Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password to Add Telemetry

blog.1password.com

Post reply on HN
Print view View original

261–270 of 353 posts

Re: 1Password to Add Telemetry

#261

Post by closewith »

abigail95 wrote: post #74
JohnFen wrote: post #54

Earlier quoted context omitted.

> Anomyous telemetry is not PII. That depends. First, no data collection is "anonymous" when it is transmitted. Any anonymity must come later, and then is only possible if the company aggregates the data with other users and deletes the original data that was collected. PII/Personal Data are squishy terms. In the US, anyway, the legal definitions of what counts as "PII" leaves out an awful lot of actual PII -- so any…

> First, no data collection is "anonymous" Because no network connection is anonymous but as long as you aren't handling PII, GDPR has nothing to say about it. I could sell an app in the EU that just pinged my server once a day. As long as I wasn't keeping a record of who pinged what when, there is no PII. Otherwise everything is PII and you would need consent before every TCP handshake.

No, IP address is personal data by the EU definition and you need a legal basis to process it. The strictly necessary legal basis allows for TCP connections required to provide the requested service.

It is clear that the EU does not consider telemetry to be strictly necessary and while there can be times when telemetry is allowable with the legitimate interest legal basis (for example, to prevent fraud or to comply with legal obligations), there is already plenty of case law across the EU that shows that the legitimate interest legal basis will not be accepted for user analytics.

For this reason, it seems unlikely that the proposed telemetry will be compliant in the EU.

Re: 1Password to Add Telemetry

#262

Post by torstenvl »

kspacewalk2 wrote: post #149
torstenvl wrote: post #141

Users: We want standalone non-subscription licenses! 1Password: I really wish we knew what users wanted. Users: Please don't move to Electron, I don't want Chrome bugs in my password manager. 1Password: I'm just baffled. We never hear from users. Users: Please, for the love of God, give us control over our vaults. Don't go cloud-only, we're begging you! 1Password: Better turn on telemetry. It's the only way to solve…

They're focusing of the enterprise market. Those users are now what matters, because that's where the money is. Individual and family customers will still get their tier of product, but ain't no company-wide business decisions gonna be catered to their whims. And particularly with standalone perpetual licences, which I'm still clinging on to. Sync via DropBox, share a vault with family, and another one with my small…

> it just doesn't work for 1Password, financially

That is clearly not true. 1Password was around for over fifteen years and was profitable well before their Series A-C that set unrealistic growth targets. The financials were sound, which is why a non-startup was able to get that kind of financing at that kind of valuation to begin with.

Re: 1Password to Add Telemetry

#263

Post by KomoD »

rdl wrote: post #76

The 1Password "no local/standalone vaults" "upgrade" in 7->8 is what got me to leave it after 15 years or so. They're killing the extensions used by Chrome/Brave/etc. in 3 months, so it became critical to move off Version 7 (which is probably not getting much security maintenance now, either). RIP.

> They're killing the extensions used by Chrome/Brave/etc. in 3 months

Just for 7?

Re: 1Password to Add Telemetry

#264

Post by carimura »

electroly wrote: post #200
torstenvl wrote: post #141

Users: We want standalone non-subscription licenses! 1Password: I really wish we knew what users wanted. Users: Please don't move to Electron, I don't want Chrome bugs in my password manager. 1Password: I'm just baffled. We never hear from users. Users: Please, for the love of God, give us control over our vaults. Don't go cloud-only, we're begging you! 1Password: Better turn on telemetry. It's the only way to solve…

The problem here is the most vocal users are often not representative of the whole userbase. As a concrete response, I'm fine with the 1Password subscription, I think the new Electron rewrite is at least as good as the old one, and the cloud hosting is the whole reason I'm using 1Password. I just don't talk about it because what is there to say? They really wouldn't know except that I keep paying my bill.

Ya that's right, I suspect Hacker News is maybe the 1% that is capable of DIY'ing a solution and will complain about every little change with that as the "stick".

That said this whole telemetry push comes on the heels of their $600M VC round a year ago which wasn't designed for a linear growth business that just "keeps on keepin on" with the good times. So I'm a little skeptical that the company is philosophically/financially aligned with its consumer users.

Re: 1Password to Add Telemetry

#265

Post by KomoD »

thebitguru wrote: post #103
avtar wrote: post #97

Earlier quoted context omitted.

> Watch browser integrations get progressively worse (check out the reviews on the Firefox extension, oh boy) This doesn't align with my experience, and I've been using their app/service for years (the Windows & Mac apps, along with the Chrome and Firefox extensions). I don't mean to sound harsh but I'm scrolling through the negative reviews on the Firefox extension page as you suggested, and it's hard to take the ma…

I have enjoyed how quickly 1Password was adopting new technology and features while still staying stable. It just worked. Lately, that hasn't been the case. Recently, the browser extension, which is my main interface for 1Password, has been acting up. I use browser extension in Edge on macOS. I am on a page signing up for a new website and want to save credentials. It doesn't. Keeps erroring out. Disabling and re-ena…

> Recently, the browser extension, which is my main interface for 1Password, has been acting up.

