4 ms·

Ahh yes, a feature every user wishes to have in a sensitive, critical, local encryption tool - something that silently exfiltrates data to the manufacturer. Th

by sneak 3y ago

Ahh yes, a feature every user wishes to have in a sensitive, critical, local encryption tool - something that silently exfiltrates data to the manufacturer. The only way it preserves privacy is if it defaults to off. Anything else is a lie in service of a fraud.

sreetamdas 3y ago
Looks like they've reversed their earlier decision and it will now be opt-in: > You’ll see this message when you open 1Password on mobile and desktop when it’s time for you to choose whether you would like to participate [...] The choice to share your data is yours. We won’t collect anything unless you’ve confirmed you’re happy to share in-app usage data moving forward.
semiquaver 3y ago
The post says that it does default to off: > Later this summer, you’ll see the option to participate in our telemetry system and help improve 1Password. You don’t need to take any action right now, and we won’t collect any usage data without your awareness and consent first. Developing modern software without being able to observe its operation is simply not realistic. Telemetry of this sort is an important driver of software quality and product improvement. I’m convinced that people who talk this way are not recognizing the important distinctions between google-analytics-style tracking software that is just trying to squeeze more money out of users and observability-style tracking that is a key part of the software development lifecycle. If you refuse to acknowledge any value in the latter then you deserve the buggy software that results.
- sneak 3y ago
  > Developing modern software without being able to observe its operation is simply not realistic. Go manages to do it, as does Linux, and Debian. I think this sort of thinking is poisonous. Just because it is common does not make it ethical or justified.
  - manfre 3y ago
    Discussion of Go toolchain wanting to add telemetry for these same reasons. This casts doubts on how well they're managing to do it. https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
    - sneak 3y ago
      They concluded (correctly) that opt-in was the only reasonable approach.
      - semiquaver 3y ago
        Be careful you don’t hurt yourself moving those goalposts.
  - charcircuit 3y ago
    >as does Linux Linux has a lot of telemetry features which businesses can use to aggregate data on how it is operating. These businesses if they identify problems submit patches to fix them. >and Debian Debian has telemtry on what packages people install. https://popcon.debian.org/ https://popcon.debian.org/
- hn_throwaway_99 3y ago
  It's like "how did we ever build functional products without the ability to spy on you all the time??" I don't disagree that telemetry is ubiquitous in modern software and pretty much built into modern software dev lifecycles, but it's not like we didn't build lots of capable software before this was the case. Heck, 1Password itself seemed to be doing fine without any telemetry in the past. The point people are making is that the one place you probably don't want telemetry software is your system critical password manager. There is a lot of potential for an "oopsie" where something accidentally gets sent that shouldn't get sent, and that's what people have an issue with.
  - semiquaver 3y ago
    Lots of people on this very forum have bitterly complained about a supposed major drop in product quality for 1Password since their relatively recent adoption of a cross-platform electron app.
pfych 3y ago
The actual post mentions the following: > We’ve designed our telemetry system to collect data on “events”. An event is essentially an action, like: Finishing our in-app onboarding, Unlocking 1Password, Creating a new item, Filling an item in a website or app. > We won’t be collecting your saved passwords, passkeys, usernames, and any URLs associated with your items. Your private information is just that – private. With it also being opt-in I dont see an issue with collecting basic numbers for how often people use the plugin or app, as long as they're telling the truth, I think it's fine.
- sneak 3y ago
  The issue is that the data doesn't belong to the vendor - it belongs to the user. It doesn't matter that you don't personally regard it as sensitive. Also due to things like lack of ESNI and lack of onion routing to obscure client IP address, it leaks other information to the vendor and ISP like your travel history over time (via client IP geolocation) and waking/sleeping/working hours. Software that exfiltrates this information without advance consent is stealing it.
  - semiquaver 3y ago
    We are talking about a network-connected paid service. It’s revealing your IP address to the company that provides the service by its natural operation, such as synchronizing passwords between devices over the network. > Software that exfiltrates this information without advance consent is stealing it. I’m not sure who you are arguing with when you keep repeating this. I pointed out that the post clearly states they will obtain this consent. At any rate, you are obviously not a customer so why are you so mad?
  - charcircuit 3y ago
    >the data doesn't belong to the vendor - it belongs to the user The data doesn't belong to anyone. The data is just a fact of what happened. No one owns the fact that George Washington was the first US president.
    - dns_snek 3y ago

by sneak 3y ago

sreetamdas 3y ago

Looks like they've reversed their earlier decision and it will now be opt-in: > You’ll see this message when you open 1Password on mobile and desktop when it’s time for you to choose whether you would like to participate [...] The choice to share your data is yours. We won’t collect anything unless you’ve confirmed you’re happy to share in-app usage data moving forward.

