Can you really trust your password manager? It's a question that might leave you feeling a bit uneasy, especially after learning about some recent findings.
A team of researchers from ETH Zurich and Università della Svizzera italiana (USI) has uncovered a series of flaws in three popular password managers, all of which claim to be your digital guardians against credential theft. But here's where it gets controversial: these managers might not be as secure as you think, especially if their servers fall into the wrong hands.
The concept of zero-knowledge encryption, which these managers promise, is simple: your passwords are encrypted on your device, and the manager's server is just a dumb storage box for these encrypted credentials. So, even if malicious parties gain control of the servers, your secrets should remain safe, right?
Unfortunately, the researchers found that this isn't always the case. They examined Bitwarden, LastPass, and Dashlane, and discovered that all three could potentially expose your passwords if their servers were compromised. And this is the part most people miss: these managers, which are often seen as simple key-derivation tools, have complex codebases that offer various features, like account sharing and backward compatibility with older encryption standards, which can introduce vulnerabilities.
The researchers tested each platform's ability to keep your secrets safe by setting up malicious server models that mimicked hacked versions of the password managers' servers. The results were eye-opening: 12 attacks worked against Bitwarden, leading to password disclosure in seven instances; seven distinct attacks succeeded against LastPass, with three leading to password exposure; and six attacks were successful in Dashlane, with one resulting in password disclosure.
The attacks don't exploit remote vulnerabilities or target specific users. Instead, they test the managers' ability to protect your data in the event of a compromise. In most successful attacks, the researchers could retrieve encrypted passwords and, in some cases, even change the entries.
All three vendors claim their products offer zero-knowledge encryption, but none outline the specific threat model their password managers secure against. The researchers argue that password managers have escaped deep academic scrutiny, unlike end-to-end encrypted messaging apps, which have been thoroughly examined.
Kenneth Paterson, a professor of computer science at ETH Zurich, expressed surprise at the severity of the security vulnerabilities affecting these managers. He believes this is because end-to-end encryption is relatively new in commercial services, and no one had examined it in detail before.
The team's recommendation? Ensure new users have access to the latest cryptographic standards by default. This might seem like a simple solution, but it's a challenging task for vendors, as upgrading their codebases could irrevocably lose existing users' secrets. Some vendors have gone to great lengths to support older formats, creating complexity in their code.
The researchers suggest a two-pronged approach: onboard all new users with the latest cryptographic standards and offer existing customers the choice to migrate or stay put, but with full knowledge of the vulnerabilities.
Paterson emphasizes the need for password manager providers to communicate security guarantees clearly and precisely, rather than making false promises. He wants their work to bring about change in the industry, ensuring users can trust the security of their password managers.
The vendors' responses to the research were constructive, with Dashlane fixing the most serious issue and Bitwarden and LastPass working to mitigate the exploited weaknesses. The researchers believe that similar vulnerabilities likely exist across the industry and that advanced hackers, including those with government backing, might already be aware of these attacks.
So, the next time you rely on your password manager, remember: while they offer convenience, they might not be as secure as you think. It's a fine line between convenience and security, and it's up to you to decide where you draw that line.
