Security researchers from the Fraunhofer Institute found serious security issues in nine password managers for Android when they analyzed them for their research.
Password managers are popular applications used to store authentication information. All of the applications currently available promise secure storage locally (on your computer, or more generally on the system that uses them) or online storage somewhere in the Cloud. Some applications come with both options.
A recent study by the Fraunhofer Institute analyzed nine password managers for Google's Android operating system. The researchers analyzed the following apps:
LastPass, 1Password, My Passwords, Dashlane Password Manager, Informaticore's Password Manager, F-Secure KEY, Keepsafe, Keeper, and Avast Passwords.
Some of these have more than 50 million installations.
The team's conclusions were very worrying for users of these applications on the Android platform.
The research revealed that password saving applications, despite their claims, do not provide adequate protection mechanisms, and sometimes abuse users' trust, exposing them to risk.
Three vulnerabilities were found in the LastPass app alone. The first concerns a hard-coded master key, the second reports data leaks via the browser, and, finally, a vulnerability affecting LastPass 4.0.x for Android that allows hackers to steal the stored master password.
At least one security vulnerability was found in each of the above applications that the researchers analyzed. In addition to the three mentioned above and not only observed in LastPass, another case was found where by installing a simple utility application, extracting passwords was a breeze.
You can read all the vulnerabilities for each of the above applications from the link below:
https://team-sik.org/trent_portfolio/password-manager-apps/
It should be noted that some of these security holes have already been patched, while others are still under development. This means that you should be extra careful if you use password managers on the Android platform.
