Disable (hidden) Facebook Connection when Unlocking | Security/Privacy Issue

ugafta

Hello.

I checked my DNS logs and see that my 1Password on my iPhone connects to Facebook ...

...when I click on the following button:

I have tested this on several websites and each time Facebook is displayed. - Why is that?

---

1Password Version: 7.9
Extension Version: Not Provided
OS Version: iOS 15.0.2

Ben

Hi @ugafta

Are you able to see what IP address is being connected to? I wonder if this is a case of the same problem we've encountered with Little Snitch and other similar tools where they're doing a reverse DNS lookup on the IP address and showing one of any variety of possible results. You can see an example of where this happened, with CloudFront, here.

1Password itself does not communicate directly with Facebook. Even in the case you had a Login item saved for Facebook and Rich Icons enabled, we use our own intermediary service for those icons rather than connecting directly to the site: https://support.1password.com/rich-icons-privacy/

You can read about the connections 1Password does make, here: https://support.1password.com/ports-domains/

Ben

ugafta

Hi @Ben

see my results (line 42) in the images:

Thank you for taking a closer look.

---

Fiddler was used as a web debugging proxy, showing all internet traffic from my iPhone.

Ben

Hi @ugafta

Thank you for the additional information. I've asked our security team to look into this further. I hope to have more to report soon. In the meantime could you please also check if this connection is made when you open the 1Password app itself? The button you're tapping above the keyboard is iOS's Password AutoFill feature, which 1Password can provide data to, but isn't actually 1Password itself.

Additionally, can you please check in the Settings app under Passwords > AutoFill Passwords and see if any providers other than 1Password are checked (e.g. iCloud Keychain)?

Thanks!

Ben

ugafta

Hi @Ben

When I open the 1Password application itself, I get the following connections: What is in.appcenter.ms?

No other provider is enabled in the app settings under Passwords > Auto-fill passwords.

By the way, I used Chrome and Safari browsers on my iPhone to check the above connections.

Thank you for more information!

Ben

@ugafta

App Center is the service we use for crash reporting.

in.appcenter.ms
Provides crash report management for 1Password for Mac and iOS.

(from https://support.1password.com/ports-domains/)

Visual Studio App Center | iOS, Android, Xamarin & React Native

I suspect whatever the original connection in question is, it is coming from Password AutoFill, not 1Password directly. I'd like to ask you to perform one other test though. Could you please try enabling iCloud Keychain in Passwords > AutoFill Passwords and disable 1Password there? Under those conditions does the connection appear when activating Password AutoFill above the keyboard? I've confirmed with our development team that 1Password does not connect to Facebook.

Please let me know. Thank you.

Ben

ugafta

@Ben

That seems to be okay now.

BTW I enabled iCloud Keychain and the connection does not appear.

Thanks for your help!