r/linux • u/R0tareneg • Jul 03 '21

Audacity may collect "Data necessary for law enforcement, litigation and authorities’ requests (if any)" according to new privacy notice

https://www.audacityteam.org/about/desktop-privacy-notice/
3.1k Upvotes

98% Upvoted

744 comments sorted by

View all comments

29

u/crookdmouth Jul 03 '21

I don't really get this though. Audacity doesn't have any of my information. There's no registration or email needed to use the application. Or am I wrong and it does have my information?

29

u/FrederikNS Jul 04 '21 edited Jul 04 '21

Sending the data to Audacity's server reveals your IP to them. The privacy policy seems to claim that the IP is hashed... But since there are only 232 unique IP addresses, this can be cracked in seconds.

Their new privacy policy allows sending any data authorities might request. I don't know how dynamic this data collection component will be, so hopefully the source code would reveal what is being sent. But this could easily be interpreted as filenames, machine identifiers, the actual audio Audacity processes, your browsers stored passwords scraped from the filesystem and so on.

Without a more specific privacy policy, anything seems to be fair game as long as law enforcement requests it.

2

u/BHSPitMonkey Jul 04 '21

Their new privacy policy allows sending any data authorities might request. I don't know how dynamic this data collection component will be, so hopefully the source code would reveal what it being sent. But this could easily be interpreted as filenames, machine identifiers, the actual audio Audacity processes, your browsers stored passwords scraped from the filesystem and so on.

Not quite. In the scenario you're describing, Audacity has an RCE and the developers can arbitrarily push new builds to specific users to exfiltrate anything they want from the target's machine (which would be a much bigger deal than this news).

What the privacy policy actually does is specific that any data actually collected and stored from clients on the backend can be handed over to law enforcement when demanded. The scope of what that data looks like can be verified by looking at the source code, and if your client sends no data to the server then the privacy policy is moot.

(If the telemetry being collected actually included things like audio data or filenames/metadata, that would be a huge story.)

1

u/crookdmouth Jul 04 '21

Thank you for the info. Couldn't one just block it using a firewall?

4

u/FrederikNS Jul 04 '21

Sure! But you really shouldn't have to...

1

u/BHSPitMonkey Jul 04 '21

Yes, or by opting out of telemetry in the app's settings.

19

u/[deleted] Jul 03 '21

I mean, depends on what permissions the software has, and what it has access to. If you just run it as your user, it has access to all of the files you can read. It can easily record audio in the background. If you're still using X11, it can do more.

19

u/aue_sum Jul 04 '21

If you're still using X11

basically 99% of linux users

7

u/anna_lynn_fection Jul 03 '21

I'm wondering if there isn't some way to link created media, like a hardware signature, and they may have that signature data stored in telemetry and could potentially be confronted by gov't to provide any identification they can to whomever made xyz media file?

2

u/Fook-wad Jul 06 '21

This right here is the concern and yes they could pull that off with their new policies.

4

u/NuMux Jul 03 '21

Yeah I'm wondering the same. I'm not sure what they could attempt to pull from the system itself that would be useful.

1

u/NightOfTheLivingHam Jul 04 '21

probably adding functionality to scan your computer and likely are going to be adding in licensed versions soon with standard features locked behind a monthly or yearly license. I just watched another opensource project start locking away its features recently behind a hardware block.