6 ms·

Privacy-preserving usage data: Under the hood

37 points by LopRabbit 3y ago

nifoc 3y ago
So it looks like they will be collecting PII (user_ipaddress) and they will also link these events to an account (account_uuid) and you just have to trust their "de-identification pipeline". Will be interesting to see if they roll this out in the EU (especially with the "Share analytics" box being checked by default).
- alphabettsy 3y ago
  Yes, and it doesn't seem necessary to collect, to begin with, to meet their intended goals.
- rlpb 3y ago
  The EU's GDPR only requires explicit consent for data collection for the purposes of the processing of data that is personally identifiable and there are exemptions such as for operational reasons. For example if you make an HTTPS request to my server then of course I have your IP address. It's what I do with that personally identifiable information that determines whether it requires explicit consent or not. For example if I only use it for the purposes of ensuring operational security and destroy access logs after some limited time, then explicit consent isn't required. Data collection for aggregate analysis that discards personally identifiable information in a non-recoverable way similarly does not require explicit consent. Sounds to me like what they say they're doing is compliant, does not require explicit consent under the GDPR anyway, and therefore whether or not the checkbox defaults to checked or not is moot from the point of view of the GDPR. I understand some people might not want to trust them, their processes or their competence regardless, but that's a matter that's outside the scope of the GDPR. The GDPR is about what they are doing and for what purposes, not whether you trust them.
- TZubiri 3y ago
  [flagged]
solardev 3y ago
I for one am glad they're doing this. There's a lot of UX stuff I wish they'd improve (random lockouts and desyncs, autofill not showing up in Android, no dedupe, no automatic discovery of app logins from saved web logins, etc.) The basic feature set already works great. I hope having more usage data will let them keep tweaking the product for users. Or they might just sell it all to data brokers. Who knows these days, lol.
- lapcat 3y ago
  > There's a lot of UX stuff I wish they'd improve (random lockouts and desyncs, autofill not showing up in Android, no dedupe, no automatic discovery of app logins from saved web logins, etc.) How does usage data fix this? Have you considered just sending them feature requests and bug reports?
  - solardev 3y ago
    Depending on the granularity, all those actions (if not intents) could be tracked. I've never really had feature requests acted on by a company before. Small one person software shops, yes, but companies? Never. I don't think their feature pipelines actually care what customers want.
    - jtbayly 3y ago
      If you don't think they care what their customers want (and I agree), then you better go back to the original question of whether this is a "good thing" or not. Why are they actually collecting the data, if they don't care what you want?
      - solardev 3y ago
        They probably want to sell it, primarily, or to help different internal teams decide what to focus resources on. But if some product owner in their org uses it to make even one improvement, it's worth it to me. I really don't mind them collecting usage data (heck, they don't even have to anonymize it for me) as long as my passwords remain encrypted. Edit: I mean, I trust this company with my entire online existence, including major financial and government functions. It's closed source and I take their word (and reputation) for it. Surely I can trust them to monitor which buttons I push...
m463 3y ago
Every tech company eventually erodes privacy. I'll bet this will erode security too.
jtbayly 3y ago
Wow. It looks like 1P is really trying to destroy my long love of their product. "Our telemetry system cannot, by design, have insight into the end-to-end encrypted data you store in 1Password." It can't by design... but can it by accident? And will they secretly change the design at the request of the CIA?
- panja 3y ago
  [flagged]
- avianlyric 3y ago
  Why are you worried about their analytics platform if your happily using their product today, which requires the use of 1Password cloud? 1Password don’t need to an analytics platform to steal your passwords. They could just straight up modify their client to send back your decrypted passwords to them. Analytics doesn’t make a jot of difference to the difficulty of doing that.
  - jtbayly 3y ago
    I'm unhappily using their product today, having still refused to update to v8. I still have local vaults. The point is, that they are wanting to intentionally collect data about me now. It's quite easy to see how that could be data that I don't want collected. Your question is like asking why it bothers me that all my neighbors have Ring doorbells now recording my walks, when they could just look out their window and spy on my anyway. It's a step along the slippery slope that makes the likelihood of privacy invasion much higher as time goes on. Ignore the CIA if you want, but I'm pretty sure they'll have an easier time collecting data they might want now that it exists. But leaving that to the side, collecting data accidentally is a known problem that keeps cropping up.
    - avianlyric 3y ago
      > I'm unhappily using their product today, having still refused to update to v8. I still have local vaults. Then this change doesn’t impact you. There’s no indication 1Password have any interest in back-porting analytics to older versions of 1Password. > Your question is like asking why it bothers me that all my neighbors have Ring doorbells now recording my walks… No, my question is quite simple. Either you trust the entire 1Password client or you don’t. Telemetry might change a persons stance on that trust, but holding up the boogy man CIA as reason for not liking telemetry is ridiculous. If the CIA could and wanted to force 1Password to hand over your encrypted data, then not having telemetry isn’t going to slow them down. If your argument is you don’t like telemetry, full stop. Then make that argument. Throwing in FUD about shady CIA activities does more to undermine your argument than strengthen it.
ycombinete 3y ago
Are there any compelling reasons to use 1password over Bitwarden? I really like Bitwarden (after moving from Lastpass) but haven’t tried 1Password. Am I missing out?
