Android Beta Rich Icons Privacy Concern

Axel

For privacy reasons I do not use "rich" icons with 1Password for Mac. In the Android beta it appears that rich icons are downloaded and there is no appropriate privacy control to disable the download.

Please implement the appropriate controls. "Rich" icons are a problem on Android for all the same reasons they are a concern on OS X.

saad

Hi @Axel! Thanks for taking the time to share your thoughts about the beta. We completely understand your concern, and I apologize an option to disable rich icons is not available yet. We are actually looking into possibly adding this as part of a beta update. I'll pass on your vote for this request.

Thanks again! Let me know if you have any questions.

EnerJi

What's the privacy concern with rich icons?

Axel

EnerJi, there's a reasonable discussion in this thread:

http://discussions.agilebits.com/discussion/comment/79942/#Comment_79942

In essence, Agilebits intermediates the retrieval of rich icons, which gives them visibility into the URLs and hostnames you have in your keychain. Agilebits has indicated they do not use this info to personally identify you, but we have only their word and no binding commitment (to my knowledge). Its also not clear that they could not be compelled to change policy.

If your keychain includes private addresses, say from a corp network, or you simply don't want Agilebits to know all your URL hostnames you'd want to disable this feature. Unfortunately, that's not a option on Android (at least not yet).

saad

Thanks for sharing this link @Axel. There is no option to disable rich icons on Android yet, but please expect it soon in a beta update. :)

EnerJi

Thank you for the explanation, Axel.

saad

Beta 12 introduced a new toggle to disable rich icons within settings. If you open 1Password, and then go into Settings > Advanced, you will see a new checkbox to enable or disable rich icons on the device.

Axel

Thanks for the followup and the fix!

One question about the new switch... When does the rich icon fetch from your server occur? I'm not able to access the new privacy setting until after I've selected my keychain file and it has been synchronized. Previously it seemed to only take a few moments after first sync for rich icon import to occur. Is there a chance that rich icons are being read before I have a chance to adjust the setting?

In my case to make sure I turned on the device airplane mode before starting the first sync, but I'm wondering if this needs to be a option visible during the initial sync setup.

saad

I just confirmed this with our developers, and it looks like rich icons are fetched before the user gets a chance to adjust the toggle within settings. Like you suggested, it would probably make sense to have an option to disable this during the initial setup. I'll add this to our issue tracker.

As of right now, a workaround would be to put your device in airplane mode during the initial setup. If you're syncing with Dropbox, enable Airplane mode after the first sync is completed. Then disable Airplane mode after turning off Rich Icons from Settings > Advanced.