6 ms·

Telemetry in a "trust us, this closed-source application which contains all your secrets, which we provide you and which we update periodically, is only contact

by rdl 3y ago

Telemetry in a "trust us, this closed-source application which contains all your secrets, which we provide you and which we update periodically, is only contacting us for "privacy protecting telemetry" and not exfiltration, intentionally or not, of your most sensitive of all data" application is a hard pass for me. This seems like an IQ test kind of question. (So many times error reporting, etc. have accidentally leaked highly sensitive data, which was then the source of a major compromise, in other systems. Maybe 1Password won't get it wrong, maybe 1Password will never be subject to any pressure to get it wrong...)

hrunt 3y ago
Imagine for a minute that you have a hammer. This hammer is a very useful tool and you have never had a problem with it. You don't know what is in the hammer -- could be steel, could be titanium, could be uranium (you're not a scientist!) -- but you know that it has always worked for you. Your experience with the hammer is so positive, you would buy another hammer from the company again, without question. One day, the company that makes this hammer says that they will be updating it to automatically tell the company a bunch of information about the hammer's use -- when it's used, where it's used, what the environment is like around the hammer, how many times it's used, what it's used for. They assure you that they don't care about who is using the hammer, but obviously it will be YOUR hammer reporting the information, so at some level it will be associated with you. Why are they doing this? Well, they know that sometimes their hammers break. They only know this, though, because sometimes their hammers break for their own employees and sometimes customers tell them hammers break. They would really like to know ALL the times their hammers break, though, so that can try to fix all the problems with their hammers, and not just the ones they see or get reported to them. They say this will be best for their customers and that's why customers should be on board with the change. No one would ever buy that hammer again, right? Regardless of the privacy implications of the company knowing everything about your usage of the hammer, the company is basically saying that their hammers break so much that many of their customers don't bother telling them and just go use someone's hammer. In other words, their product is bad and their customers don't value it enough to deal with it. Don't even get me started on paying monthly for that hammer ...
- unpopular42 3y ago
  > No one would ever buy that hammer again, right? I mean, you might not, but I don't see telemetry as such an evil. It does help make the product better. So "no one" is a bit too strong here, try "no one with my mindset" ;)
  - dismalpedigree 3y ago
    Sometimes makes product better for customer. Most of the time makes product worse for customer but increases monetization. I use 1password and generally like it. Their moves towards typical Product Owner monetization BS has me starting to look to other options.
  - mrfumier 3y ago
    Hum, no. I had this belief before, that it helps makes the product better. But I realized that telemetry is used against us. It helps the company push their own agenda, and manipulate the user. For example, I'm used to update my Android apps manually. Google made it more and more difficult, version by version, to access the corresponding screen in the Google play app, in order to push for auto-update. They analyzed this through telemetry.
- satvikpendem 3y ago
  > No one would ever buy that hammer again, right? I think you came to the wrong conclusion. Lots of people might still buy the hammer, and lots of people might knowingly buy the hammer, and even more, lots of people might knowingly buy the hammer and like that the hammer is being fixed when it breaks. I honestly don't understand why so many people oppose telemetry, especially when it's anonymous.
  - deleted 3y ago
    [deleted]
  - JonChesterfield 3y ago
    Can you imagine why someone might not want software containing their passwords and credit cards to stream data to a central server under the control of whoever wrote that software?
abigail95 3y ago
Especially since it's operated from a Five Eyes country. The problem is its always been there. Telemetry provides more noise to hide exfiltration of sensitive data, but the risk has always been there from the start for the reasons you laid out. It's a closed source product in a surveilence heavy country. Telemetry or not, it's risky.
- lambdasquirrel 3y ago
  If they were going to "de-identify" the data for their telemetry, then I'd need to see some rigorous mathematical proof of it, to have any trust in their promises. You will eventually compromise the individual datapoints in a dataset, given enough queries. There is in fact a field of research that specifically studies just this. The PMs at 1password haven't done their homework, they're just waving their hands, and it is worrying for users.
tzs 3y ago
Without telemetry it is a closed-source application that contains all your secrets, is updated periodically, and is already storing encrypted copies of all your secrets on their servers. If they wanted to intentionally exfiltrate your data they could already do it easily. I don't see how adding telemetry makes any significant difference.
- rdl 3y ago
  The version I use(d) doesn’t connect to their servers, it stores a local password vault, and uses WebDAV to sync. I mostly moved away from passwords, and moved important passwords to a different system (Bitwarden/vaultwarden), but still kept random low value/legacy stuff in 1Password, which is why I am annoyed vs merely disappointed by their product changes.
jacquesm 3y ago
The default for anything in that setting should be that phoning out (or trying to do so) is qualified as a security incident. Especially if it happens right after you've entered your credentials.
- rdl 3y ago
  Yeah, LittleSnitch helps with that. I’d be fine with telemetry if it recorded locally in a way which was fully inspectable and human readable and which I could send IFF I wanted to, but with a password manager I’d be scared even of just a long list of events; passwords and keys themselves are so low entropy vs long lists that you could easily encode something…
mrjin 3y ago
That's exactly why I never use any password managers, I don't trust any of them as: passwords are supposed to known by the owner only but by using a password manager, they were voluntarily surrendered to 3rd parties only god know whether they are trust worth or not.

