "reveal" and therefore, if compromised, could fetch the secret even without a click?
  - 1123581321 4y ago
    Good point. I don’t know what 1Password could do to prevent the telemetry from issuing control commands to the rest of the app outside of trying to prevent malicious code from being checked in and deployed.
Animats 4y ago
> The worry about telemetry in a product like this is how it's implemented. Exactly. They are enlarging the attack surface of a security device. For their own benefit. One buffer overflow and there's a backdoor. That this is happening means their marketing people have more power than their security people. This is a very bad thing for a security company. Start migrating away from 1Password. Now.

1123581321 4y ago

They do separate the UI application from the kernel that manages access to the data. I guess the biggest risk would be that you click reveal, which has the kernel expose a password to the UI, and then the UI phones home with its entire raw contents.

julian37 4y ago
Surely the UI code is what responds to clicking "reveal" and therefore, if compromised, could fetch the secret even without a click?
- 1123581321 4y ago
  Good point. I don’t know what 1Password could do to prevent the telemetry from issuing control commands to the rest of the app outside of trying to prevent malicious code from being checked in and deployed.

Animats 4y ago

> The worry about telemetry in a product like this is how it's implemented. Exactly. They are enlarging the attack surface of a security device. For their own benefit. One buffer overflow and there's a backdoor. That this is happening means their marketing people have more power than their security people. This is a very bad thing for a security company. Start migrating away from 1Password. Now.