You probably can't trust your password manager if it's compromised
Researchers demo weaknesses affecting some of the most popular options Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised.…
https://www.theregister.com/2026/02/16/password_managers/Open linkView original on infosec.pub
12 replies
As usual, the actual best option (keepass in this case) gets no publicity.
What's the best way to use a Keepass database on a phone?
I personally use syncthing to sync it between my devices and then keepassDX to load the database on the phone.
You can technically use any file sync service but, I would recommend having some form of retention system(syncthing does this for you) in play in case it does somehow corrupt.
I'm not sure it's compatibility on apple products though as I don't own any.
Keepass2android works pretty well. I'm not sure for iPhones
Keepassium is great on iPhones. You can sync through the files app (iCloud, smb,…) and it also has native connections to Dropbox, owncloud, nextcloud, WebDAV and more.
Would self hosting help protect a user?
Oh really?! Tell me about it!
In addition to KeePass, some may find "Pass" interesting, that is based on GnuPG - https://www.passwordstore.org/
Pass is what I recommend
Probably?
I think there is an important distinction that all of the attacks are against the client connection to the compromised server, they're not able to decrypt the data at rest.
Hopefully each organization hardens against these discoveries.
Nice article. I've been using Keepass for many years but, as someone whose been looking to switch to Linux, this is very intriguing.
https://www.passwordstore.org/