widget-cdn.rpxnow.com What is this?

I have i've been using agilebits 1Password on my mac for a few months now and today i noticed that when i use the google chrome widget, as soon as i type in my password, the widget connects to widget-cdn.rpxnow.com

Can someone explain what this is doing? Why is the widget connecting to an external resource upon password entry?

Comments

  • JasperJasper

    Team Member

    Hey @asajinx,

    1Password does make various outside connections (ex: checks for app updates from Amazon CloudFront). Sometimes an app like LittleSnitch may report one of the CNAME records that points to the same address that AgileBits uses, since CloudFront servers are used by many companies.

    See this support article for details:

    1Password and Your Privacy

  • Hi @JasperP

    Yes i am aware of Cloudfront CDN, LittleSnitch reports CloudFront as its own separate request though. What i would like to know is what rpxnow.com is? Is that another CDN service?

  • JasperJasper

    Team Member

    Hey @asajinx,

    From the link I posted above:

    There is a peculiarity of how some firewall software, Little Snitch in particular, may report these connections. Little Snitch’s Connection Inspector will display “all names currently known to resolve to one of the IP addresses of the server.”

    Given how the Cloud Front content distribution network operates, the particular cloudfront.net subdomains do not correspond to a unique IP address. Nor is an individual IP address limited to a single cloudfront subdomain. For example, one of the IP addresses associated with d13itkw33a7sus.cloudfront.net is 54.230.49.141. That same IP address may also be associated with some other cloudfront subdomain entirely unconnected to Agile Bits. That IP address may also be associated with something like example.com.

    The upshot of this interaction between Cloud Front domain names, IP address, and Little Snitch’s reporting habits is that Little Snitch erroneously reports 1Password attempting to connect to example.com in that example.

    1Password could be connecting to CloudFront for software updates, rich icons, news, or help files. And for one of those cases, LittleSnitch is reporting widget-cdn.rpxnow.com, which would be another domain that is associated with CloudFront. There have been several reports on the forums here by users experiencing LittleSnitch reporting 1Password connecting to strange domains, but they're really just CloudFront aliases. If you go to rpxnow.com, it redirects to dashboard.janrain.com, and that site seems to use CloudFront.

  • @JasperP

    Got it, thanks!

  • sjksjk oversoul

    Team Member

    Hi, @asajinx.

    Some verification for @JasperP's explanation:

    % host widget-cdn.rpxnow.com widget-cdn.rpxnow.com is an alias for d29usylhdk1xyu.cloudfront.net. d29usylhdk1xyu.cloudfront.net has address 54.230.143.46 d29usylhdk1xyu.cloudfront.net has address 54.230.140.112 d29usylhdk1xyu.cloudfront.net has address 205.251.215.189 d29usylhdk1xyu.cloudfront.net has address 205.251.215.190 d29usylhdk1xyu.cloudfront.net has address 54.230.143.209 d29usylhdk1xyu.cloudfront.net has address 54.230.140.168 d29usylhdk1xyu.cloudfront.net has address 54.230.140.225 d29usylhdk1xyu.cloudfront.net has address 54.230.143.218

    :)

This discussion has been closed.