What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour?

I have found two publications from usenix.org here and here that show detailed explanation for the cases mentioned above.

I would appreciate answers, that are based on current research on commonly used Password Managers (regardless of the Operating System). The threat model or attack may use CSRF, XSS or autofill, but should not be the main attack vector or use an entirely different approach of these, than in the linked papers.

I am open for all suggestions including self-promotion of research. This question is not intended to let you do the search for publications, it is just for answers in case you already know of such attacks and would like to share these information.

  • 2
    My colleague discovered this bug in Chrome which let any website steal you LastPass passwords
    – paj28
    Commented Oct 14, 2015 at 19:23
  • 1
    @schroeder That is understandable, sorry for that. I edited the question, which hopefully is more appropriate.
    – John
    Commented Oct 15, 2015 at 17:00
  • @John I re-opened it for you
    – schroeder
    Commented Oct 15, 2015 at 17:01

1 Answer 1


There was a presentation at BlackHat Europe 2015 about weaknesses in Lastpass.

  • Very nice find!
    – John
    Commented Nov 26, 2015 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .