Trusting Zenarmor (fka Sensei) / Sunny Valley Networks

[firewall]

If privacy is such a concern to you then dont use sensei.

I'm not even sure the developers would agree with that position.

Thats a fact of life for commercial products.

Only it's not. There's no need or requirement to egress data from a user's machine or network beyond those imposed by software manufacturers. Not licensing, not usage or bug reports, nor data/metadata collected through the use of their products.

Dont use Azure, dont use O365, dont use AWS, dont use anything where some data has to be stored elsewhere.

Huh? Utilization of cloud-based products and services always requires deployment of local assets? You seem to be misunderstanding my use case. This has nothing to do with "data stored elsewhere", rather what that data is comprised of and for what purpose it was collected in the first place.

Not everyone's needs are the same and clearly ours are markedly different. Again, you do you.

[almodovaris]

I don't plead "I have nothing to hide" (e.g. my credit card number).

But I do plead that I don't bother that SunnyValley reads my websurfing data.

You should know that lack of privacy may also work to exonerate you of committing a crime.

If I want to do something that passes unseen through Zenarmor, I use VPN (e.g. Opera with VPN).

But no, as long as you use the internet you have no privacy, you're just fooling yourself that you have privacy.

And sometimes not using the internet does not protect you from data leaks from the government, or insurance companies, or hotel chains.

As the saying goes, Google knows a lot about you, even if you have never used it.

So, it is all a matter of trust: do you trust security professionals or do you trust the DD-WRT or Lineage OS approach (if it works, fine, if not, wait till someone bothers to address that bug).

[offbyone]

Hi, a new OPNsense user here. I was about to setup Zenarmor onto my router, decided to do a quick lookup on the topic and found this thread.

It's ceases to amaze me how little people are interested in how their data is treated. I totally agree with firewalls posts.

I'd love to hear info on what data is collected and is it in any way anonymized. I understand that some data collection may be needed in some cases, but the data can be handled in many ways. And when handled badly, it can get in to wrong hands. Why would I use OPNsense among other things in the first place if I wasn't interested about my data..

Zenarmor seems to be a great product, but if I don't know how it works, I'm not sure if I need it that much.

[almodovaris]

Listen, my calculation is this: I will stop paying for Kaspersky (my internet provider provides me with 20 licenses for F-Secure, branded with the name of the provider). So, I will be still covered in respect to using an antivirus, and I will pay two licenses for Zenarmor: one for my house and one for the house of my parents.

So, whether it's Kaspersky or Zenarmor who reads my data it is pretty much the same situation.

[Styx13]

Hello,

I would also be interested in understanding the data that Zenarmor shares with Sunny Valley server/services and other third party.

I have been using the free version in passive mode, and I would consider purchasing a license and use it in active mode. However, I would like a clear understanding of what data is shared, how often, why and how it is affected by the different options available in the configuration.

After all, I consider Zenarmor as a shield against not only malware and other cyber threats but also against the data collection done by so many companies and actors online. So if Zenarmor itself does some data collection/sharing, transparency about what data is shared as well some control over it seems pretty important.

@mb, I notice links to "View Privacy Policy" on most configuration page, but neither the privacy policy page or the documentation details the data collected by zenarmor and how to control it. (for example, when "Cloud Threat Intel" is enabled, does zenarmor shares any of my data with Sunny Valley or other third party ?, or when enabling "health check" ?). Would it be possible to get more information about that ? Thanks.

[FullyBorked]

I might be missing something in this thread and not going to get caught up in the argument.  But you can view their privacy policy here https://www.sunnyvalley.io/legal/privacy-policy.  This will detail what they collect and how they use it.  Read through this and you can make your decision if you are comfortable with the policy or not.   

[Styx13]

The privacy policies here  https://www.sunnyvalley.io/legal/privacy-policy do give some information, but not enough details to build the trust that I would think a lot of users are looking for.

A lot of people implementing such solution (including me) are usually looking for both security and privacy (data security/privacy). Ideally, once such solution is implemented, it would not "leak" any kind of data at all.
While this is very difficult (but not impossible), I can understand that some data has to be shared for certain features.
In that case, I would like to have details and information about the exact type of data that is being shared, for how long and what controls I have over it.

It seems that some pieces are here (some in privacy policy, some in the doc), but it is not clearly spelled out and it feels like some features that "may" be sharing data are not identified as such.

We learn from sy that 2 features that send data out there can be disabled in configuration.

After disabling the Cloud Portal, Zenarmor queries web traffic for Threat intel and sends the heartbeat. You can configure both on Configuration - Cloud threat Intel and Configuration - Updates & Health.

While the configuration for Cloud Threat Intel was indicated in the documentation, I did not know that the heartbeat was actually also sending data out to Sunny Valley.
It would help building trust if it was clearly spelled out that those 2 features are sending data out (and what data exactly) and that you can disable them if you do not want your data to be shared (directly in the web ui - there's this little "i" icon to put descriptions and details for the different options/parameters).
It also makes me wonder if there could be other features/parts of zenarmor that may also be sharing data without my awareness ?

At the end of the day, once data has been shared, it is out of your control (unless you're being granted some control over that shared data) and trust is the only thing left.
For me, it requires more transparency and details to get that trust. It may also require giving more control over the shared data to the owner of said data.

So in the current state, there is not enough details, transparency and controls for me to trust and be comfortable enough to use zenarmor.