- Given_47 3y ago
  Yea I recently switched to bw as well and find it amazing
- upon_drumhead 3y ago
  I really don’t like BW. I use multiple vaults to split out specific categories of things. I have a vault per contract for example. I don’t want them all in a single vault.
throwawa14223 3y ago
Allowing me not to use their cloud would have been even more privacy preserving.
- geodel 3y ago
  So they are forcing you to use their product. Outrageous.
  - mehlmao 3y ago
    That was not a requirement when I first signed up.
    - dcow 3y ago
      Technically nothing is preventing you from maintaining your own reverse-engineered 1Password backend. You're even legally allowed to do so under US law. You just don't want to invest the time and effort. And neither does 1Password for the price you pay. Maybe it would be nice for them to offer a pricing tier where they make it easy for your to BYOB, but it doesn't seem to be a priority of theirs anymore and you can always switch to one of those open source apps that stores things locally if that's really a deal breaker.
      - evanb 3y ago
        The complaint is that there were already perfectly good 1Pw "backends" that didn't need any reverse engineering at all: wifi sync, and dropbox. But they took them away. The complaint is: why the fuck did they do that?
        dcow 3y ago
        Because not enough of their user base cared for it to be cost effective to maintain it. Would it have been nice for them to offer a pricing tier where you could pay to have offline backends? Sure. But whatever the case they decided that didn't make sense. So your options now are to talk with your legs or get over it.
neilv 3y ago
A month ago: 1Password rolling out “privacy-preserving” telemetry system (1password.com) 74 points by LopRabbit 34 days ago | 70 comments | https://news.ycombinator.com/item?id=36427299 https://news.ycombinator.com/item?id=36427299
- brycewray 3y ago
  FTFA: “We recently shared that we’ll soon be rolling out a privacy-preserving telemetry system that will help us improve 1Password by leveraging aggregated, de-identified usage data. Here we’ll share technical details about how this system works and the steps we’ve taken to protect customer privacy while engaging with the resulting data.”
  - neilv 3y ago
    The month-ago seems related.
    - brycewray 3y ago
      Yes, that was the item to which your link referred.
jorams 3y ago
> But why collect these data points in the first place? This heading is followed by several paragraphs that don't explain at all why they're collecting several of these data points. If the IP address is dropped in the de-identification pipeline, why is it stored in the "raw events"? If you don't need an exact timestamp, why are you storing it? Why does the app send all of this identifying data to be stored for 21 days instead of "de-identifying" it beforehand?
- ipsumlorem 3y ago
  That's what also annoyed me a bit so I just contacted them via the link in the bottom of the blog post: "Hey there, I just read the "under the hood" blog post about telemetry and have some questions. First of all, the section "But why collect these data points in the first place?" does not really answer the question. There is no explanation given about why e.g. IP-addresses are collected when, as by your schematics, they are never really used and completely anyway. So why store them in the first place, even if only for 21 days? Another question I have is, why the de-identification of some items takes place in your AWS environment instead of on device. For example, when talking about the IP-address, it is not used later on anyway. And the timestamp could easily be truncated by the batcher on device, couldn't it? Looking forward to hearing from you!"
  - ipsumlorem 3y ago
    Here's their response. Thanks for your thoughtful questions and for your patience as we connected with our engineers over the weekend. *Why are IP addresses collected?* Currently, IP addresses are an unavoidable part of the telemetry data process because the event transmission occurs over the TCP/IP protocol. The library we use as the web server automatically parses IP addresses from that transmission, but we've implemented a step to entirely remove that field from the data before it's processed for analytics. We currently don't require or desire IP information for telemetry; we’re early in our telemetry journey and will consider improving our handling of IP addresses as a future enhancement. *Why do we de-identify server-side rather than on the device?* De-identifying server-side allows us to enrich the raw event data with additional metadata elements that aren't stored on your device. These elements are non-identifying pieces of information like the type of account and whether or not the trial period is active. The entire server-side enrichment pipeline is hosted entirely within 1Password's own infrastructure. *Could the timestamp be truncated by the batcher on the device?* The timestamp being truncated on the device is possible – our primary concern here is the loss of visibility into latency in our pipeline. This can have a significant impact on data quality and understanding the health of our pipeline. Our goal as we roll this out is to provide transparency on how we prioritize customer privacy while building a better 1Password. We hope this helps answer some of your questions and we’re here to help if you have anything else you’d like to know.
snowstormsun 3y ago
Why store raw events for 21 days in an S3 buckets when you could hash all IDs cryptographically in-memory before they're persisted to any disk?
kylehotchkiss 3y ago
I was originally OK with some collection just to help their product team but seeing IP address, device ID, and account IDs makes this a massive nope for me. And I won’t change my mind on that even if they defensively drop them after seeing peoples feedback. I’ve paid for this app for nearly a decade and have been an adamant fan and user of their software. Why break my trust over something so stupid? I was expecting an apple-level privacy protection effort here. With so many paid users, there’s just no need to collect so many personal details to verify the legitimacy of data. 1pass - take a hint from apples privacy preserving photo scanning snafu last year - if you’re upsetting loyal users, take a step back, and rethink the system.

