Metadata is still data? Sure, it's not your password, but the title isn't "1Password Leaks Your Passwords". And it's not just when it's uploaded. It's when anyone has access to your keychain. The primary feature of a password manager is that it is supposed to be resistant to attack.

Passwords are my data in 1Password. If you say to me that 1Password is leaking my data, I'm thinking it leaks my passwords. The headline is misleading.

"1Password Leaks Your Metadata" would be both more accurate and less clickbait.

I disagree. As per the porn example in the article, and many other fathomable situations, metadata in a password manager can be as important, and sometimes more sensitive, than the password itself.

Exactly. People wouldn't care for a politician's password to IloveSexWithHorses.com (unless they like beastiality themselves and can't afford an account of their own).

The fact that he subscribes to such a site though, would be worth gold in expose articles and/or blackmail...

Point me at the part in my post where I said metadata wasn't important.

I guess my point is that simply calling metadata 'data' isn't sensationalist in this setting.

People have different risk assessments.

I'm not saying this isn't a significant risk, or shouldn't be treated as such. I'm merely saying that the headline implies that the primary data in 1Password is leaked, when it is not.

In what possible way would this headline not be more accurate if it were "1Password Leaks Your Metadata"? How would that be diminishing different peoples' risk assessments?

If you think a title is poor you should probably email the mods to suggest a better title.

They seem receptive to that kind of thing.

No, metadata is not data. It's metadata.

It's data about data. So, still data. The title may be a bit sensationalized ("your data" sound like "all your data", but it really is "some of your data"), but it is not false.

There's a reason it's not called 'data', is my point. It's false, insofar that it's not the 'data' you give to 1Password.

> There's a reason it's not called 'data', is my point.

Is there, actually, in this context? What is the reason you're drawing this distinction? What makes generated passwords 'data', but password reset urls and hand-typed entry names 'metadata'?

Because people seem to think everything they do on a computer is or should be private. It's not and shouldn't be.

What about everything that is expected to be private, can be made private, has security implications for not being private, and has no gains for being public other than "it's slightly less expensive"?

Why shouldn't my password reset urls be private? They are... in the password database I use.

Why shouldn't my database entry names be private? They are... in the password database I use.

Are you saying that these things are metadata in 1Password by virtue of the fact that they weren't secured? Because that would seem like circular reasoning - that you can never leak data, because leaked data is metadata. I don't share your definition of metadata in such a case.

Are you saying that these things are metadata in 1Password because they shouldn't be private? I just plain strongly disagree if so.

Are you saying that these things are metadata because users shouldn't expect a password database to secure them properly? Then I could at least see where you're coming from. But I don't think it makes sense to tie the definition of metadata to that - among other complaints, I think it lets off companies/software that leak your (meta)data off far too easily, and that such word games absolve them of too much responsibility.

I didn't say anything of the sort. I said metadata isn't data and just because metadata is about you/your data, doesn't mean you own it.

I've been intentionally vague so as to discuss this in more macro terms rather than the specific case as presented here, because I feel there's a panicked "deer in the headlights" attitude that comes with talking about data and metadata, and I'd like to try and help folks think a little more rationally around the topic rather than simply "EVERYTHING RELATED TO ME IS MINE AND NEEDS TO BE ENCRYPTED AND HIDDEN".

I regularly forget about how closed-minded the HN userbase is when it comes to privacy.

> I've been intentionally vague so as to discuss this in more macro terms

You may want to lead with that next time - I'm not the only one attempting to interpret your vagueness in-context (that is, in the specific case as presented here) which apparently isn't your intent. Hopefully it'll generate productive discussion instead of a confused chorus attempting to clarify terminology.

> I feel there's a panicked "deer in the headlights" attitude that comes with talking about data and metadata

Are you seeing that in this thread? Or is this more of a generalized feeling of HN? Or of the internet?

I feel like I'm mostly seeing discussions about what specific data was involved, what alternatives are out there, and the severity and history of the problem (which I'm seeing as mostly "not as severe as your initial kneejerk to the title might imply, but not ideal either" - pretty levelheaded and accurate, IMO?)

None of them seemed particularly frozen, unable to move forwards, or panicking beyond the time it took them to evaluate what specific (meta)data was leaking - to me, at least. And given that password databases secure the keys to the castle, so to speak, I'm not sure a little panicking isn't warranted in this specific context.

> I regularly forget about how closed-minded the HN userbase is when it comes to privacy.

If that's in response to this thread, keep in mind that, in-context, the "privacy" many professionals in here are concerned about, is the "privacy" of their amazon account keys, to avoid their servers being subverted into part of a malware distribution botnet. And the "privacy" of their user database - to avoid the reputation hit that comes when all your customer's passwords are cracked, and their inboxes are flooded with porn spam. I think it'd be a mistake to overgeneralize that response.

What you've just done to my comment is common on the Internet, but extremely harmful to an intelligent discourse. I wrote what I did all together because each sentence informs and provides context for the others. In isolation, each sentence may carry a different meaning than if they're grouped.

In the future, remember this when you decide to dissect someone's writing.