As said before, I have been considering purchasing a subscription (which requires sharing more information), because zenarmor does a good job at integration (with OPNSense), and detecting and blocking threats. But It lacks on the data privacy and controls side.

I do hope though that things will evolve on that side (more details and transparency in both documentation and product about what is shared and more control over what is shared) so that I can build that trust.

[mb]

Hi @Styx13,

Thanks for sharing your concerns and suggestions. Very much appreciated and understood.

We've spent almost a year on both the technical and regulation (GDPR, California Consumer Privacy etc.) side of things to align industry best practices and our beloved users' expectations with our infrastructure.

Having said that, we'll go ahead and prepare a document which will provide detailed technical information and guidance on this topic.

We plan to make it available along with 1.11 Release and will update the thread once it's ready.

[Pitango]

Hi mb,

I would like to draw your attention to the quote from the SUNNY VALLEY CYBER SECURITY INC. PRIVACY POLICY

https://www.sunnyvalley.io/legal/privacy-policy

"...persistent identifiers that can be used to identify a user over time across different websites or other online services, purchase information, photographs, video or audio files, and other personal information"

As someone who has been collecting information for a government agency for decades I am very curious to know why you need this information?

[Styx13]

@mb,

Thank you for your reply and I am happy to hear that you plan to get better documentation regarding the data that's being shared/collected.
I look forward to see and check it.

I also hope for "better" (or more) control over the shared/collected data.

If you are interested in ways to better explain and let the end user control how the data is shared and collected, I would gladly share my ideas.

[mb]

Hi @Pitango, for the sake of clarification: were you referring to "other personal information" clause?

Hi @Styx13, my pleasure. And I'll be happy to listen to your ideas. I'll be contacting you with a PM.

[firewall]

Having said that, we'll go ahead and prepare a document which will provide detailed technical information and guidance on this topic.

We plan to make it available along with 1.11 Release and will update the thread once it's ready.

Hello @mb, was this document made available in parallel to the 1.11 Release, as described above?  Perhaps I've missed something in the Release Notes?
https://www.sunnyvalley.io/docs/support/release-notes#111----march-31-2022

[mb]

Hi @firewall,

Thanks for the follow-up. We've discussed this with the team and decided that the best way to go would be to provide our users with a "Privacy Check Tool". 

This way, any updates on the software could also be reflected through the Privacy Check Tool in parallel and without any delay.

This is already in the making and planned to ship with the next major release.

Please see the attached picture (from our Project Mgmt Tool) for the details.

[sghost]

Sorry to bring back the dead here, but i happend to stumble accross this. Jumping down the mans throat for being concerned of his right to privacy grinds my geers enough to post. I have nothing negative to say about sensei or zenarmor, but just riding a brand and keeping with an attitude of screw it is idiot and lazy. Asked and answered as far this goes so I would just like to leave you with a quote. Also, while i'm here, to the opnsense team, great job. Since coming from pfsense i couldnt be happier, ill be looking at spending some cash as a thanks soon.

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say."

[mb]

Hi @sghost,

Thanks for sharing your thoughts. Much appreciated. Your point is well taken and we completely share your point of view.

Taking the chance I want to share Sunny Valley Networks' official stance on Privacy and provide an update on what we've been doing in this regard.

We've spent almost a year on both the technical and regulation (GDPR, California Consumer Privacy etc.) side of things to align industry best practices and our users' expectations with our infrastructure.

Reading our beloved users' feedback afterwards, it became apparent that we also needed to provide "detailed technical information" on what data we're collecting; for what purposes and how our users can manage zenarmor settings to control their data sharing status.

The first idea was adding these information to legal documents; but managing technical detail in legal documents appeared to be more challenging than we originally thought.

After doing an extensive research for industry best practices; It looks like the best method will be providing our users with a dedicated 'Privacy Settings Menu' where we can disclose which information you're sharing, the reasoning behind this and a quick on/off button to disable/enable related functionality so that you can easily control your Privacy posture.

This functionality will ship with the upcoming Zenarmor release 1.12. I'm attaching the screenshot of the aforementioned Privacy menu. 

It's a cliche; but I'll have to say it anyhow just to express our stance: your privacy is utmost important to us. The product has been designed, from ground-zero, keeping this in mind. OPNsense user community is highly privacy-conscious. Working with such a community helped very much as well.

I guess we're the only product offering a Cloud Management capability and at the same time offering the option to store reporting data locally on the user's premises. We store only what is necessary to store in the Cloud. All cloud communications can be monitored through zenarmor agent's cloud agent logs. You'll notice that apart from the connection keep-alives; there'll be no messages going back / forth unless you're signed-on to the Cloud Interface and interacting with the related menus.  From a product development perspective, this kind of approach brings with it a lot of challenges. However, we believe this is the right approach.

Our intent is to provide a privacy-safe and secure environment to our users. If the 'practice' does not align with this 'intent', please be noted that it is unintentional and we're all open to constructive suggestions like the ones in this thread and more than eager to revise our processes, products and services.

In that regard, we've already reached out to several forum users who shared their suggestions. Some of them were kind enough to contribute further ideas which eventually helped create our current approach.

Apart from that, I'd like to also re-iterate that we're open to helping people who might want to conduct an independent analysis of the privacy situation of the product. Please feel free to reach out to privacy - at - sunnyvalley.io . Your suggestions and ideas are always welcome.

Thank you