by rdl 3y ago

hrunt 3y ago

Imagine for a minute that you have a hammer. This hammer is a very useful tool and you have never had a problem with it. You don't know what is in the hammer -- could be steel, could be titanium, could be uranium (you're not a scientist!) -- but you know that it has always worked for you. Your experience with the hammer is so positive, you would buy another hammer from the company again, without question. One day, the company that makes this hammer says that they will be updating it to automatically tell the company a bunch of information about the hammer's use -- when it's used, where it's used, what the environment is like around the hammer, how many times it's used, what it's used for. They assure you that they don't care about who is using the hammer, but obviously it will be YOUR hammer reporting the information, so at some level it will be associated with you. Why are they doing this? Well, they know that sometimes their hammers break. They only know this, though, because sometimes their hammers break for their own employees and sometimes customers tell them hammers break. They would really like to know ALL the times their hammers break, though, so that can try to fix all the problems with their hammers, and not just the ones they see or get reported to them. They say this will be best for their customers and that's why customers should be on board with the change. No one would ever buy that hammer again, right? Regardless of the privacy implications of the company knowing everything about your usage of the hammer, the company is basically saying that their hammers break so much that many of their customers don't bother telling them and just go use someone's hammer. In other words, their product is bad and their customers don't value it enough to deal with it. Don't even get me started on paying monthly for that hammer ...

unpopular42 3y ago
> No one would ever buy that hammer again, right? I mean, you might not, but I don't see telemetry as such an evil. It does help make the product better. So "no one" is a bit too strong here, try "no one with my mindset" ;)
- dismalpedigree 3y ago
  Sometimes makes product better for customer. Most of the time makes product worse for customer but increases monetization. I use 1password and generally like it. Their moves towards typical Product Owner monetization BS has me starting to look to other options.
- mrfumier 3y ago
  Hum, no. I had this belief before, that it helps makes the product better. But I realized that telemetry is used against us. It helps the company push their own agenda, and manipulate the user. For example, I'm used to update my Android apps manually. Google made it more and more difficult, version by version, to access the corresponding screen in the Google play app, in order to push for auto-update. They analyzed this through telemetry.
satvikpendem 3y ago
> No one would ever buy that hammer again, right? I think you came to the wrong conclusion. Lots of people might still buy the hammer, and lots of people might knowingly buy the hammer, and even more, lots of people might knowingly buy the hammer and like that the hammer is being fixed when it breaks. I honestly don't understand why so many people oppose telemetry, especially when it's anonymous.
- deleted 3y ago
  [deleted]
- JonChesterfield 3y ago
  Can you imagine why someone might not want software containing their passwords and credit cards to stream data to a central server under the control of whoever wrote that software?

abigail95 3y ago

Especially since it's operated from a Five Eyes country. The problem is its always been there. Telemetry provides more noise to hide exfiltration of sensitive data, but the risk has always been there from the start for the reasons you laid out. It's a closed source product in a surveilence heavy country. Telemetry or not, it's risky.

lambdasquirrel 3y ago
If they were going to "de-identify" the data for their telemetry, then I'd need to see some rigorous mathematical proof of it, to have any trust in their promises. You will eventually compromise the individual datapoints in a dataset, given enough queries. There is in fact a field of research that specifically studies just this. The PMs at 1password haven't done their homework, they're just waving their hands, and it is worrying for users.

tzs 3y ago

Without telemetry it is a closed-source application that contains all your secrets, is updated periodically, and is already storing encrypted copies of all your secrets on their servers. If they wanted to intentionally exfiltrate your data they could already do it easily. I don't see how adding telemetry makes any significant difference.

rdl 3y ago
The version I use(d) doesn’t connect to their servers, it stores a local password vault, and uses WebDAV to sync. I mostly moved away from passwords, and moved important passwords to a different system (Bitwarden/vaultwarden), but still kept random low value/legacy stuff in 1Password, which is why I am annoyed vs merely disappointed by their product changes.

jacquesm 3y ago

The default for anything in that setting should be that phoning out (or trying to do so) is qualified as a security incident. Especially if it happens right after you've entered your credentials.

rdl 3y ago
Yeah, LittleSnitch helps with that. I’d be fine with telemetry if it recorded locally in a way which was fully inspectable and human readable and which I could send IFF I wanted to, but with a password manager I’d be scared even of just a long list of events; passwords and keys themselves are so low entropy vs long lists that you could easily encode something…

mrjin 3y ago

That's exactly why I never use any password managers, I don't trust any of them as: passwords are supposed to known by the owner only but by using a password manager, they were voluntarily surrendered to 3rd parties only god know whether they are trust worth or not.