Password Managers' Zero-Knowledge Claims Debunked

The security of password managers has been called into question after researchers revealed vulnerabilities in popular password managers.

TL;DR
• Password managers' zero-knowledge claims have been debunked by researchers.
• The researchers revealed vulnerabilities in popular password managers, including Bitwarden, Dashlane, and LastPass.
• The attacks allow an adversary to steal data and, in some cases, entire vaults.

Summary
Password managers have become essential security tools, with 94 million US adults using them. These tools store sensitive data, including passwords, cryptocurrency credentials, and payment card numbers, and claim to offer 'zero knowledge' encryption, meaning only users can access their data. However, research has revealed that these claims may not be entirely true, particularly when account recovery is in place or password managers are set to share vaults or organize users into groups.

The research analyzed top password managers Bitwarden, Dashlane, and LastPass, and found vulnerabilities that allow someone with control over the server to steal data and entire vaults. These vulnerabilities include weaknesses in key escrow mechanisms, account recovery processes, and support for legacy versions. For instance, an attack on Bitwarden's account recovery process allows an adversary to replace a group's public key with their own, enabling them to decrypt ciphertext and access a user's vault.

The researchers also found that all three password managers provide backward compatibility to support older, less-secure versions, which can be exploited to gain unauthorized access. Furthermore, attacks targeting 'item-level encryption' or 'vault malleability' can swap fields within an item, allowing an adversary to steal passwords from select vault items.

To protect customers, password managers must prioritize security and implement measures such as regular security audits, penetration testing, and bug bounty programs. For example, Bitwarden conducts internal reviews and third-party assessments, while LastPass participates in AWS's Security Improvement Program. 1Password also undergoes rigorous security testing and assures that its 'zero-knowledge' encryption means that only users can access and decrypt their data.

Key takeaways include:
• Password managers' 'zero knowledge' claims may be overstated.
• Vulnerabilities exist in account recovery processes and support for legacy versions.
• Regular security audits and penetration testing are crucial.
• Password managers must prioritize security to maintain user trust.

The security of password managers is a complex issue, and users should be aware of the potential risks and take steps to protect their online security.