Item — HN Reader

Telemetry in a "trust us, this closed-source application which contains all your secrets, which we provide you and which we update periodically, is only contacting us for "privacy protecting telemetry" and not exfiltration, intentionally or not, of your most sensitive of all data" application is a hard pass for me. This seems like an IQ test kind of question.

(So many times error reporting, etc. have accidentally leaked highly sensitive data, which was then the source of a major compromise, in other systems. Maybe 1Password won't get it wrong, maybe 1Password will never be subject to any pressure to get it wrong...)

5 comments

Imagine for a minute that you have a hammer. This hammer is a very useful tool and you have never had a problem with it. You don't know what is in the hammer -- could be steel, could be titanium, could be uranium (you're not a scientist!) -- but you know that it has always worked for you. Your experience with the hammer is so positive, you would buy another hammer from the company again, without question.

One day, the company that makes this hammer says that they will be updating it to automatically tell the company a bunch of information about the hammer's use -- when it's used, where it's used, what the environment is like around the hammer, how many times it's used, what it's used for. They assure you that they don't care about who is using the hammer, but obviously it will be YOUR hammer reporting the information, so at some level it will be associated with you.

Why are they doing this? Well, they know that sometimes their hammers break. They only know this, though, because sometimes their hammers break for their own employees and sometimes customers tell them hammers break. They would really like to know ALL the times their hammers break, though, so that can try to fix all the problems with their hammers, and not just the ones they see or get reported to them. They say this will be best for their customers and that's why customers should be on board with the change.

No one would ever buy that hammer again, right?

Regardless of the privacy implications of the company knowing everything about your usage of the hammer, the company is basically saying that their hammers break so much that many of their customers don't bother telling them and just go use someone's hammer. In other words, their product is bad and their customers don't value it enough to deal with it.

Don't even get me started on paying monthly for that hammer ...

> No one would ever buy that hammer again, right?

I think you came to the wrong conclusion. Lots of people might still buy the hammer, and lots of people might knowingly buy the hammer, and even more, lots of people might knowingly buy the hammer and like that the hammer is being fixed when it breaks. I honestly don't understand why so many people oppose telemetry, especially when it's anonymous.

Can you imagine why someone might not want software containing their passwords and credit cards to stream data to a central server under the control of whoever wrote that software?

You could say the same about any piece of software. In the end it's about the implementation. If they don't segregate their data, then they don't, doesn't matter what software it is. In the end you'd have to trust them just as you trust them to store your credit cards and passwords. If you don't trust them with telemetry, you presumably don't trust them with storing sensitive data and thus shouldn't use their product.

Because it is nearly impossible for it to be truly anonymous.

> No one would ever buy that hammer again, right?

I mean, you might not, but I don't see telemetry as such an evil. It does help make the product better. So "no one" is a bit too strong here, try "no one with my mindset" ;)

Hum, no.

I had this belief before, that it helps makes the product better.

But I realized that telemetry is used against us. It helps the company push their own agenda, and manipulate the user.

For example, I'm used to update my Android apps manually. Google made it more and more difficult, version by version, to access the corresponding screen in the Google play app, in order to push for auto-update. They analyzed this through telemetry.

Sometimes makes product better for customer. Most of the time makes product worse for customer but increases monetization.

I use 1password and generally like it. Their moves towards typical Product Owner monetization BS has me starting to look to other options.

Until "No one would ever buy that hammer again, right?" I genuinely thought you were making a pro telemetry argument.

Without telemetry it is a closed-source application that contains all your secrets, is updated periodically, and is already storing encrypted copies of all your secrets on their servers. If they wanted to intentionally exfiltrate your data they could already do it easily.

I don't see how adding telemetry makes any significant difference.

The version I use(d) doesn’t connect to their servers, it stores a local password vault, and uses WebDAV to sync. I mostly moved away from passwords, and moved important passwords to a different system (Bitwarden/vaultwarden), but still kept random low value/legacy stuff in 1Password, which is why I am annoyed vs merely disappointed by their product changes.

Especially since it's operated from a Five Eyes country.

The problem is its always been there. Telemetry provides more noise to hide exfiltration of sensitive data, but the risk has always been there from the start for the reasons you laid out.

It's a closed source product in a surveilence heavy country. Telemetry or not, it's risky.

If they were going to "de-identify" the data for their telemetry, then I'd need to see some rigorous mathematical proof of it, to have any trust in their promises. You will eventually compromise the individual datapoints in a dataset, given enough queries. There is in fact a field of research that specifically studies just this. The PMs at 1password haven't done their homework, they're just waving their hands, and it is worrying for users.

The default for anything in that setting should be that phoning out (or trying to do so) is qualified as a security incident. Especially if it happens right after you've entered your credentials.

Yeah, LittleSnitch helps with that.

I’d be fine with telemetry if it recorded locally in a way which was fully inspectable and human readable and which I could send IFF I wanted to, but with a password manager I’d be scared even of just a long list of events; passwords and keys themselves are so low entropy vs long lists that you could easily encode something…

That's exactly why I never use any password managers, I don't trust any of them as: passwords are supposed to known by the owner only but by using a password manager, they were voluntarily surrendered to 3rd parties only god know whether they are trust worth or not.