> I use browser extension in Edge on macOS. I am on a page signing up for a new website and want to save credentials. It doesn't. Keeps erroring out. Disabling and re-enabling extension, and then refreshing the tab finally fixes it. I reached out to customer support and they told me to sign out to force refresh the cache. I did it, but the problem wasn't fixed.

I've had the same issue, support told me the exact same thing:

1. Lock the 1Password app (which also locks the extension).

2. Unlock the 1Password app (which also unlocks the extension).

If the issue is still present, please go through the steps below to fully re-sync your account:

1. Right click the 1Password icon in your browser toolbar and choose Settings.

2. Under General, disable "Integrate with 1Password app".

3. Under Accounts & Vaults, sign out of your account.

4. Sign back into your account.

5. Go back to General, and re-enable "Integrate with 1Password app".

I told them it didn't help at all, they claim they've released a fix for "one of the possible causes of the bug", in the beta version of the extension, they asked me to make a new chrome profile and install the beta version but I just didn't bother at that point and just lived with it..

Re: 1Password to Add Telemetry

#266

Post by closewith »

abigail95 wrote: post #102
JohnFen wrote: post #84

Earlier quoted context omitted.

> Are we assuming 1Password is lying about anonymisation? I wouldn't put it that way. Rather, I'd say that you shouldn't assume something is true just because a company claims it is. Especially when that thing can have a material effect on their profit margin.

In simplest terms. 1P says they are collecting non-PII. Higher poster in this thread says "I can't imagine how they're going to get this past EU regulators." I'm saying there is no problem, and someone needs to provide proof that the opt-out here is illegal.

Well, in the EU, the onus is on the data processer to show compliance, not the other way around.

However, Recital 30 (Online Identifiers for Profiling and Identification) clearly shows that IP addresses are personal data;

> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. 2This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

There is plenty of case law to show that processing IP addresses (even if you discard them later) is processing personal data. For example, an Italian court included as part of a ruling:

> In this respect, it is worth pointing out that the IP address constitutes personal data insofar as it makes it possible to identify an electronic communication device, thus indirectly making the data subject identifiable as a user (see Article 29 Working Party, WP 136 - Opinion No 4/2007 on the concept of personal data, of 20 June 2007, p. 16). This is especially so where, as in the present case, the IP is associated with other information relating to the browser used and the date and time of browsing (see recital 30 of the Regulation).

Source: https://gdprhub.eu/index.php?title=Garante_per_la_protezione...

Re: 1Password to Add Telemetry

#268

Post by bombcar »

ROFISH wrote: post #175
torstenvl wrote: post #141

Users: We want standalone non-subscription licenses! 1Password: I really wish we knew what users wanted. Users: Please don't move to Electron, I don't want Chrome bugs in my password manager. 1Password: I'm just baffled. We never hear from users. Users: Please, for the love of God, give us control over our vaults. Don't go cloud-only, we're begging you! 1Password: Better turn on telemetry. It's the only way to solve…

Even more hilarious: I have recorded customer service events specifically stating against all three of those. I liked 1Password when it was an amazing Mac-only app. Now it's just another Electron app I can throw away and discard for different Electron app, there's nothing special about it. The problem is that I don't see any particular alternative. I don't like Bitwarden's security (password is provided to the server…

1password is pushing me more and more toward something else, it has only to piss me off a bit more and I might just drop down to Apple Keychain for most things ...

Re: 1Password to Add Telemetry

#269

Post by closewith »

abigail95 wrote: post #105
miken123 wrote: post #90

Earlier quoted context omitted.

> Anomyous telemetry is not PII. GDPR is personal data. How are you exactly going to submit it anonymously? Will it connect over Tor? Because if you just send it over your internet connection, it arrives with your IP address on the packets, which is PII, which makes it data processing of PII, which makes it require a legal basis to process. And it is legally uncertain that 'legitimate interest' is a valid ground for…

That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake. Edit: It would also violate using any networks that transit such countries, because TLS and TCP handshake info might be PII too. I find that such a ridiculous position to have re GDPR. 1P already has consent from users for its apps to use the network to conne…

> That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake.

Yes, and this is the current situation with the US following Schrems II. Obviously, lots of companies are non-compliant as everyone is waiting for a diplomatic solution following the ruling against Privacy Shield.

> 1P already has consent from users for its apps to use the network to connect to their services.

They probably rely on the strictly necessary legal basis for network connections that are required to run the service. However, each purpose much have its own legal basis and you cannot bundle purposes. For example, you cannot gain consent to process given personal data for one purpose and then process it for another purpose.

Consent must be bound to one or several specified purposes which must then be sufficiently explained.

Re: 1Password to Add Telemetry

#270

Post by bombcar »

Corrado wrote: post #255
tweetle_beetle wrote: post #125

Earlier quoted context omitted.

Fairly sure Bitwarden has done all that for some time. Having had to use both at work, I can't see any killer features that 1Password has in my use case and there are various small things that slow me down when using it.

I've been using Bitwarden for several years and I really like it. However, I do wish it had a few more item "types". Not everything fits into the ["Login", "Card", "Identity", "Secure Note"] array.

1password only has ["Driver Licenses", "Software Licenses", "Documents"] as additional types. "Documents" seems to be doing the heavy lifting, as the others are either a form of "Identity" or "Secure Note".
Post reply on HN