37 points by LopRabbit 3y ago

So it looks like they will be collecting PII (user_ipaddress) and they will also link these events to an account (account_uuid) and you just have to trust their "de-identification pipeline". Will be interesting to see if they roll this out in the EU (especially with the "Share analytics" box being checked by default).

alphabettsy 3y ago
Yes, and it doesn't seem necessary to collect, to begin with, to meet their intended goals.
rlpb 3y ago
The EU's GDPR only requires explicit consent for data collection for the purposes of the processing of data that is personally identifiable and there are exemptions such as for operational reasons. For example if you make an HTTPS request to my server then of course I have your IP address. It's what I do with that personally identifiable information that determines whether it requires explicit consent or not. For example if I only use it for the purposes of ensuring operational security and destroy access logs after some limited time, then explicit consent isn't required. Data collection for aggregate analysis that discards personally identifiable information in a non-recoverable way similarly does not require explicit consent. Sounds to me like what they say they're doing is compliant, does not require explicit consent under the GDPR anyway, and therefore whether or not the checkbox defaults to checked or not is moot from the point of view of the GDPR. I understand some people might not want to trust them, their processes or their competence regardless, but that's a matter that's outside the scope of the GDPR. The GDPR is about what they are doing and for what purposes, not whether you trust them.
TZubiri 3y ago
[flagged]

solardev 3y ago

I for one am glad they're doing this. There's a lot of UX stuff I wish they'd improve (random lockouts and desyncs, autofill not showing up in Android, no dedupe, no automatic discovery of app logins from saved web logins, etc.) The basic feature set already works great. I hope having more usage data will let them keep tweaking the product for users. Or they might just sell it all to data brokers. Who knows these days, lol.

