#roboform — Public Fediverse posts

Passwortmanager sind angreifbar. Das fand Marek Tóth heraus und berichtete darüber auf der #DefCon33:
https://marektoth.com/blog/dom-based-extension-clickjacking/
Die von Tóth aufgedeckten Schwachstellen ermöglichen es Hackern, sensible Daten aus Passwort-Managern zu stehlen, darunter Kreditkartendaten, Namen, Adressen und Telefonnummern, wenn ein Opfer eine bösartige Website besucht. Darüber hinaus können Hacker, wenn eine anfällige Website, auf der Ihre Passwort-Manager-Anmeldedaten gespeichert sind, eine Cross-Site-Scripting-Schwachstelle (XSS) oder eine Subdomain-Übernahme aufweist, diese ausnutzen, um Anmeldedaten (Benutzernamen und Passwörter), 2FA-Codes und Passkeys zu stehlen.
Nach Updates gelten inzwischen folgende Passwortmanager als sicher: #Bitwarden #Dashlane, #Keeper, #NordPass, #ProtonPass & #RoboForm.

#infosec #passwortmanager #2FA#security #privacy #BeDiS

#Zeroday #Clickjacking #exploit impacts several #passwordmanagers

https://www.ghacks.net/2025/08/21/zero-day-clickjacking-exploit-impacts-several-password-managers/?utm_source=mas.to&utm_medium=social&utm_campaign=&utm_term=&utm_content=&utm_referrer=https%3A%2F%2Fmas.to%2F%40KNTRO&utm_id=&utm_creative=&utm_channel=mastodon_organic&utm_platform=desktop&utm_location=argentina&utm_language=es-ar&utm_variant=

#Zero_Day #Password #Passwords #PasswordManager #0day #0_day #MarekTóth #Tóth #1Password #Bitwarden #Dashlane #Enpass #iCloudPasswords #Keeper #LastPass #LogMeOnce #NordPass #ProtonPass #RoboForm #Cybersecurity #Socket #KeePass

#Zeroday #Clickjacking #exploit impacts several #passwordmanagers

https://www.ghacks.net/2025/08/21/zero-day-clickjacking-exploit-impacts-several-password-managers/?utm_source=mas.to&utm_medium=social&utm_campaign=&utm_term=&utm_content=&utm_referrer=https%3A%2F%2Fmas.to%2F%40KNTRO&utm_id=&utm_creative=&utm_channel=mastodon_organic&utm_platform=desktop&utm_location=argentina&utm_language=es-ar&utm_variant=

#Zero_Day #Password #Passwords #PasswordManager #0day #0_day #MarekTóth #Tóth #1Password #Bitwarden #Dashlane #Enpass #iCloudPasswords #Keeper #LastPass #LogMeOnce #NordPass #ProtonPass #RoboForm #Cybersecurity #Socket #KeePass

#Zeroday #Clickjacking #exploit impacts several #passwordmanagers

https://www.ghacks.net/2025/08/21/zero-day-clickjacking-exploit-impacts-several-password-managers/?utm_source=mas.to&utm_medium=social&utm_campaign=&utm_term=&utm_content=&utm_referrer=https%3A%2F%2Fmas.to%2F%40KNTRO&utm_id=&utm_creative=&utm_channel=mastodon_organic&utm_platform=desktop&utm_location=argentina&utm_language=es-ar&utm_variant=

#Zero_Day #Password #Passwords #PasswordManager #0day #0_day #MarekTóth #Tóth #1Password #Bitwarden #Dashlane #Enpass #iCloudPasswords #Keeper #LastPass #LogMeOnce #NordPass #ProtonPass #RoboForm #Cybersecurity #Socket #KeePass

#Zeroday #Clickjacking #exploit impacts several #passwordmanagers

https://www.ghacks.net/2025/08/21/zero-day-clickjacking-exploit-impacts-several-password-managers/?utm_source=mas.to&utm_medium=social&utm_campaign=&utm_term=&utm_content=&utm_referrer=https%3A%2F%2Fmas.to%2F%40KNTRO&utm_id=&utm_creative=&utm_channel=mastodon_organic&utm_platform=desktop&utm_location=argentina&utm_language=es-ar&utm_variant=

#Zero_Day #Password #Passwords #PasswordManager #0day #0_day #MarekTóth #Tóth #1Password #Bitwarden #Dashlane #Enpass #iCloudPasswords #Keeper #LastPass #LogMeOnce #NordPass #ProtonPass #RoboForm #Cybersecurity #Socket #KeePass

Security Week 2423: о плохих генераторах случайных чисел и пароле к криптокошельку

