Can a password management service safely learn about users' passwords?

Jeffrey P Goldberg, who works on 1Password's research, opens with a concrete research question: is enabling two-factor authentication on a password manager linked to weaker account passwords? He explains that the company deliberately avoids collecting account password strength, so any study has to be designed so no user is put at risk. The central problem is gathering sensitive measurements from client software without exposing them.

He argues that simple anonymization is not enough. Hashed identifiers can often be reversed, and supposedly anonymous datasets can be re-identified once combined with outside data the designer does not control. He reviews privacy approaches: coarse binning of results, the random response method from survey research that encourages honest answers, and differential privacy, which adds calibrated statistical noise to limit re-identification. Homomorphic encryption and multiparty computation can compute over secrets without a trusted third party, but he says they remain too slow and complicated for practical use. A Netflix ratings case illustrates how a dataset released as anonymous was re-identified using public ratings.

The talk ends without an answer, since the research is early and the trade-offs between noise, sample size and confidence are unresolved. The practical takeaway is to assume data will leak, treat statistical error as a normal part of analysis, and design privacy guarantees in from the start. In the Q&A, an attendee suggested encrypting a one-bit strength rating for server-side comparison, which Goldberg said could be workable with existing tools.