PASSWORD MANAGERS LESS SECURE THAN PROMISED

Summary from the TLDR InfoSec newsletter

ETH Zurich's Applied Cryptography Group demonstrated 25 total attacks across Bitwarden (12), LastPass (7), and Dashlane (6), collectively serving ~60 million users breaking their "zero-knowledge encryption" guarantees by operating a malicious server that deviates from expected client behavior during routine actions such as login, vault access, and sync. Attacks ranged from targeted vault integrity violations to full organizational vault compromise, requiring only lightweight server-impersonation tooling rather than significant computational resources, with the root cause attributed to feature-bloat complexity and reliance on obsolete 1990s-era cryptographic primitives. Security teams should evaluate password manager vendors against criteria of transparent vulnerability disclosure, third-party audits, and modern end-to-end encryption enabled by default, pending publication of full findings at USENIX Security 2026.