1a5f9842524



Offline



Activity: 8

Merit: 0







NewbieActivity: 8Merit: 0 Why is Armory sending our *USERNAMES* to bitcoinarmory.com ‼️ August 09, 2014, 01:47:51 PM

Last edit: August 09, 2014, 08:55:23 PM by 1a5f9842524 #1 bitcoinarmory.com every 30 minutes with the hash of your home folder name, OS version, and of course your IP address (proxies are ignore) at every start of the application. The only way to disable it is not an option that can be set, but a command line option you need to use every launch. The options "skip online check" and "disable software upgrade notifications" do not disable it as one would expect.



It's not hard to imagine how this would be connected with the transactions a person makes just due to the timings of the requests. Even just matching the hashes returned with usernames on this forum would be enough to identify a lot of people. As pointed out below, this does not respect proxy settings so the real IP of the user is sent to bitcoinarmory.com.



How much of this is being logged by Amazon S3 and bitcoinarmory.com?

How long are the logs kept?

Why aren't users told their privacy is being violated?

Why can't this feature be turned off in a sensible way?

This behavior is totally unacceptable.



Code: #############################################################################

def getDecoratedURL(self, url, verbose=False):

"""

This always decorates the URL with at least Armory version. Use the

verbose=True option to add OS, subOS, and a few "random" bytes that help

reject duplicate queries.

"""

argsMap = {}

argsMap['ver'] = getVersionString(BTCARMORY_VERSION)



if verbose:

if OS_WINDOWS:

argsMap['os'] = 'win'

elif OS_LINUX:

argsMap['os'] = 'lin'

elif OS_MACOSX:

argsMap['os'] = 'mac'

else:

argsMap['os'] = 'unk'



try:

if OS_MACOSX:

argsMap['osvar'] = OS_VARIANT

else:

argsMap['osvar'] = OS_VARIANT[0].lower()

except:

LOGERR('Unrecognized OS while constructing version URL')

argsMap['osvar'] = 'unk'



if OS_WINDOWS:

argsMap['id'] = binary_to_hex(hash256(USER_HOME_DIR.encode('utf8'))[:4])

else:

argsMap['id'] = binary_to_hex(hash256(USER_HOME_DIR)[:4])



return url + '?' + urllib.urlencode(argsMap)





https://github.com/etotheipi/BitcoinArmory/blob/7bd89850a90a280e3345c29d7e0338b62f841548/announcefetch.py#L232



The Armory client makes a HTTP requestevery 30 minutes with the hash of your home folder name, OS version, and of course your IP address (proxies are ignore) at every start of the application. The only way to disable it is not an option that can be set, but a command line option you need to use every launch. The options "skip online check" and "disable software upgrade notifications" do not disable it as one would expect.It's not hard to imagine how this would be connected with the transactions a person makes just due to the timings of the requests. Even just matching the hashes returned with usernames on this forum would be enough to identify a lot of people. As pointed out below, this does not respect proxy settings so the real IP of the user is sent toThis behavior is totally unacceptable.

ForgottenPassword



Offline



Activity: 154

Merit: 100







Full MemberActivity: 154Merit: 100 Re: Why is Armory sending our *USERNAMES* to bitcoinarmory.com!? August 09, 2014, 01:50:52 PM

Last edit: August 11, 2014, 08:31:11 PM by ForgottenPassword #2



It seems to be for getting the announcements on new releases. Why do you need the hash of the home directory for that?



The GUI gave me the impression that I had to press "Check for updates" before it would "dial home", apparently I was wrong. Why would you do that every 30 minutes? It shouldn't do that automatically!



I didn't see the comment where they admit its logged. But if it is why in the hell would they do that? that puts them at unnecessary legal risk of receiving subpoenas for this information.



Update:

The Armory developers are releasing an update that will fix everything we were worried about, see here: https://bitcointalk.org/index.php?topic=731315.msg8299712#msg8299712 Holy hell. Thats pretty serious if you ask me. Has anyone brought this up before?It seems to be for getting the announcements on new releases. Why do you need the hash of the home directory for that?The GUI gave me the impression that I had to press "Check for updates" before it would "dial home", apparently I was wrong. Why would you do that every 30 minutes? It shouldn't do that automatically!I didn't see the comment where they admit its logged. But if it is why in the hell would they do that? that puts them at unnecessary legal risk of receiving subpoenas for this information.



Tip Address: I have private messages disabled. Send me an email instead. My contact details can be found here. Tip Address: 13Lwo1hK5smoBpFWxmqeKSL52EvN8U7asX

ForgottenPassword



Offline



Activity: 154

Merit: 100







Full MemberActivity: 154Merit: 100 Re: Why is Armory sending our *USERNAMES* to bitcoinarmory.com ‼️ August 09, 2014, 02:31:41 PM #9 Quote from: etotheipi on August 09, 2014, 02:27:03 PM Guys, calm down.



The code you posted doesn't send your username to bitcoinarmory.com, it sends the truncated hash of your user home directory path. This does not give us any information about you except that it will be the same when your system makes multiple requests for version/announcement information. We intentionally chose this instead of tracking by IP because we knew that IP logging was "not cool". And in the end, we don't care about your IP, we only use it the ID for collecting statistics about what operatings systems are being use to run Armory and what versions people are using, especially after announcing new versions. This helps us remove duplicates.



Armory (the company) only tracks unique IDs long enough to collect daily statistics of our user base, like how many people have upgraded. If a announce-request is made and comes from an ID we have never seen, we add the OS and Armory version to the statistics. Otherwise we ignore it. That's it. We added the unique ID so that we have a way to count unique users without logging IP addresses. We also add the ability for you disable this by running with "--skip-annuonce-check".