lapcat 3y ago
> There's a lot of UX stuff I wish they'd improve (random lockouts and desyncs, autofill not showing up in Android, no dedupe, no automatic discovery of app logins from saved web logins, etc.) How does usage data fix this? Have you considered just sending them feature requests and bug reports?
- solardev 3y ago
  Depending on the granularity, all those actions (if not intents) could be tracked. I've never really had feature requests acted on by a company before. Small one person software shops, yes, but companies? Never. I don't think their feature pipelines actually care what customers want.
  - jtbayly 3y ago
    If you don't think they care what their customers want (and I agree), then you better go back to the original question of whether this is a "good thing" or not. Why are they actually collecting the data, if they don't care what you want?
    - solardev 3y ago
      They probably want to sell it, primarily, or to help different internal teams decide what to focus resources on. But if some product owner in their org uses it to make even one improvement, it's worth it to me. I really don't mind them collecting usage data (heck, they don't even have to anonymize it for me) as long as my passwords remain encrypted. Edit: I mean, I trust this company with my entire online existence, including major financial and government functions. It's closed source and I take their word (and reputation) for it. Surely I can trust them to monitor which buttons I push...

m463 3y ago

Every tech company eventually erodes privacy. I'll bet this will erode security too.

jtbayly 3y ago

Wow. It looks like 1P is really trying to destroy my long love of their product. "Our telemetry system cannot, by design, have insight into the end-to-end encrypted data you store in 1Password." It can't by design... but can it by accident? And will they secretly change the design at the request of the CIA?

panja 3y ago
[flagged]
avianlyric 3y ago
Why are you worried about their analytics platform if your happily using their product today, which requires the use of 1Password cloud? 1Password don’t need to an analytics platform to steal your passwords. They could just straight up modify their client to send back your decrypted passwords to them. Analytics doesn’t make a jot of difference to the difficulty of doing that.
- jtbayly 3y ago
  I'm unhappily using their product today, having still refused to update to v8. I still have local vaults. The point is, that they are wanting to intentionally collect data about me now. It's quite easy to see how that could be data that I don't want collected. Your question is like asking why it bothers me that all my neighbors have Ring doorbells now recording my walks, when they could just look out their window and spy on my anyway. It's a step along the slippery slope that makes the likelihood of privacy invasion much higher as time goes on. Ignore the CIA if you want, but I'm pretty sure they'll have an easier time collecting data they might want now that it exists. But leaving that to the side, collecting data accidentally is a known problem that keeps cropping up.
  - avianlyric 3y ago
    > I'm unhappily using their product today, having still refused to update to v8. I still have local vaults. Then this change doesn’t impact you. There’s no indication 1Password have any interest in back-porting analytics to older versions of 1Password. > Your question is like asking why it bothers me that all my neighbors have Ring doorbells now recording my walks… No, my question is quite simple. Either you trust the entire 1Password client or you don’t. Telemetry might change a persons stance on that trust, but holding up the boogy man CIA as reason for not liking telemetry is ridiculous. If the CIA could and wanted to force 1Password to hand over your encrypted data, then not having telemetry isn’t going to slow them down. If your argument is you don’t like telemetry, full stop. Then make that argument. Throwing in FUD about shady CIA activities does more to undermine your argument than strengthen it.

ycombinete 3y ago

Are there any compelling reasons to use 1password over Bitwarden? I really like Bitwarden (after moving from Lastpass) but haven’t tried 1Password. Am I missing out?

Given_47 3y ago
Yea I recently switched to bw as well and find it amazing
upon_drumhead 3y ago
I really don’t like BW. I use multiple vaults to split out specific categories of things. I have a vault per contract for example. I don’t want them all in a single vault.

throwawa14223 3y ago

Allowing me not to use their cloud would have been even more privacy preserving.

geodel 3y ago
So they are forcing you to use their product. Outrageous.
- mehlmao 3y ago
  That was not a requirement when I first signed up.
  - dcow 3y ago
    Technically nothing is preventing you from maintaining your own reverse-engineered 1Password backend. You're even legally allowed to do so under US law. You just don't want to invest the time and effort. And neither does 1Password for the price you pay. Maybe it would be nice for them to offer a pricing tier where they make it easy for your to BYOB, but it doesn't seem to be a priority of theirs anymore and you can always switch to one of those open source apps that stores things locally if that's really a deal breaker.
    - evanb 3y ago
      The complaint is that there were already perfectly good 1Pw "backends" that didn't need any reverse engineering at all: wifi sync, and dropbox. But they took them away. The complaint is: why the fuck did they do that?
      - dcow 3y ago
        Because not enough of their user base cared for it to be cost effective to maintain it. Would it have been nice for them to offer a pricing tier where you could pay to have offline backends? Sure. But whatever the case they decided that didn't make sense. So your options now are to talk with your legs or get over it.

