Submitted 10 hours ago by floofloof@lemmy.ca to technology@lemmy.world
https://www.theregister.com/2026/02/16/password_managers/
cross-posted from: infosec.pub/post/42164102
Researchers demo weaknesses affecting some of the most popular options Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised.…
Since the summary doesn’t say which three popular password managers:
As one of the most popular alternatives to Apple and Google’s own password managers, which together dominate the market, the researchers found Bitwarden was most susceptible to attacks, with 12 working against the open-source product. Seven distinct attacks worked against LastPass, and six succeeded in Dashlane.
Next do proton pass
Anything against keepass
Bitwarden. Shit.
These attacks are more around the encryption and all require a fully malicious server. It sounds like Bitwarden is taking these seriously and personally I’d still strongly prefer it to any closed source solution where there could be many more unknown but undiscovered security concerns.
Using a local solution is always most secure, but imo you should first ask yourself if you trust your own security practices and whether you have sufficient hardware redundancy to be actually better. I managed to lose the private key to some Bitcoin about a decade ago due to trying to be clever with encryption and local redundant copies.
Further, with the prevalence of 2FA even if their server was somehow fully compromised as long as you use a different authenticator app than Bitwarden you’re not at major risk anyways. With how poorly the average person manages their password security this hurdle alone is likely enough to stop all but attacks targeted specifically at you as an individual.
Just adding: Passkeys do migitate a lot of these issues as well.
I don’t have the self hosting maturity to share my db across my devices yet. I need to get on that.
Thats really disappointing. At least the selfhosted version means it would have to be a heavily targeted attack.
Which in turn is based off of KeePass, right? So double shit?
no, Bitwarden isn’t “based off” anything
Bitwarden says all issues have already been addressed.
https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/
Yes, although it sounds like they haven’t finished fixing some of them:
All issues have been addressed by Bitwarden. Seven of which have been resolved or are in active remediation by the Bitwarden team. The remaining three issues have been accepted as intentional design decisions necessary for product functionality.
Looking through, it seems like for the most part these are very niche and/or require the user to be using SSO or enterprise recovery options and/or try to change and rotate keys or resync often. I think few people using this for personal would be interacting with that attack surface or accepting organizational invites, but it is serious for organizations (probably why they’re trying quickly to address this).
Honestly I think a server being incognito controlled and undetected in bitwardens fleet while also performing these attacks is, unlikely? Certainly less likely than passwords being stolen from individual site hacks or probably even banks. Like at that point, it would just be easier to do these types of manipulations directly on bank accounts or crypto wallets or email accounts than here, but then again, if you crack a wallet like this you get theoretically all the goodies to those too I suppose, for a possibly short time (assuming the user wasn’t using 2FA that wasn’t email based as well).
Not to mitigate these issues. They need to fix them, just trying to ascertain how severe and if individual users should have much cause for concern.
Ah, great. Carrying on…
I suggest KeepassXC, I like it. Can use it with TOTP too
Keepass + Syncthing for cloudless sync between devices. Dreamteam.
Yess!
I store the keepass vault on my nextcloud
On iOS and macOS, I use Strongbox pro (one time purchase), as it integrates beautifully into the apple ecosystem using its APIs.
On linux and windows free KeepassXC with browser plug-ins
On Android I use the free keePassDX which, like strongbox, uses the android APIs for passwords
Same. My password database never touches a server I don’t own and my keyfile is manually copied between my devices and stored separately from the database file.
I know they’re convenient, but people should really stop using cloud-based password managers and start using local ones. I personally recommend KeepassXC.
And keepass is perfectly cloud ready by placing the kdbx file into your cloud storage and sync using webDav or similar.
Keepass, upload the database file to random free cloud accounts after making changes to the database.
This is foulproof as long as the end-user device doesn’t get hacked, right?
Yes and no. You can store them in a free cloud account, provided you have local copies; there’s a risk your access to the cloud storage could be denied. A security risk is that they could harvest these databases, and decrypt them later.
I think your best bet, if you were to use free services, is to delete old databases from the cloud. Encrypt the new databases with the updated password manager and a new master password.
I store my passwords on a flash drive with KeepassXC. How about you compromise that server… Oh wait a minute, no server?
As long as your copy isn’t a trojan.
So just get it from your repo.
People really use these apps? I mean…here are all my passwords? …just like that?
Hell, my kids tutor wanted my bank account to withdraw each month. I said, ‘fuck no…not unless we’re banging each other every night with a prenup!’
Oh, God. Shut up.
Your tutor asked for access… To your bank account?
What’s a metaphor?
What do you do? Use one password for everything?
Breaking news, rain is wet.
That is why this article is significant.
Anyone got a good suggestion for a self hosted option? Ideally one that has a good iOS app and a web interface.
You can self-host Bitwarden. Or there’s the Vaultwarden implementation of the Bitwarden API.
You take the good, you take the bad, you take them both and there you have The facts of life, the facts of life.
There’s a time you got to go and show You’re growin’ now you know about The facts of life, the facts of life.
When the world never seems to be livin up to your dreams And suddenly you’re finding out the facts of life are all about you, you.
Engywuck@lemmy.zip 3 hours ago
No shit?