App Privacy Report for 1P only displays one contacted domain

Damnatus

That's great news. Thank you for letting me, and the rest of the community, know! 🙂

-Dave

1P_Dave just wanted to let you know that this issue has been resolved in iOS 17.5 (and corresponding updates) as CVE-2024-27807.

Thank you Damnatus. 🙂

-Dave

I can understand that 1P_Dave. Thank you for your patience. I have now asked Apple Security if sysdiagnose potentially collects third party app user data.

I will let you know when the case either gets closed or resolved.

Damnatus

Since Sysdiagnose isn't made by our team we're unable to provide advice on how to use it or analysis on the information that it collects. We don't want to give you incorrect information about another company's product, especially when that information concerns your privacy.

Reaching out to discuss this with the developer of the tool, Apple, is the best option. I'm sorry that I'm not able to help more.

-Dave

Hi 1P_Dave, yep read through the page carefully already ☺️ and got the Privacy Policy linked and that the logs „might contain personal information found on your device or associated with your iCloud accounts and/or Apple ID, including but not limited to your name, user name, email address, email settings, file paths, file names, downloads, your computer's IP addresses, and network connection“ and that they do not share with other companies. I think that this is the extend of detail I can expect.

Sure I can go through the logs, but as it is a systemwide log dump, that is practically not humanly doable for a person, especially when not knowing what to look for.

That’s why I asked if you or the iOS Dev Team maybe have more insight in regard to how sysdiagnose and 1Password interact in regards to personal information.

After looking at the Security Design White Paper again ( https://1passwordstatic.com/files/security/1password-white-paper.pdf#page18 ), there shouldn’t be much as authentication via biometrics is handled through Secure Enclave and only item overview is seen after authentication, but no item details are
decrypted until actively chosen and closing the app should clear temporary written data.

Damnatus

Thanks for the update! You can find more information about Sysdiagnose tool on Apple's website: Using Sysdiagnose to Troubleshoot iOS or iPadOS — Apple Device Support Tutorials | Apple Training

You're able to open the log and review it to see what it contains before sending it to Apple Support.

For details about what kind of information the tool collects I would reach out to Apple Support since they would be in the best position to answer those questions and to clarify how that information is handled according to their privacy policy.

-Dave

Hi 1P_Dave,

I’ve heard back from Apple with a request for video demonstrating the use of 1Password 8 and the App Privacy Report and then run sysdiagnose and send it too as they’re not able to reproduce it.

I haven’t used sysdiagnose and as you and/or your colleagues from the iOS Dev Team have way more experience with that, it would be nice if you could answer some questions.

My cursory research shows that it is diagnostic snapshot. I have not found info about how to end it but that it can take up to 10 Mins to collect the data.

1. Do you know what timeframe is logged?

As this is my private device, I feel hesitant in disclosing personal info, especially when it’s a sysdiag log around my password manager.

1. what is your/ the iOS Dev Teams experience with sysdiagnose logging around the 1Password app, specifically with potential personal info leakage into logs?

(There just recently has been a fix in iOS 17.3 where the phone number could be extracted through logs, so I’m just extra careful and try to cover my bases. Which is hard when being not a programmer but understanding just enough to know about the potential risks). I also know that Apple is usually decent in privacy preserving logging, but because a password manager is involved, I want to double check.

Thanks!

Damnatus

Thank you for reporting the iOS App Privacy Report issue to Apple! I'm not sure how they would classify this but, if you can, please do let me know if you hear back from them.

-Dave

Good to know 1P_Dave! I made a report to Apple and included the link to this thread. What I found curious was that the Feedback Assistant Website from Apple was blank after log in (probably bc I’m no registered dev or don’t use beta), so I made the report via the Security Bounty. Not sure if it qualifies for that, but as it is a Privacy feature partly circumvented, I felt it could be counted as vulnerability. What’s your take on that, if you don’t mind me asking.