Rich Icons now in 1Password

So I figure that cloudfront can tabulate all the icons fetched by one ip address and thereby know the sites that address has logins for.

Or they can watch for fetches for one icon and compile a list of IPs with logins for that site.

@brenty: Regarding: "IP addresses are not personally identifiable (even location-matching often is inaccurate), and 1Password isn't collecting or transmitting identifiers that would make you or I stand out, to connect one image request to another. So that covers 'Or they can watch for fetches for one icon and compile a list of IPs with logins for that site.' "

Despite the attempt to minimize the forensic value of IP addresses, I take this as confirmation that Cloudfront can collect a list of IPs that have a login (proxied by icon URL) to a particular 3rd party service. So for example, if a marketing firm or government agency ordered "all IP addresses that fetch the icon for site XYZ" Cloudfront could provide that, assuming they derived the icon URL associated with the site.

To elaborate on tabulation, assuming the effort to derive a table of 3rd party services associated with each icon URL, Cloudfront could log all icon fetches for a given IP, and translate those to the 3rd party services for which the IP has a login. E.g., "every site whose icon was fetched by IP x.x.x.x", or "every site whose icon was fetched, for each IP that fetched icons".

@MikeT, thanks, that was the genesis of my original question. Whereas https://support.1password.com/privacy-rich-icons/ explains in depth how "we" can't collect certain information, it ignores the fact that Cloudfront can collect it, in bulk.

"We cannot lose, use, or abuse information that we don’t have. Nor do we have to worry about protecting sensitive data if we never have that data to protect."

Cloudfront's ability to exploit the data for commercial gain, or a sneaky employee or attacker doing so is being neglected, as though Agilebit's CDN provider is not part of the "we" that the customer need not fear. "We", the company(s) that implement the 1Password solution, do have the data.

"One thing to keep in mind when you make your decision is that someone in a position to capture information from your use of Rich Icons is almost certainly in a position to capture what websites you visit (including when you do so) without enabling Rich Icons. But we think the choice should ultimately be up to you."

Like the "anyone who can sniff your traffic" point, this quote diverts from the fact that Cloudfront is easily situated to exploit the information. This is not about a spook with a wiretap.

I think the article is disingenuous in that, contrary to its soothing intent, the feature does make the core information available, in bulk, to Cloudfront and Agilebits, presumably on request. Rather than to evade this fact, I think that the article should make it clear that all of a user's login sites can be derived and associated with their IP address, by means of the rich icon feature.

Much as you said, "If you want to protect your privacy, unfortunately, Rich Icons must be turned off in 1Password."

I also think that the feature should be off by default, and the user notified of the risk, with confirmation, before it is ever turned on.

Why am I going to all this trouble? After reinstalling on Aug 13, I noticed I suddenly had rich icons. No idea how it happened as I always assumed the feature was a privacy gap. But at that point I suspected it had already leaked my information. So I jumped on this thread to confirm my suspicion. I did not expect to debate the vulnerability, just to confirm it or learn otherwise.

Now that it's confirmed, I think it should be clearly acknowledged, and with better protections implemented.

Thanks. Fyi, in my case, I was installing over an existing installation. I don't know if that affects the installation experience. I don't recall any questions or words or warning. It was possibly only an update. What I know for sure is that rich icons was suddenly on without my touching it.

In either case, I also think a protection should exist post-install, to prevent unintended vulnerability by the same user or another user. If 1Password can be used and configured by another account on the same machine, that's post-install.

Anyway, thanks again.