Security slip-ups in 1Password and other password managers 'extremely worrying'

Everything's fine now. Patch. Keep using them. Move along

By Thomas Claburn in San Francisco


Password management applications, recommended by many security experts as the only viable way to deal with large sets of passwords that are unique and sufficiently complex, introduce their own set of problems – namely the general fallibility of software.

A group of security researchers called TeamSIK from the Fraunhofer Institute for Secure Information Technology (SIT) in Darmstadt, Germany, on Tuesday published its security assessment of nine popular password management applications on Android devices and found them all wanting.

"The overall results were extremely worrying and revealed that password manager applications, despite their claims, do not provide enough protection mechanisms for the stored passwords and credentials," the group said. "Instead, they abuse the users' confidence and expose them to high risks."

TeamSIK looked at My Passwords, Informaticore Password Manager, LastPass, Keeper, F-Secure KEY, Dashlane, Hide Pictures Keep Safe Vault, Avast Passwords, and 1Password.

In each application, the group identified one or more security vulnerabilities, all of which were reported to app makers and were fixed prior to the publication of the group's findings. Among the better-known password managers, fix times are respectable – a week to a month in most cases. In other words, the bugs disclosed today have been fixed. Make sure you're patched, because now hackers have all the information they need to exploit vulnerable versions of the software.

The flaws identified were sometimes serious, such as storing the master password entered by the user in plaintext or using hard-coded crypto-keys in application code. In other cases, design flaws allowed the researchers to extract supposedly secure credentials using a third-party app.

The researchers observe that many of the apps fail to account for the possibility of clipboard sniffing, which may be done to capture credentials that have been copied into memory in order to paste them into a password entry interface.

Complicating the vulnerability picture, many of these apps implement convenience features that affect app security. For example, some of the apps include a built-in web browser, which expands the scope of possible flaws. Also, the researchers found auto-fill functions in applications could be used to capture stored secrets through "hidden phishing" attacks.

Here's a rundown of the problems found and disclosed today by the team:


Informaticore Password Manager

LastPass Password Manager

Keeper Passwort-Manager

F-Secure KEY Password Manager

Dashlane Password Manager

Hide Pictures Keep Safe Vault

Avast Passwords

1Password – Password Manager

This is not to say that password management applications add more risk than they remove; rather, those using these apps must make maintaining them a priority in order to keep them secure. And if you do that, you're sorted.

"Since all vendors fixed their security issues, our advice to the customers is to always update their apps," said Siegfried Rasthofer, a malware researcher at Fraunhofer SIT, in an email to The Register. ®

Sign up to our NewsletterGet IT in your inbox daily


More from The Register

Google hands out roses to preferred Android MDM vendors

Lucky few get Chocolate Factory's endorsement as Enterprise Mobility Management

Google pholds! Just kidding. But Android Q Beta 2 drop supports those cool bendy mobes

Toying with UI, burstin' bubbles

Google rolls out Android Easter Egg for Europe – a Microsoft antitrust-style browser, search engine choice box

Now how about we forget these fines, eh, mes amies? Meine Freunde? Mis amigos?

Google takes a page from Microsoft of old and revives browser ballot on Android

There's no place like Chrome, but... here are the other guys

Just look at Q! Watch out Microsoft, the next Android has a proper desktop PC mode

Foldable support too

Renegade Android apps can siphon off your web logins, browser history. So make sure Chrome or OS is patched, friends

Kit-Kat API whacked, don't give hackers your phone. This WebView came rolling home

Android clampdown on calls and texts access trashes bunch of apps

Users unchuffed, devs pulling bricked wares off Google Play

Google’s Android Emulator gains AMD and Hyper-V support

But Intel’s HAXM is still ‘Droid’s preferred hypervisor

Did you know that iOS ad clicks cost more than Android? These scammers did

Malware hides cheap Android clicks as high-end Apple traffic

New Android P beta is 'very close', 'near-final' but also just 'early'

How excited to be? Cautiously, unless you need to get cracking with testing for P's big changes