Schneier on Security

New research challenges password managers' claims of zero-knowledge architecture. By reverse-engineering Bitwarden, Dashlane, and LastPass, researchers found that server-side control — whether administrative or via compromise — can enable vault theft, especially when account recovery or vault sharing features are enabled. Some attacks can also downgrade encryption enough to convert ciphertext to plaintext. Bruce Schneier highlights Password Safe as an alternative that avoids cloud storage entirely and offers no recovery features, trading convenience for stronger encryption guarantees.