Recent research from ETH Zurich and USI has put the spotlight on well-known password managers—Bitwarden, LastPass, and Dashlane—highlighting significant vulnerabilities that challenge their zero-knowledge encryption claims. Despite their assurances that user vault data remains inaccessible even to the companies themselves, the research findings illustrate a different picture.
Under simulated server compromise scenarios, researchers identified 12, 7, and 6 attack vectors in Bitwarden, LastPass, and Dashlane, respectively. These vulnerabilities primarily stem from the use of legacy cryptographic standards to maintain backward compatibility, which inadvertently creates complex code paths ripe for exploitation. For Bitwarden and LastPass, full vault compromise was possible, illustrating the potential risk to user data.
The analysis revealed that Bitwarden and LastPass were susceptible to attacks that could lead to complete vault exposure. On the other hand, Dashlane addressed the most critical flaws by removing support for outdated cryptographic protocols, demonstrating a proactive approach to enhancing security. Additionally, the findings stressed the importance of utilizing up-to-date cryptographic standards across the board.
In related cybersecurity news, other security issues were highlighted, including a CVE with a 7.8 CVSS score affecting Windows 11 Notepad due to vulnerabilities in its Markdown rendering feature. This flaw permits hidden malicious URI links capable of local code execution. Furthermore, Discord sparked privacy debates with the introduction of facial age estimation technology for age-verification on its platform. Beyond these, an Apple zero-day was reported being exploited in the wild, and a Chrome emergency patch was issued to address a use-after-free remote code execution flaw.
In light of these findings, researchers recommend vendors offer clear options for migrating to newer encryption standards while ensuring transparent vulnerability disclosure. This proactive stance can safeguard user data and restore trust in password management services.

Collections

Researchers from ETH Zurich and USI have uncovered significant vulnerabilities in Bitwarden, LastPass, and Dashlane, challenging their zero-knowledge encryption claims. Under simulated server compromise scenarios, they found 12, 7, and 6 attack vectors respectively, with full vault compromise possible in Bitwarden and LastPass. The vulnerabilities largely stem from legacy cryptographic standards maintained for backward compatibility. Dashlane fared better by proactively removing outdated cryptographic protocol support. Researchers recommend vendors provide clear migration paths to modern encryption standards and improve vulnerability disclosure practices. The piece also briefly covers other security news including a Windows 11 Notepad CVE, Discord's facial age estimation feature, an Apple zero-day exploit, and a Chrome emergency patch.

Password Managers Under Scrutiny: Vulnerabilities Unveiled by Researchers