12

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (see below). Is the Dashlane password manager vulnerable to those problems? Has anyone done an independent security analysis of it to see whteher it shares those problems?

For instance, the following published research paper analyzed the security of five popular password managers (LastPass, RoboForm, My1login, Passwordbox, and NeedMyPassword) and found security vulnerabilities in four of the five:

The vulnerabilities ranged from garden-variety XSS and CSRF vulnerabilities, to more obscure attacks based on exploiting bookmarklets and the fact that they might be executed in a context together with malicious Javascript.

However, that paper didn't analyze the Dashlane password manager, perhaps because it has only recently started to get attention and capture significant market share.

Is there any publicly available security analysis of the Dashlane password manager, e.g., to assess whether it is vulnerable to those sorts of vulnerabilities, or any other resources or guidance to help users decide whether they should trust it to be secure?

7

A security analysis was performed in May 2016:

That analysis attempts to look for largely the same types of vulnerabilities as the Li et al. paper cited in the question. They looked for XSS attacks, but found none. They were also able to bypass Dashlane's device authentication feature. Overall, they found Dashlane to be quite secure.

They analyzed Dashlane version 4.1.1. Dashlane has since been updated to version 4.6.8.

2

Anything that stores your password on an online server outside of your control is to be considered insecure; there is no valid reason for your entire password collection to leave your home network.

The software your online password manager service (doesn't only apply to Dashlane) uses is most likely closed source, you know nothing about their security procedures nor if your passwords are really encrypted or just sitting in a passwords.txt file.

Second, their encryption - let's assume they use industry standard crypto that isn't flawed, and the key is your password hashed with a computationally expensive hash to prevent bruteforce... looks great, right ? But what if a rogue sysadmin, developer or attacker gained access to the server ? While he can't directly decrypt the database, he can modify the code that handles logging in to capture your password and wait for you to log in. Also, you may not be a high-profile target and no attacker would waste his time compromising you, but here the attacker instead aims to compromise the entire password manager service to get the passes for all users, not just you.

Then, there's law enforcement, they can almost always force the company to disclose your passwords; if the databases are encrypted they'll probably use the approach stated above and wait for you to log in. While passwords for most online services aren't of much value since law enforcement can also force them to disclose your data, passwords for services in other countries (where L.A. has no authority) or your servers/encrypted drives are very valuable for them.

Now compare that to a Keepass database stored locally on a possibly encrypted hard drive, where an attacker should either physically steal the machine (and then bruteforce eventual disk encryption and the database's password), alter it (add a keylogger and wait for you to log in and decrypt the pass DB), or remotely compromise it which isn't worth his time if you aren't a high profile target and is often difficult.

  • It would generally be difficult for an attacker to do this to an online service undetected. Not impossible, however a large service such as Lastpass will have IDS / IPS and monitoring systems in place to detect such breaches. – SilverlightFox Dec 10 '14 at 19:28
  • 1
    Difficult doesn't mean impossible, the point is that you trust a random company with your entire digital life and that's something a bit too dangerous in my opinion. – user42178 Dec 10 '14 at 19:30
  • 2
    "there is no valid reason for your entire password collection to leave your home network" Synchronizing your entire password collection across devices as Dashlane does is a "valid reason". – Heather Aug 23 '16 at 21:52
  • If you "aren't a high profile target," then nobody, law enforcement, rogue sysadmin, or otherwise, is going to modify the service's code just to obtain your master password. Software engineer-hours are far too expensive for that. – Kevin Jul 14 '17 at 3:53
-3

There’s only one key to unlocking your encrypted data. By default, you and only you have it. It’s how we make sure that even if hackers breached our servers, there would be nothing that could tie your information to you.

At least thats what they say.

  • 3
    Hello and welcome to Information Security! In the future, please always provide a link or other source when you quote something. I added one for you here. – Anders Mar 3 '17 at 12:06
  • 2
    As it stands, this does not answer the question, which was not about whether Dashlane claims you control the only key, but about potential vulnerabilities to XSS and CSRF, and whether there is public analysis of it. Can you update your answer to better address the question? – Xander Mar 3 '17 at 15:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.