LastPass Android : 7 3rd party trackers

[Alex5723]

German (translated to English)

LastPass Android: Third-party providers monitor every step

LastPass is a widely used password manager. The app has over 10 million installations in the Google Play Store alone. With Exodus Privacy I briefly checked whether the app contains known tracker signatures. A total of seven trackers were found :

AppsFlyer
Google Analytics
Google CrashLytics
Google Firebase Analytics
Google Tag Manager
MixPanel
segment

For an app that processes extremely sensitive data (passwords), this is simply an indictment. Advertising and analytics modules simply have no place in this – it is completely out of the question to integrate them into password manager apps…

Reply | Quote

[Alex5723]

According to The Register Bitwarden and Dashlane both contain trackers.

Reply | Quote

[Paul T]

One reasons to not use an online password manager.
Having complete control of your passwords is preferable for many people. Convenience of multiple device use may be enough reason to stay with an online manager.

cheers, Paul

Reply | Quote

[Ascaris]

Bitwarden for Google Play contains Microsoft Appcenter Crashes and Google Firebase Analytics.

Dashlane for Google Play contains Google CrashLytics, Braze (formerly Appboy), Adjust, and Google Firebase Analytics.

The two trackers in Bitwarden appear to be somewhat innocuous, in that there are potentially legitimate reasons for the trackers.

Braze and Adjust in Dashlane are a bit suspect. The other two appear to be potentially legitimate.

If the presence of the two trackers in Bitwarden bothers you, you can go for the F-Droid version of the app, which can be installed via sideload on any Android device. F-Droid does not, as far as I know, allow anything with a tracker in its repository, and I verified this via the Exodus standalone. I tried to include the analysis here, but the spam filter for the site decided that it contained “contacts,” whatever that means, and that it “seems to be spam.” If including relevant technical bits within a technical post on a tech site “seems to be spam,” then there “seems to be” a problem with the spam filter.

The F-Droid version of Bitwarden is the version I use, but with that said: When you are using any software you didn’t personally write, and where that software by necessity handles sensitive data, be it a password manager, browser, operating system, or anything else, there will always be a need to take a leap of faith and trust that the people who did write it have done so competently and honestly. If you don’t trust a given piece of software, it doesn’t much matter whether it has analytics built-in… it could be completely free of known trackers even as it surreptitiously sends all of your data to some third party to be exploited.

Google and Facebook (as the two most prominent examples) are interested in collecting your personal data to be able to push targeted ads at you. They’re not in the identity theft business. That’s how Google Chrome can simultaneously be considered one of the most secure yet least private browsers available. Privacy and security are not the same thing.

This, of course, is just for the Android apps. The Firefox extension for Bitwarden is one of the few that is recommended by Mozilla, meaning that they’ve done whatever they do to validate its function enough to be willing to put their stamp of approval on it, so that’s something at least. Dashlane doesn’t have a Firefox extension that I could find.

 

Group "L" (KDE Neon Linux 5.21.4 User Edition)

Reply | Quote

[Author]

Posts