A recent investigation by WIRED has uncovered troubling design vulnerabilities in widely used cloud-based password managers — including Bitwarden, Dashlane, and LastPass — challenging long-standing claims about their security and potential to fully protect users’ sensitive credentials.

Password Managers Under the Microscope

Password managers have long been recommended as one of the most practical ways to generate and store unique, strong passwords for dozens of online accounts. They promise zero-knowledge encryption, meaning the service provider cannot access users’ unencrypted passwords. This capability has made them a cornerstone of modern cybersecurity best practices.

However, a new study led by researchers at ETH Zurich and the Università della Svizzera italiana found that these claims don’t always hold up in practice. Under certain conditions, attackers could exploit cryptographic and architectural weaknesses to gain unauthorized access to users’ encrypted password vaults, or even modify the contents — effectively undermining the core promise of security.

What the Research Found

The analysis focused on several popular password managers and revealed a range of attack paths tied to how encrypted vaults are stored and managed. Key vulnerabilities include:

  • Weak server-side handling of encrypted vault data.

  • Flaws in key escrow or account-recovery features that create additional risk pathways.

  • Poor segregation of cryptographic keys.

  • Legacy or insufficiently authenticated encryption schemes that allow data tampering.

In some cases, these issues could allow a malicious actor with access to the password manager’s server infrastructure to decrypt, alter, or manipulate a user’s entire set of credentials. The vulnerabilities varied by product and by specific features enabled, but the fact that multiple independent weaknesses were found highlights a systemic issue in how some password vaults are implemented.

Why This Matters for Users

Cloud-based password managers are popular precisely because they sync securely across devices and create a centralized way to manage online identity credentials. But if the encryption protections these services claim can be bypassed — even under rare threat models — users could face the risk of widespread credential theft or account takeovers without warning.

The results also underscore the tradeoff between convenience features (like cross-device sync and recovery options) and the complexity risks they introduce, especially if not paired with rigorous cryptographic safeguards.

What Users and Vendors Can Do

While commercial vendors have largely embraced zero-knowledge architectures, researchers recommend more extensive security reviews and updates to cryptographic practices to address design flaws. Users concerned about potential risk can take immediate steps such as:

  • Enabling multi-factor authentication (MFA) wherever supported.

  • Keeping password manager software fully updated.

  • Reviewing vendor security advisories and responses.

  • Minimizing use of advanced features like automatic recovery when possible until fixes are released.

Vendors, for their part, are being urged to adopt modern cryptographic standards, provide transparency around security architecture, and actively mitigate reported vulnerabilities — especially those that could allow malicious insiders or sophisticated attackers to exploit encrypted data.

Source: https://www.wired.com/story/security-news-this-week-password-managers-share-a-hidden-weakness/