A recap of key research presented at Real World Cryptography 2026 in Taipei, covering three major themes: vulnerabilities in cloud-based password managers (27 attacks found across four products including Bitwarden, LastPass, and Dashlane), physical memory interposition attacks against AMD and Intel trusted execution environments using hobbyist hardware to recover private keys, and a broader reflection on how non-human identities (API keys, OAuth tokens) remain stuck in the 'password era' of authentication. GitGuardian also presented their own research mapping nearly 1 million leaked private keys to certificates via Certificate Transparency logs.
Table of contents
When secret managers fail: a cryptography nightmareShould you trust your trusted execution environment?The tools are not enoughUntil next timeSort: