Study finds flaws in cloud password managers ^{CEFR A2}

Many people use password managers because most users have between 100 and 200 passwords and cannot remember them all. Cloud-based managers let users reach their passwords from different devices and share them with family members. Security is critical because these services store sensitive data, including online banking and credit card logins, in encrypted vaults.

Researchers from the Applied Cryptography Group at ETH Zurich studied three popular cloud-based password managers. They set up servers that acted like hacked servers and tested a malicious server threat model. The team demonstrated several attacks that could let an attacker see or change users' passwords. The attacks often used simple actions users normally perform, such as logging in, opening the vault, viewing passwords, or synchronising data.

The researchers followed responsible disclosure and contacted providers before publishing, and they gave the companies 90 days to fix the vulnerabilities. Recommendations include updating systems, offering migration choices for existing customers, and being transparent. Users should prefer managers that undergo external audits and have end-to-end encryption enabled by default.