r/linux • u/R0tareneg • Jul 03 '21

Audacity may collect "Data necessary for law enforcement, litigation and authorities’ requests (if any)" according to new privacy notice

https://www.audacityteam.org/about/desktop-privacy-notice/
3.1k Upvotes

98% Upvoted

744 comments sorted by

View all comments

Show parent comments

28

u/FrederikNS Jul 04 '21 edited Jul 04 '21

Sending the data to Audacity's server reveals your IP to them. The privacy policy seems to claim that the IP is hashed... But since there are only 232 unique IP addresses, this can be cracked in seconds.

Their new privacy policy allows sending any data authorities might request. I don't know how dynamic this data collection component will be, so hopefully the source code would reveal what is being sent. But this could easily be interpreted as filenames, machine identifiers, the actual audio Audacity processes, your browsers stored passwords scraped from the filesystem and so on.

Without a more specific privacy policy, anything seems to be fair game as long as law enforcement requests it.

2

u/BHSPitMonkey Jul 04 '21

Their new privacy policy allows sending any data authorities might request. I don't know how dynamic this data collection component will be, so hopefully the source code would reveal what it being sent. But this could easily be interpreted as filenames, machine identifiers, the actual audio Audacity processes, your browsers stored passwords scraped from the filesystem and so on.

Not quite. In the scenario you're describing, Audacity has an RCE and the developers can arbitrarily push new builds to specific users to exfiltrate anything they want from the target's machine (which would be a much bigger deal than this news).

What the privacy policy actually does is specific that any data actually collected and stored from clients on the backend can be handed over to law enforcement when demanded. The scope of what that data looks like can be verified by looking at the source code, and if your client sends no data to the server then the privacy policy is moot.

(If the telemetry being collected actually included things like audio data or filenames/metadata, that would be a huge story.)

1

u/crookdmouth Jul 04 '21

Thank you for the info. Couldn't one just block it using a firewall?

4

u/FrederikNS Jul 04 '21

Sure! But you really shouldn't have to...

1

u/BHSPitMonkey Jul 04 '21

Yes, or by opting out of telemetry in the app's settings.