Technology

Well the specific point here is that these companies claim that a server hack won't reveal your passwords since they're encrypted and decrypted on your local device so the server only sees the encrypted version. Apparently this isn't completely true.

Yeah, the title there really doesn't reflect the article text. It should be "you probably can't trust your password manager if the remote servers it uses are compromised".

Are you trying to say the front fell off?

These password managers claim your passwords are secure, even if their servers get compromised, which is what is expected from a security standpoint. But that is apparently not the case.

Jfc this headline is almost as bad.

Password managers are supposed to be designed to resist a situation where they're compromised, and are only ever supposed to see a mysterious blob of encrypted data without ever having access to any information that would help decrypt it. The headline's more like M1 Abrams Tanks Vulnerable to Small Arms Fire - it'd be totally expected that most things die when shot with bullets, but the point of a tank is that it doesn't, so it's a big deal if it does.

Things you should know: Your car won't drive after it's broken down.

Next do proton pass

And glosses over what it claims are the two that dominate market (combined market share of 55%) which negates their headline, since it's likely the reader is using one of those two password managers.

Source

If you don't have to use your passwords from multiple locations, your hints are intelligible only to you, and you don't leave the paper anywhere too obvious, this isn't a bad solution.

Yes, although it sounds like they haven't finished fixing some of them:

All issues have been addressed by Bitwarden. Seven of which have been resolved or are in active remediation by the Bitwarden team. The remaining three issues have been accepted as intentional design decisions necessary for product functionality.

Edit: There's more information about the specific threats and remediation steps in the PDF report linked at the end of the Bitwarden blog post:

https://bitwarden.com/assets/Kki4W785JIPOdFj6EeWB5/1e74e924febb4c6a5ad03eed23b92d23/pwmgr_paper__1_-combined%C3%82__1_.pdf

These attacks are more around the encryption and all require a fully malicious server. It sounds like Bitwarden is taking these seriously and personally I'd still strongly prefer it to any closed source solution where there could be many more unknown but undiscovered security concerns.

Using a local solution is always most secure, but imo you should first ask yourself if you trust your own security practices and whether you have sufficient hardware redundancy to be actually better. I managed to lose the private key to some Bitcoin about a decade ago due to trying to be clever with encryption and local redundant copies.

Further, with the prevalence of 2FA even if their server was somehow fully compromised as long as you use a different authenticator app than Bitwarden you're not at major risk anyways. With how poorly the average person manages their password security this hurdle alone is likely enough to stop all but attacks targeted specifically at you as an individual.

Or if you have like $5/mo to spend on a VPS, self-host vaultwarden. It's compatible with the bitwarden apps and browser plugins.