semiquaver 3y ago

The post says that it does default to off: > Later this summer, you’ll see the option to participate in our telemetry system and help improve 1Password. You don’t need to take any action right now, and we won’t collect any usage data without your awareness and consent first. Developing modern software without being able to observe its operation is simply not realistic. Telemetry of this sort is an important driver of software quality and product improvement. I’m convinced that people who talk this way are not recognizing the important distinctions between google-analytics-style tracking software that is just trying to squeeze more money out of users and observability-style tracking that is a key part of the software development lifecycle. If you refuse to acknowledge any value in the latter then you deserve the buggy software that results.

sneak 3y ago
> Developing modern software without being able to observe its operation is simply not realistic. Go manages to do it, as does Linux, and Debian. I think this sort of thinking is poisonous. Just because it is common does not make it ethical or justified.
- manfre 3y ago
  Discussion of Go toolchain wanting to add telemetry for these same reasons. This casts doubts on how well they're managing to do it. https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
  - sneak 3y ago
    They concluded (correctly) that opt-in was the only reasonable approach.
    - semiquaver 3y ago
      Be careful you don’t hurt yourself moving those goalposts.
- charcircuit 3y ago
  >as does Linux Linux has a lot of telemetry features which businesses can use to aggregate data on how it is operating. These businesses if they identify problems submit patches to fix them. >and Debian Debian has telemtry on what packages people install. https://popcon.debian.org/ https://popcon.debian.org/
hn_throwaway_99 3y ago
It's like "how did we ever build functional products without the ability to spy on you all the time??" I don't disagree that telemetry is ubiquitous in modern software and pretty much built into modern software dev lifecycles, but it's not like we didn't build lots of capable software before this was the case. Heck, 1Password itself seemed to be doing fine without any telemetry in the past. The point people are making is that the one place you probably don't want telemetry software is your system critical password manager. There is a lot of potential for an "oopsie" where something accidentally gets sent that shouldn't get sent, and that's what people have an issue with.
- semiquaver 3y ago
  Lots of people on this very forum have bitterly complained about a supposed major drop in product quality for 1Password since their relatively recent adoption of a cross-platform electron app.

pfych 3y ago

The actual post mentions the following: > We’ve designed our telemetry system to collect data on “events”. An event is essentially an action, like: Finishing our in-app onboarding, Unlocking 1Password, Creating a new item, Filling an item in a website or app. > We won’t be collecting your saved passwords, passkeys, usernames, and any URLs associated with your items. Your private information is just that – private. With it also being opt-in I dont see an issue with collecting basic numbers for how often people use the plugin or app, as long as they're telling the truth, I think it's fine.

sneak 3y ago
The issue is that the data doesn't belong to the vendor - it belongs to the user. It doesn't matter that you don't personally regard it as sensitive. Also due to things like lack of ESNI and lack of onion routing to obscure client IP address, it leaks other information to the vendor and ISP like your travel history over time (via client IP geolocation) and waking/sleeping/working hours. Software that exfiltrates this information without advance consent is stealing it.
- semiquaver 3y ago
  We are talking about a network-connected paid service. It’s revealing your IP address to the company that provides the service by its natural operation, such as synchronizing passwords between devices over the network. > Software that exfiltrates this information without advance consent is stealing it. I’m not sure who you are arguing with when you keep repeating this. I pointed out that the post clearly states they will obtain this consent. At any rate, you are obviously not a customer so why are you so mad?
- charcircuit 3y ago
  >the data doesn't belong to the vendor - it belongs to the user The data doesn't belong to anyone. The data is just a fact of what happened. No one owns the fact that George Washington was the first US president.
  - dns_snek 3y ago