Solved These 3 popular password managers are insecure, researchers find

Borg 386 · Feb 18, 2026

Hate to sound old fashioned, but I try to keep as many passwords off my PC as possible. I have a little notebook in my desk drawer where everything is written down. I trust that more then keeping them on a PW manager.

Swiss researchers discovered security vulnerabilities in three popular password managers – Bitwarden, LastPass, and Dashlane – demonstrating multiple potential attacks on each platform.

PCWorld reports these flaws stem from outdated 1990s cryptographic technology and complex code architectures that create additional attack points for cybercriminals.

While no immediate danger exists, the companies have been notified and are working on fixes to protect millions of users’ password vaults.

Your password manager isn't as safe as you think

Security experts have found serious security vulnerabilities in widely-used password managers. Here's what they advise users to do.

www.pcworld.com

cheaterslick · Feb 18, 2026

Bitwarden, LastPass, and Dashlane

You would think these companies would know this by now.

I mean, 1990s technology? They don't (penetrate) test their own software?

Edwin · Feb 18, 2026

Borg 386 said:
These 3 popular password managers are insecure...

What else is new!

BruceR · Feb 18, 2026

These 3 popular password managers are WERE insecure, researchers find

... IF the server had been hacked:

To do this, they set up their own servers that behaved like a hacked password manager server.

As is usual with "friendly" attacks, Paterson's team contacted the providers of the affected systems before publishing the findings. They had 90 days to close the security gaps. "The vendors were mostly cooperative and grateful, but not all of them were equally quick to fix the vulnerabilities," says Paterson.

S0C9 · Feb 18, 2026

BruceR said:
These 3 popular password managers ~~are~~ WERE insecure, researchers find
... IF the server had been hacked:

Yeah, remove the primary security layer and claim the apps are not secure when the server is wide open!
Not really a valid breach test!

pseymour · Feb 18, 2026

The paper doesn't mention the 90s at all, that I can find. In skimming it, I found a reference to "early-2000s cryptography," which I'm assuming means AES?

There haven't been any successful attacks on AES that I know of, but maybe I missed it. BEAST, for example, was an attack on CBC, but that was a flaw in how TLS 1.0 handled the IV, so it was a weakness in TLS, not AES.

Here's the original paper, if anyone wants to read a non-clickbait version of this story. https://eprint.iacr.org/2026/058.pdf

OldNavy · Feb 18, 2026

I think i'm still happy to use Bitwarden.

BruceR · Feb 18, 2026

A much more appropriate headline and summary:

Password managers’ promise that they can’t see your vaults isn’t always true
Contrary to what password managers say, a server compromise can mean game over.

Steve C · Feb 19, 2026

Borg 386 said:
Hate to sound old fashioned, but I try to keep as many passwords off my PC as possible. I have a little notebook in my desk drawer where everything is written down. I trust that more then keeping them on a PW manager.

Your password manager isn't as safe as you think

Security experts have found serious security vulnerabilities in widely-used password managers. Here's what they advise users to do.

www.pcworld.com

I use an 'air gap' too which cannot be hacked over the internet.

kelper · Feb 19, 2026

The security researchers 'hack' relies on bad actors gaining control of the Password Manager's server(s), which seems unlikely. And they only looked at these four - Bitwarden, LastPass, Dashlane and 1Password. These providers, in effect, do not have zero-knowledge.

TairikuOkami · Feb 19, 2026

I do not store core passwords in PM and I do not use convenient features like autofill or extension to be exploited.

Borg 386 · Feb 19, 2026

TairikuOkami said:
I do not store core passwords in PM and I do not use convenient features like autofill or extension to be exploited.

It's surprising how many people nowadays will choose convenience over security. Or maybe it's not, the general attitude is if it saves me a few seconds it'll be the choice.

rezpower · Feb 19, 2026

So what is the safest way to have our passwords saved? maybe an application or a file on PC?

Borg 386 · Feb 19, 2026

rezpower said:
So what is the safest way to have our passwords saved? maybe an application or a file on PC?

It sounds old fashioned, but write it down in a book or on paper. Try to keep PW's off your PC. Assume anything electronic that stores sensitive info might/probably will be hacked eventually. A couple of those password managers have been hacked in the past. Yeah, it's a PIA to have to put them in by hand every time, but IMHO it's the safest way to go.

kelper · Feb 19, 2026

Borg 386 said:
A couple of those password managers have been hacked in the past.

Some customer details were stolen but NO passwords were compromised which shows how secure they are.

Kees · Feb 19, 2026

My method is a password protected XSLX file on my hard disk and a backup of that on an external disk that is stored at an adress somewhere else (trusted family member). For every purpose (shopping, insurances, forum login etc.) I have a separate sheet in the total spreadsheet. I can make notes in that file too, one per account.

A few times in a year I print an overview of all logins and save it in a 'secret' location in the house. So that my wife and that family member can reach it if neccesary (and if all backups have gone lost). My wife (and that family member know the password of the XSLX file as well.

It won't be a 100% hackfree method, but convenient to use and rather safe. My banking login and my DigID (used for official accounts like income taxes and pension benefits) I don't have in that file. Those are just in my head and that of my wife's.

S0C9 · Feb 19, 2026

Borg 386 said:
It sounds old fashioned, but write it down in a book or on paper. Try to keep PW's off your PC. Assume anything electronic that stores sensitive info might/probably will be hacked eventually. A couple of those password managers have been hacked in the past. Yeah, it's a PIA to have to put them in by hand every time, but IMHO it's the safest way to go.

Yeah, I just write mine on a sticky note and attach to side of my monitor at work.. /s

Sorry, couldn’t resist… I have maybe 400+ pswd’s I use, many of which are [work] required to be a 12-char minimum with usual set of upper/lower case, special char and random numbers. Apps, servers, different support tiers, vault requirements and that’s before the personal accounts, home devices, etc. plus those with 2FA that require codes generated by apps like MS, Google, Authy on top! While I agree that writing it down is the best approach to prevent electronic hacks, with the number I have to remember that approach isn’t realistic.
While there are other ways - like spreadsheets - to track them, can’t just have that single source on your home PC. Phone?

PS: ALWAYS use 2FA on any account associated with your finances.. bank, credit card, any web site that you use to purchase stuff.. heck, even social media. And don’t use faceID to access your phone.

Solved These 3 popular password managers are insecure, researchers find

Well-known member

My Computer

Well-known member

My Computers

♦ ♦

My Computers

Well-known member

These 3 popular password managers are WERE insecure, researchers find​

My Computer

Well-known member

These 3 popular password managers are WERE insecure, researchers find​

My Computer

putting the mental back in experimental

My Computer

Well-known member

My Computer

Well-known member

Password managers’ promise that they can’t see your vaults isn’t always true​

My Computer

Well-known member

My Computer

Well-known member

My Computers

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

These 3 popular password managers are WERE insecure, researchers find

These 3 popular password managers are WERE insecure, researchers find

Password managers’ promise that they can’t see your vaults isn’t always true