The sentences are still grouped together immediately above my post - in your post. This isn't some blog post quoting snippets from some other link, or a book quoting sections from another resource. I also strongly disagree that these things are inherently harmful, if that's what you're indeed saying. They can be misused to harmful ends, to be sure - but what would you have me do, ditch quotes entirely? Quote only entire books? Chapters?

Quoting entire paragraphs may not be sufficient to provide proper context, and especially if being willfully misinterpreted, can be potentially harmful.

But well intentioned quotes, immediately under a post providing them in their full context - which is the case in my post you replied to? I'm hard pressed to see that as distorting your meaning and harming discourse. If you have specific grievances as to how I have, please state them. If my understanding is distorted, there is harm to discourse regardless of whether or not it's visible in the form of distorted quotes.

The many questions I'm asking are my attempts at understanding the context of your statements, to avoid such distortions. The couple that you've answered have clarified some things. A couple more have been mooted by indirect responses. Many others are still relevant and unanswered.

Even now, I'm a bit unsure if you're saying that I've done harm, in the specific post I made that you were responding to - or if you're making vague generalizations again, this time about sentence level quoting on the internet in general. I'm assuming the former for now - but please correct me if I'm wrong. I would ask, but that's clearly not working out for me.

Last word.

Do you not give the website your password is used at to 1Password?

1Password isn't leaking passwords.

I know, but the website address is still data that I input into the application. My point was that it doesn't only leak fluffy metadata that I don't directly input into the application.

Well, that's not metadata, it's just data.

... yes, and that's why your claim that "It's false, insofar that it's not the 'data' you give to 1Password." is wrong. Which was my point.

Also, whatever the unusual definition of data you use that results in metadata being excluded is irrelevant (and it is unusual, look up the definition of data in any dictionary). The important part is that 1Password was not making it clear that it does not encrypt certain parts of the "information" you put into it.

I never said what you're claiming I said, all I said was metadata isn't data insofar that it's not the 'data' you give to 1Password. I never said anything specific was or wasn't data.

And I'm not using an unusual definition of data, that begs the question. My point is just because it's about you, doesn't mean you own it.

Metadata is also not yours in the first place. Data about you or the things you do isn't yours. Does Julian Edelman own the fact that he caught a pass?

How is data stored exclusively on my machines or on my Dropbox account not mine just because it has "meta" as a prefix? It's still data!

Public metadata isn't mine. Private metadata is. And in fact, around here it's illegal to record my metadata, even if publicly viewable - anti-piracy groups have been fined for producing databases of IP addresses+shared files taken from the Bittorrent network.

Some metadata is yours. This metadata isn't, and lots of other metadata isn't yours.

What part of 1Password's metadata can be considered "not yours"?

I don't know everything they monitor/measure, but times you've accessed your data would be something that isn't yours, if they collect that.

Why not?

The same reason unicorns and fairies don't exist.

Metadata gives information about other data. The length of your password would be metadata rather than data. I'm pretty sure no one really wants that out in public?

Nice thing about 1Password (and other password managers) - password length isn't that important. My HN password is 30 characters, 5 of which are symbols, 5 of which are digits.

That's lots of metadata, but probably doesn't help you in the slightest in guessing my password. Agree with you that its problematic that 1password was leaking things like site names and URLs though.

Metadata is data about data.

In my opinion, the names and URLs in a password manager are data, not metadata.

I personally typed or copy-pasted all the entries in my keepass vault, it's primary information associated with the passwords, highly personal, and that it's not the definition of metadata. The fact that a tool automates the gathering of some data (URLs) for the user doesn't automatically make it metadata.

Metadata would the character encoding, version, encryption, ids required to read the file, as well as added/modified dates (potentially sensitive metadata).

"1Password Leaks The Websites you're subscribed to When You Using its officially sanctioned Dropbox Sync"

Here, I fixed it for you.

I don't understand this article at all. My wife and I sync 1Password credentials using an agilekeychain within a shared (between us only) file in our Dropboxes (so we can still have distinct Dropbox logins.

This works amazingly, and it's the only way I know how to have distinct individual logins and share common passwords (most other solutions would require we use the same iCloud login, etc.)

The agilekeychain is in a folder that only our Dropbox users have access to. Where, again, is the part where the whole internet can see it and Google can index it?

If you have your sync set up to be generally visible on the entire web, aren't the passwords (encrypted) also there? I operate under the assumption that my keychain itself hasn't been compromised and if it has I've got a ticking timer to reset important passwords. If it were on the internet, I'd better be spending time every month rotating passwords since I would have to assume attackers were always at it.

So what's up with this "visible in a browser" thing, and why would anyone use it in the first place?!?

>The agilekeychain is in a folder that only our Dropbox users have access to. Where, again, is the part where the whole internet can see it and Google can index it?

That happens to people who self-host the file. That aside, Dropbox (the company -- or any other person that has access to your agilekeychain, for that matter), having access to metadata about your encrypted passwords is already bad. They shouldn't be able to see anything -- not just your passwords, but also the sites they're for (sexwithanimals.com, hilterappreciationsociety.org etc.).

>If you have your sync set up to be generally visible on the entire web, aren't the passwords (encrypted) also there?

Your passwords yes. Their metadata (such as that they're for sexwithanimals.com and hilterappreciationsociety.org etc) not.