PSA: The auto-fill password manager I used for 2 years had a flaw

I found out last week that my password manager was storing master password hints in plain text. Saw it in a security audit report from a friend who runs pen tests in Austin. The hint field is meant for recovery, but it can leak a lot if someone sees it. I switched to a different tool with no hint option and enabled a hardware key instead. Has anyone else checked their manager's hint settings after reading the fine print?

1 comments

1 Comment

thomas_torres1mo ago

LastPass had the same kind of problem back in 2022 when I was using it, and the breach reports mentioned unencrypted metadata that basically gave away my username patterns. I switched to a local-only manager that stores everything in one encrypted file on my phone and laptop, and I set up a YubiKey for the unlock step. The hint field is a dumb feature anyway, if you need a hint to remember your master password you should probably change the password itself.