I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (see below). Is the Dashlane password manager vulnerable to those problems? Has anyone done an independent security analysis of it to see whteher it shares those problems?
For instance, the following published research paper analyzed the security of five popular password managers (LastPass, RoboForm, My1login, Passwordbox, and NeedMyPassword) and found security vulnerabilities in four of the five:
- The Emperor's New Password Manager: Security Analysis of Web-based Password Managers. Zhiwei Li, Warren He, Devdatta Akhawe, Dawn Song. Usenix Security Symposium, 2014.
However, that paper didn't analyze the Dashlane password manager, perhaps because it has only recently started to get attention and capture significant market share.
Is there any publicly available security analysis of the Dashlane password manager, e.g., to assess whether it is vulnerable to those sorts of vulnerabilities, or any other resources or guidance to help users decide whether they should trust it to be secure?