🚨 New research from ETH Zurich has found that popular password manager's zero-knowledge encryption claims don't fully hold up if their servers are compromised.

[privacyguides@mastodon.neat.computer]

New research from ETH Zurich has found that popular password manager's zero-knowledge encryption claims don't fully hold up if their servers are compromised. ️

LastPass, Dashlane & Bitwarden were identified as being affected, this is significant because cloud password managers commonly claim that their user's data would be unaffected if they were compromised.

#privacy #security #passwordmanager

Password managers don’t protect secrets if pwned

: Researchers demo weaknesses affecting some of the most popular options

(www.theregister.com)

[privacyguides@mastodon.neat.computer]

Secure local password managers

️ For more info visit our site: https://www.privacyguides.org/en/passwords/#local-storage

#passwordmanager #security #privacyguides

[privacyguides@mastodon.neat.computer]

️ Secure cloud password managers

️ For more info visit our site: https://www.privacyguides.org/en/passwords/#cloud-based

#passwordmanager #security #privacyguides

[privacyguides@mastodon.neat.computer]

Dashlane & Bitwarden promptly issued fixes.

LastPass did not issue a fix and stated: "our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zürich team."

In 2022, LastPass experienced a breach that impacted 1.6 million users due to inadequately strong technical and security measures within their infrastructure.

The best time to switch from LastPass was yesterday; the second best is today. ️

Here's what we recommend ️

#lastpass #security

[dazo@infosec.exchange]

@privacyguides A better name for LastPass is LostPass

[dalias@hachyderm.io]

@privacyguides This sounds like the kind of thing that cannot just be "fixed". As far as I can tell, *all three were lying* about their servers being dumb storage without access to your secrets. This is a problem of vendor integrity not a technical problem.

[papaexmatrikulatus@mastodon.social]

@privacyguides
Do you have another source for Bitwarden havin fixed the issues? If i am not mistaking, i can't see where they say something explicit about Bitwarden fixing these issues in the linked article.

[h0m3@mastodon.social]

@dalias @privacyguides Self-host, some things are better of self hosted. And a password manager is one of them. And better without any internet access, your devices can sync when they are on your local network.

[dalias@hachyderm.io]

@h0m3 @privacyguides It doesn't even need self-hosting. It just needs the storage backend to be a pure content-agnostic storage backend for opaque encrypted data, not having some control channel interaction that puts the vendor in a privileged position and locks you in to using their cloud infrastructure.

[helloclippy@techhub.social]

@dalias @h0m3 @privacyguides KeePass is the best option if you don't need cloud sync

[dalias@hachyderm.io]

@helloclippy @h0m3 @privacyguides Cloud sync is good, but only if it's *your choice* of storage and the storage provider doesn't have backdoor access to the password manager.

[h0m3@mastodon.social]

@dalias @helloclippy @privacyguides Yes. Bitwarden allows you to cloud sync to your instance, even using an alternative server application like vaultwarden. Thats the most important feature for me and i would abandon them if they choose to remove it in the future.

"Its open source but you can only connect to our proprietary servers" is a no-go to me

[drathir@mastodon.social]

@privacyguides same old story and yet ppl still not convinced to local only password managers like keepassxc...

[timisch@mastodon.social]

@Papaexmatrikulatus @privacyguides

Security through transparency: ETH Zurich audits Bitwarden cryptography against malicious server scenarios | Bitwarden

A new in-depth security report is available, continuing the Bitwarden commitment to transparency and trusted open source security. The audit, conducted by the prestigious Applied Cryptography Group at ETH Zurich, proactively tested Bitwarden core cryptography operations against the hypothetical event of a maliciously compromised server. All issues identified in the report have been addressed by the Bitwarden team and have been included in the attached cryptography report for full transparency.

Bitwarden (bitwarden.com)

[papaexmatrikulatus@mastodon.social]

@timisch @privacyguides Thank you!

[aerion@nerdculture.de]

@privacyguides
Lastpass is an absolutely AWFUL company.

After LogMeIn got their hands on them the prices skyrocketed from $12 to $24 to $36 to $48 a year for their premium plan.

I switched to Bitwarden, who have kept their premium plan at just $10 a year, for many years now.

With ownership of Lastpass now in the hands of not one, but two investment companies, one really has to question where Lastpass's priorities lie.

[silhouette@dumbfuckingweb.site]

@privacyguides keep assium

[eist@hsnl.social]

@privacyguides what do you recommend for self-hosting a password manager?

[simonzerafa@infosec.exchange]

@h0m3 @dalias @helloclippy @privacyguides

Bitwarden has EU based servers which I would recommend.

The cost for a year of service is very good value IMHO

[dalias@hachyderm.io]

@simonzerafa @h0m3 @helloclippy @privacyguides Where the servers are located doesn't matter if the encryption is done right.