You probably can't trust your password manager if it's compromised

Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised. The team, comprised of researchers from ETH Zurich and Università della Svizzera italiana (USI), examined the "zero-knowledge encryption" promises made by Bitwarden, LastPass, and Dashlane, finding all three could expose passwords if attackers compromised servers. The premise of zero-knowledge encryption is that user passwords are encrypted on their device, and the password manager's server acts merely as a dumb storage box for the encrypted credentials. Therefore, in the event that the vendor's servers are controlled by malicious parties, attackers wouldn't be able to view users' secrets. As one of the most popular alternatives to Apple and Google's own password managers, which together dominate the market, the researchers found Bitwarden was most susceptible to attacks, with 12 working against the open-source product. Seven distinct attacks worked against LastPass, and six succeeded in Dashlane. The attacks don't exploit weaknesses in the same way that remote attackers could exploit vulnerabilities and target specific users. Instead, the researchers worked to test each platform's ability to keep secrets safe in the event they were compromised. In most cases where attacks were successful, the researchers said they could retrieve encrypted passwords from the user, and in some cases, change the ent...