Password Managers' Secret Flaws Exposed

Popular password managers, including Bitwarden, LastPass, and Dashlane, have been found to contain serious security vulnerabilities. Swiss security researchers demonstrated a range of attacks that could lead to the compromise of user vaults, enabling unauthorized access to and even alteration of stored passwords. These findings were shared with the companies before public disclosure, allowing them time to address the flaws.

The researchers identified complex code architectures within these managers, likely a consequence of features designed for enhanced user experience, such as password recovery and family sharing. However, this complexity appears to have increased the potential attack surface.

The successful exploits did not require extensive computing power, relying instead on simple program interactions that mimic routine user activities. All three affected companies responded to the vulnerability disclosures, though their speed in implementing fixes varied.