What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour?

I have found two publications from usenix.org here and here that show detailed explanation for the cases mentioned above.

I would appreciate answers, that are based on current research on commonly used Password Managers (regardless of the Operating System). The threat model or attack may use CSRF, XSS or autofill, but should not be the main attack vector or use an entirely different approach of these, than in the linked papers.

I am open for all suggestions including self-promotion of research. This question is not intended to let you do the search for publications, it is just for answers in case you already know of such attacks and would like to share these information.

  • 2
    My colleague discovered this bug in Chrome which let any website steal you LastPass passwords
    – paj28
    Oct 14 '15 at 19:23
  • 1
    @schroeder That is understandable, sorry for that. I edited the question, which hopefully is more appropriate.
    – John
    Oct 15 '15 at 17:00
  • @John I re-opened it for you
    – schroeder
    Oct 15 '15 at 17:01

There was a presentation at BlackHat Europe 2015 about weaknesses in Lastpass.

  • Very nice find!
    – John
    Nov 26 '15 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.