As a company, we have to have some way to measure our userbase, and we felt this was the least intrusive way possible. And you can opt-out.







If that is the case, why do you need to collect statistics every 30 minutes? By doing that you also see what times the installation is running which could allow you to match it up against bitcoin transactions made during those times.



And whether you like it or not the IP is transmitted along with the unique installation ID and we can't know whether you are storing the IP's or not. This bypasses any proxy settings set on bitcoind, such as people using Tor. If that is the case,By doing that you also see what times the installation is running which could allow you to match it up against bitcoin transactions made during those times.And whether you like it or notThis bypasses any proxy settings set on bitcoind, such as people using Tor.



Tip Address: I have private messages disabled. Send me an email instead. My contact details can be found here. Tip Address: 13Lwo1hK5smoBpFWxmqeKSL52EvN8U7asX

ForgottenPassword



Offline



Activity: 154

Merit: 100







Full MemberActivity: 154Merit: 100 Re: Why is Armory sending our *USERNAMES* to bitcoinarmory.com ‼️ August 09, 2014, 02:39:22 PM

Last edit: August 09, 2014, 02:51:18 PM by ForgottenPassword #12 Additionally you could still get a list of all usernames on bitcointalk for example and compute the ID hashes by working out what their home directory would be expected to be if they used the same username on bitcointalk and their PC.



You'd be able to check that hash against your "statistics database" and find their installation along with all of the IP's that gave you the statistics.



What you do is arguably worse than simply collecting IP's.



Why don't you just send the OS version etc without the ID on the first time Armory is run? Much better than what you do.



Tip Address: I have private messages disabled. Send me an email instead. My contact details can be found here. Tip Address: 13Lwo1hK5smoBpFWxmqeKSL52EvN8U7asX

ForgottenPassword



Offline



Activity: 154

Merit: 100







Full MemberActivity: 154Merit: 100 Re: Why is Armory sending our *USERNAMES* to bitcoinarmory.com ‼️ August 09, 2014, 03:06:13 PM

Last edit: August 09, 2014, 03:16:54 PM by ForgottenPassword #16 Quote from: etotheipi on August 09, 2014, 03:00:16 PM So that we don't "count" that ping as a unique user. Our goal is to get a rough gauge of how many people are using Armory, and what the OS & version distribution is. That's all we use the data for. If we send a ping without the ID, we don't know if it's a duplicate.



Also, I shouldn't have suggested "just" hard-forks... a piece of secure software used by people with massive amounts of money has many different reasons users might need to be notified, including critical security issues with Armory, if they arise.



I still don't know why you need to know their installation ID for each ping. Can you come up with a real-life example of a situation where you'd need to know that information when providing announcements? if there were critical issues in Armory that would affect everyone running that version and not specific installations.



For most users privacy is just as important as security.



Annoucements/statistics should be two completely seperate things. I think statistics should happen on first-run ONLY and it should be very obvious it's happening and easy for the user to opt-out. Checking for annoucements should send the bare amount of information you require, the Armory version and platform.



I was under the impression checks for announcements weren't automatic and it seems others were too. Maybe it should be more obvious that they are automatic and easier to disable them (in the GUI) for people who want to check manually instead. I still don't know why you need to know their installation ID for each ping. Can you come up with a real-life example of a situation where you'd need to know that information when providing announcements? if there were critical issues in Armory that would affect everyone running that version and not specific installations.For most users privacy is just as important as security.Annoucements/statistics should be two completely seperate things. I think statistics should happen on first-run ONLY and it should be very obvious it's happening and easy for the user to opt-out. Checking for annoucements should send the bare amount of information you require, the Armory version and platform.I was under the impression checks for announcements weren't automatic and it seems others were too. Maybe it should be more obvious that they are automatic and easier to disable them (in the GUI) for people who want to check manually instead.



Tip Address: I have private messages disabled. Send me an email instead. My contact details can be found here. Tip Address: 13Lwo1hK5smoBpFWxmqeKSL52EvN8U7asX

ForgottenPassword



Offline



Activity: 154

Merit: 100







Full MemberActivity: 154Merit: 100 Re: Why is Armory sending our *USERNAMES* to bitcoinarmory.com ‼️ August 09, 2014, 08:06:54 PM

Last edit: August 09, 2014, 08:51:08 PM by ForgottenPassword #18 Quote from: 1a5f9842524 on August 09, 2014, 08:04:40 PM Utter nonsense.



If you wanted a unique anonymous ID you would have generated a few random bytes and used that. Instead you used a highly identifying, personal piece of information and sent it to your remote server along with the IP address of the user. There's no way you can pretend that was a mistake from somebody who is writing wallet software.



Why don't you do us a favor and delete all the information you've collected without your users consent.



I agree.



On the website, they have a privacy policy that states this:



Quote ATI may collect your devices IP address: when you start the software on your device and the software checks for updates and notifications, unless you opt out of this feature.



ATI does not share this information outside of ATI except that ATI may share information with governmental authorities pursuant to a court order or other lawful order.



However I don't recall being forced to agree to this when I ran the software, though from looking at the source it appears to be in the help menu at least. I agree.On the website, they have a privacy policy that states this:However I don't recall being forced to agree to this when I ran the software, though from looking at the source it appears to be in the help menu at least.



Tip Address: I have private messages disabled. Send me an email instead. My contact details can be found here. Tip Address: 13Lwo1hK5smoBpFWxmqeKSL52EvN8U7asX