neilv 3y ago

A month ago: 1Password rolling out “privacy-preserving” telemetry system (1password.com) 74 points by LopRabbit 34 days ago | 70 comments | https://news.ycombinator.com/item?id=36427299 https://news.ycombinator.com/item?id=36427299

brycewray 3y ago
FTFA: “We recently shared that we’ll soon be rolling out a privacy-preserving telemetry system that will help us improve 1Password by leveraging aggregated, de-identified usage data. Here we’ll share technical details about how this system works and the steps we’ve taken to protect customer privacy while engaging with the resulting data.”
- neilv 3y ago
  The month-ago seems related.
  - brycewray 3y ago
    Yes, that was the item to which your link referred.

jorams 3y ago

> But why collect these data points in the first place? This heading is followed by several paragraphs that don't explain at all why they're collecting several of these data points. If the IP address is dropped in the de-identification pipeline, why is it stored in the "raw events"? If you don't need an exact timestamp, why are you storing it? Why does the app send all of this identifying data to be stored for 21 days instead of "de-identifying" it beforehand?

ipsumlorem 3y ago
That's what also annoyed me a bit so I just contacted them via the link in the bottom of the blog post: "Hey there, I just read the "under the hood" blog post about telemetry and have some questions. First of all, the section "But why collect these data points in the first place?" does not really answer the question. There is no explanation given about why e.g. IP-addresses are collected when, as by your schematics, they are never really used and completely anyway. So why store them in the first place, even if only for 21 days? Another question I have is, why the de-identification of some items takes place in your AWS environment instead of on device. For example, when talking about the IP-address, it is not used later on anyway. And the timestamp could easily be truncated by the batcher on device, couldn't it? Looking forward to hearing from you!"
- ipsumlorem 3y ago
  Here's their response. Thanks for your thoughtful questions and for your patience as we connected with our engineers over the weekend. *Why are IP addresses collected?* Currently, IP addresses are an unavoidable part of the telemetry data process because the event transmission occurs over the TCP/IP protocol. The library we use as the web server automatically parses IP addresses from that transmission, but we've implemented a step to entirely remove that field from the data before it's processed for analytics. We currently don't require or desire IP information for telemetry; we’re early in our telemetry journey and will consider improving our handling of IP addresses as a future enhancement. *Why do we de-identify server-side rather than on the device?* De-identifying server-side allows us to enrich the raw event data with additional metadata elements that aren't stored on your device. These elements are non-identifying pieces of information like the type of account and whether or not the trial period is active. The entire server-side enrichment pipeline is hosted entirely within 1Password's own infrastructure. *Could the timestamp be truncated by the batcher on the device?* The timestamp being truncated on the device is possible – our primary concern here is the loss of visibility into latency in our pipeline. This can have a significant impact on data quality and understanding the health of our pipeline. Our goal as we roll this out is to provide transparency on how we prioritize customer privacy while building a better 1Password. We hope this helps answer some of your questions and we’re here to help if you have anything else you’d like to know.

snowstormsun 3y ago

Why store raw events for 21 days in an S3 buckets when you could hash all IDs cryptographically in-memory before they're persisted to any disk?

kylehotchkiss 3y ago

I was originally OK with some collection just to help their product team but seeing IP address, device ID, and account IDs makes this a massive nope for me. And I won’t change my mind on that even if they defensively drop them after seeing peoples feedback. I’ve paid for this app for nearly a decade and have been an adamant fan and user of their software. Why break my trust over something so stupid? I was expecting an apple-level privacy protection effort here. With so many paid users, there’s just no need to collect so many personal details to verify the legitimacy of data. 1pass - take a hint from apples privacy preserving photo scanning snafu last year - if you’re upsetting loyal users, take a step back, and rethink the system.