Research Reveals Vulnerabilities in Bitwarden, LastPass, and Dashlane Password Managers

Academics from ETH Zurich and Università della Svizzera italiana examined the security of three widely used password managers: Bitwarden, LastPass, and Dashlane. They found that all three platforms could potentially expose user passwords if their servers were compromised, undermining the promise of zero-knowledge encryption. This research highlights a critical gap in the security of password managers, which are often considered safe.

The researchers identified 12 successful attacks against Bitwarden, 7 against LastPass, and 6 against Dashlane. These attacks were not based on exploiting weaknesses but rather on testing the platforms’ abilities to protect user secrets in the event of a server compromise. For instance, 7 of the 12 attacks on Bitwarden led to password disclosure, while only 3 of LastPass’s attacks had the same outcome.

None of the vendors clearly outline the specific threats their password managers protect against, which raises questions about the transparency of their security claims. The researchers noted that many of the successful attacks required routine user interactions, such as logging in or synchronizing data, suggesting that users may unknowingly expose themselves to risks.

Professor Kenneth Paterson from ETH Zurich expressed surprise at the severity of the vulnerabilities found. He emphasized the need for password manager providers to communicate more clearly about the security guarantees their products offer. The researchers recommend that vendors ensure new users are onboarded with the latest cryptographic standards to enhance security.

Dashlane responded positively to the findings, stating they had fixed a significant issue related to the disclosure of passwords. Bitwarden also acknowledged the importance of third-party security assessments, while LastPass indicated they are taking steps to address the identified risks.

The researchers believe that similar vulnerabilities may exist in other password managers, potentially exposing a broader range of users to risks. This situation underscores the importance of ongoing scrutiny and improvement in the security of password management solutions.

• Bitwarden: Found to be the most susceptible with 12 successful attacks against its security.
• LastPass: Experienced 7 distinct attacks that could lead to password disclosure.
• Dashlane: Had 6 successful attacks, with one issue already addressed by the vendor.