I use both 1Password and Proton Pass as password managers. Today a friend of mine, who knows a former 1Password employee, told me that this person still uses an old version of 1Password because recent versions have serious privacy issues and collect a lot of data, such as a list of every app installed on your device.
This worried me, so I read 1Password’s privacy policy looking for evidence, and I found this passage:
We collect information from your browsers and devices, which provides us with technical usage information when you access or use the Services. This includes information about your devices, applications, operating systems, cookies, server logs, IP address, location data, analytics information, software errors and crash data, authentication details, quality and performance metrics, and other technical details necessary for us to operate and maintain our Services.
I know this is second-hand information. What worries me is that the policy mentions “information about your devices, applications” without saying which applications. Does this mean only 1Password’s own apps, or other apps installed on the device as well? Has anyone looked into this, or asked 1Password directly? And if they do collect data about other installed apps, does this affect Privacy Guides’ recommendation?
it’s a paid service so they have less reason to be selling data
This rule doesn’t really apply anymore. Nearly every business is a data collection company these days, even if it’s not their core business. If my doctor’s office, utility company, mechanic, barber, grocery store, and gym are doing it, I see no reason to assume that a dedicated software company isn’t.
Not saying 1Password is definitely doing it. But I’m not saying they’re not. That’s their reputation cost of refusing to be open-source and transparent.
In this environment, I’m done giving any service or software product the benefit of the doubt. I see everyone as nefarious data collectors unless proven otherwise through open source code. Period.
This is pretty standard language to a degree, any app that is backed by a service is going to have web infrastructure that logs some of those things. Then you want to be looking further into the policy to see if they describe their log retention practices.
Password Managers are also unique in that in order for them to do what they do, they need to live in your browser, look at every web form and URL to do the matching so that they can then suggest to you if they have a password saved or would like help creating one. The difference between the privacy respecting password managers and the regular ones focused on the normies are what they share back with the service.
There’s a reason 1Password have one of the best in market, it is because they do collect data so they can optimize their auto-capture and auto-fill to work best on the website that people use the most. In the same breadth in other forums on the internet you will constantly see people championing Bitwarden while lamenting their auto-fill or auto-capture is no good and now they are moving to 1Password.
As always with this, choose the product that best aligns to your personal threat matrix. FWIW you can go into the settings of 1Password and opt out of a lot of the things that would communicate your vault contents back to them.
I’d like to think you are right i.e. I agree Bitwarden likely doesn’t capture all those attributes described in OPs original quote from 1Password, at a minimum they’d still have those edge server logs with IP addresses, api request paths etc. But if I was picking through a pure privacy lens I’d likely chose Bitwarden first. Or ours for that matter.