«Взлом» криптокошелька, пароль к которому был утерян больше 10 лет назад, — это самая красивая история по теме кибербезопасности на прошлой неделе. Пожелавший остаться анонимным пользователь приобрел биткоины на сумму примерно 4000 евро в 2013 году. Криптовалюта хранилась в цифровом кошельке, доступ к которому был защищен паролем. Известный исследователь Джо Гранд на пару с коллегой помогли владельцу криптокошелька восстановить пароль, и не при помощи простого перебора, а, как правильно отметили в обсуждении на Хабре, «решив проблему мозгами». Джо Гранд любит подавать свои истории красиво, он снял видео и дал интервью журналу Wired, где использовал красивые и понятные более широкой аудитории метафоры типа «мы нашли способ повернуть время вспять». Реально интересная техническая информация этой работы, впрочем, уместилась на одну страницу текстом . Для облегчения «взлома» криптокошелька хакерам требовалось уменьшить количество возможных вариаций пароля для перебора. Им удалось это сделать благодаря одной особенности программы RoboForm, которую владелец кошелька использовал для генерации пароля. И это, пожалуй, самое интересное: анализ старой версии RoboForm показывает нам пример, как не надо генерировать случайные последовательности символов.

https://habr.com/ru/companies/kaspersky/articles/819063/

#RoboForm

The #RoboForm password regeneration source code and technical notes are up! https://grandideastudio.com/portfolio/security/roboform-password-regeneration/

How Researchers Cracked an 11-Year-Old #Password to a $3 Million#CryptoWallet

Thanks to a flaw in a decade-old version of the #RoboForm password manager and a bit of luck, researchers were able to unearth the password to a #crypto wallet containing a fortune.
#security

https://www.wired.com/story/roboform-password-3-million-dollar-crypto-wallet/

World Password Day: Top 10 Password Managers for Ultimate Digital Safety https://thecyberexpress.com/top-password-managers-for-digital-safety/ #GooglePasswordManager #TheCyberExpressNews #PasswordManagers #WorldPasswordDay #TheCyberExpress #FirewallDaily #1Password #Bitwarden #LogMeOnce #ZohoVault #Features #Dashlane #NordPass #RoboForm #Enpass #Keeper

@stk @shipp @mmiasma @tokyo_0 @cooopsspace
@alfredo @xmetal
EN

Thanks SO much everyone for the tips and encouragement about dealing with my gmail password problems! I've purchased and installed #Roboform as an affordable #PasswordManager and I've set them as the default for passwords on my phone. Always a learning curve with a new process. Since I have 2FA for Google, it's possible that folks couldn't do anything with my password, even if they found it. I've had no unusual security alerts.

Which password manager do you use? If you choose other, please comment and mention which one you use.

P. S.: About to migrate away from LastPass and am looking for suggestions...

#lastpass #hack #hacked #passwords #1password #bitwarden #nordpass #roboform #iolo #totalav #kaspersky #vault #security

Which password manager do you use? If you choose other, please comment and mention which one you use.

P. S.: About to migrate away from LastPass and am looking for suggestions...

#lastpass #hack #hacked #passwords #1password #bitwarden #nordpass #roboform #iolo #totalav #kaspersky #vault #security

Which password manager do you use? If you choose other, please comment and mention which one you use.

P. S.: About to migrate away from LastPass and am looking for suggestions...

#lastpass #hack #hacked #passwords #1password #bitwarden #nordpass #roboform #iolo #totalav #kaspersky #vault #security

Which password manager do you use? If you choose other, please comment and mention which one you use.

P. S.: About to migrate away from LastPass and am looking for suggestions...

#lastpass #hack #hacked #passwords #1password #bitwarden #nordpass #roboform #iolo #totalav #kaspersky #vault #security

Which password manager do you use? If you choose other, please comment and mention which one you use.

P. S.: About to migrate away from LastPass and am looking for suggestions...

#lastpass #hack #hacked #passwords #1password #bitwarden #nordpass #roboform #iolo #totalav #kaspersky #vault #security

I haven't used #LastPass for about 4 years, but certainly I still had a vault on their server.
I've been using #Roboform, and took at a look at it today.
Of the 2,000 logins, about 300 were classified as weak #passwords, or had turned up at some point in HIBP.

I started changing the weak ones. Since I've been on the internet 30 years, there was a shitload of sites that were long gone, merged or which I had log forgotten. Yet my password manager keeps those for me, forever. Throwing more garbage onto a never ending pile of passwords that can only get bigger.

I don't have time to regularly change 2,000 passwords. I can't manage the time to weed the website garden.

It seems every year there's a great idea for replacing the password that never comes to adoption. Meanwhile, the password pile gets even deeper.

I'm seriously considering a clean start. A change of phone number, change of email, just pick the top 50 sites I regularly use, scale back the online services I use, and let everything else just rot.

@jenny_sivapalan If you do look to moving in be been very happy with #RoboForm.

Quelqu'un a des idées à partager pour un #gestionnaire de #password *libre* pour une équipe ?

J'adore #KeePass mais il ne permet pas de partager des password entre plusieurs personnes facilement...

J'aimerais éviter qu'on parte sur une solution privatrice ( #1password , #roboform ou #lastpass ... ).