Researchers Demonstrate 27 Attacks Against Major Password Managers

Researchers demonstrate multiple attacks against major password managers, showing how compromised servers and design flaws can expose encrypted vault data.

We often treat cloud-based password managers as digital safes that only we can open. These services rely on Zero-Knowledge Encryption, a marketing promise that the company storing your data cannot actually see what is inside. However, new research suggests that this safety net is not as secure as many of us assume.

A group of researchers from ETH Zurich and the Università della Svizzera italiana, led by Professor Kenneth Paterson, recently released a paper that should make every security-conscious person concerned. The team executed 27 successful attacks against industry leaders Bitwarden, LastPass, and Dashlane (12 against Bitwarden, 7 against LastPass, and 6 against Dashlane), proving that if a server is compromised by a sophisticated actor, your vault can be unlocked with surprising ease.

How the Vaults Were Broken

The findings ...