Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password to Add Telemetry

blog.1password.com

Post reply on HN
Print view View original

31–40 of 353 posts

Re: 1Password to Add Telemetry

#31

Post by marcosdumay »

ninkendo wrote: post #23
wootland wrote: post #13

Opt-out telemetry is unacceptable, this also signals that the product team has no vision and the organization is riddled with bureaucracy. Great products get built by someone with a vision to create them, mediocre products gets created by product managers justifying their positions with data they've gleaned by spying on users.

100% agreement from me. People have trouble believing this, but software existed before telemetry existed. We didn’t have trouble understanding where user pain points were back then, because we actually performed user studies, and offered the ability for users to provide feedback if they wanted to. The field of UX wasn’t born the moment someone wrote the first telemetry library.

> We didn’t have trouble understanding where user pain points were back then

If anything, people seem to have much more difficulty understanding user pain points right now.

Re: 1Password to Add Telemetry

#32

Post by ValentineC »

hammyhavoc wrote: post #6
nikanj wrote: post #3

After taking in ridiculous amounts of money, they must figure out what features are most crucial for users – so that those features can be monetized the hardest

Or so they can ditch lesser used features to eliminate technical debt.

Relevant xkcd: https://xkcd.com/1172/

Re: 1Password to Add Telemetry

#33

Post by abigail95 »

wootland wrote: post #16
danpalmer wrote: post #7

Telemetry to inform product decisions is fine, in fact I think it's necessary to have confidence that software is performing in the wild (e.g. crash reporting), or that customers know how to use it. What is not ok is opt-out telemetry for personalisation for advertising, or over-reaching personal data collection, in 1Password's case data from your vault. There is however a grey area in the middle – data about the per…

> What is not ok is opt-out telemetry for personalisation for advertising Opt-out telemetry is also not ok for product decisions. It's a dark pattern that shows no respect for user privacy.

What's the difference between telemetry from the client side, and aggregate logs of server api endpoints?

Assume no PII, what's the difference? What do you mean by dark pattern?

Re: 1Password to Add Telemetry

#34

Post by flinner »

dijit wrote: post #19
AlexandrB wrote: post #15

Earlier quoted context omitted.

> If you already trust 1password to store your credentials I don't, so I'm never upgrading to 1Password 8. The telemetry news only validates my decision. What I consider important in a security product and what AgileBits considers important diverged a while ago and that's ok I guess.

1password 8 definitely feels like a massive UX downgrade over v7. Though I can’t put why into words.

The latest version seems optimized for keyboard shortcuts at the expense of easily accessible 1-click copying of username/password/one-time password. To me, this introduced a large additional cognitive load where instead of a click, click, click, I now have to remember that CMD+C is username, CMD+Shift+C is password, and (something else?) for One-Time Password.

Re: 1Password to Add Telemetry

#36

Post by kitsunesoba »

dijit wrote: post #19
AlexandrB wrote: post #15

Earlier quoted context omitted.

> If you already trust 1password to store your credentials I don't, so I'm never upgrading to 1Password 8. The telemetry news only validates my decision. What I consider important in a security product and what AgileBits considers important diverged a while ago and that's ok I guess.

1password 8 definitely feels like a massive UX downgrade over v7. Though I can’t put why into words.

I think it's that v8 feels less an app crafted for individuals and more like yet another generic SaaS made for corporate customers.

Re: 1Password to Add Telemetry

#37

Post by favorited »

nickvanw wrote: post #5

I have my issues with what 1Password has become as a product, but this seems like a very good stance to take. As a product owner, it's essential to know what and how people are using the product, collecting some straightforward telemetry that's anonymized and doesn't contain and Vault data strikes me as reasonable.

If it is so essential, how have they been so successful since 1P was released nearly 20 years ago?

Re: 1Password to Add Telemetry

#38

Post by tptacek »

The only reason we're talking about this is that 1Password wrote a blog post about it. They're not dumb, they know that this is the reaction they can expect from a blog post about how they're doing telemetry. They compete with a raft of products that not only use telemetry, but do it sneakily and with SAAS vendors that add attack surface to their products. But nobody talks about telemetry in those products, because those vendors don't want to have the conversation.

Re: 1Password to Add Telemetry

#39

Post by pinkcan »

dijit wrote: post #19
AlexandrB wrote: post #15

Earlier quoted context omitted.

> If you already trust 1password to store your credentials I don't, so I'm never upgrading to 1Password 8. The telemetry news only validates my decision. What I consider important in a security product and what AgileBits considers important diverged a while ago and that's ok I guess.

1password 8 definitely feels like a massive UX downgrade over v7. Though I can’t put why into words.

it's no longer a native app

Re: 1Password to Add Telemetry

#40

Post by 1123581321 »

TechBro8615 wrote: post #12
danpalmer wrote: post #7

Telemetry to inform product decisions is fine, in fact I think it's necessary to have confidence that software is performing in the wild (e.g. crash reporting), or that customers know how to use it. What is not ok is opt-out telemetry for personalisation for advertising, or over-reaching personal data collection, in 1Password's case data from your vault. There is however a grey area in the middle – data about the per…

The worry about telemetry in a product like this is how it's implemented. It's more code that could have bugs in it. What assurances do we have that it will execute safely in a way that it can't possibly access the password database, even in the event of (for example) compromise of the CI pipeline that builds the telemetry SDK? > No customer vault data can be seen or collected. We’re only interested in how people use…

They do separate the UI application from the kernel that manages access to the data. I guess the biggest risk would be that you click reveal, which has the kernel expose a password to the UI, and then the UI phones home with its entire raw contents.
Post reply on HN