Light

Episode #1066 Quiz

Password Leakage
Date: 2026-02-24 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1066 addresses password leakage risks in cloud-based password managers Bitwarden, LastPass, and Dashlane, which are vulnerable to attacks if the server infrastructure is subverted. Researchers found flaws in key escrow, vault integrity, sharing features, and backward compatibility, emphasizing the difficulty securing feature-rich managers under a fully malicious server model.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary reason that the CA/Browser Forum reduced the domain validation reuse period from 397 days to 199 days as mentioned by DigiCert?

Question 1

What is the primary reason that the CA/Browser Forum reduced the domain validation reuse period from 397 days to 199 days as mentioned by DigiCert?

Due to technical limitations in certificate issuance software forcing shorter periods. To improve the overall security by requiring more frequent domain revalidation. To comply with new government regulations unrelated to security concerns. To reduce the workload on Certificate Authorities by shortening certificate lifetimes.

Question 2: According to the ETH Zurich research discussed, what common cryptographic mistake did LastPass have that impacted vault integrity?

Question 2

According to the ETH Zurich research discussed, what common cryptographic mistake did LastPass have that impacted vault integrity?

Implementing outdated public key algorithms that are vulnerable to quantum attacks. Use of weak passwords as master keys by default for users. Lack of client-side encryption causing server-side plaintext storage of vault data. Use of AES-CBC mode without ciphertext integrity checks, allowing detection failures after decryption.

Question 3: Why is it technically impractical for 3D printers to comply with legislation requiring them to block printing of firearm parts?

Question 3

Why is it technically impractical for 3D printers to comply with legislation requiring them to block printing of firearm parts?

Modern 3D printers automatically encrypt print files, preventing any examination of their contents. 3D printers lack on-board processing power for complex file analysis and are easily hacked, making screening ineffective. Because firearms are exclusively printed using proprietary machines that are exempt from these laws. All 3D printing is done remotely on servers that filter files, so printer-level blocking is unnecessary.

Question 4: What does the 'ClickFix' attack exploit to achieve over half of all malware loader activity in 2025 according to Huntress Labs?

Question 4

What does the 'ClickFix' attack exploit to achieve over half of all malware loader activity in 2025 according to Huntress Labs?

Using malicious browser extensions to steal clipboard data and credentials. Tricking users into performing system commands by masquerading as legitimate tasks like CAPTCHAs that request keyboard shortcuts and paste commands. Exploiting buffer overflow vulnerabilities in web browsers to execute arbitrary code silently. Hijacking DNS responses to redirect users to fake update servers for malware installation.

Question 5: Regarding passwords generated directly by Large Language Models (LLMs), what is the fundamental weakness highlighted in the episode?

Question 5

Regarding passwords generated directly by Large Language Models (LLMs), what is the fundamental weakness highlighted in the episode?

Passwords generated by LLMs are encrypted with weak algorithms by default, risking compromise. LLMs do not generate passwords of sufficient length and complexity to be considered strong by modern standards. LLMs lack the ability to combine uppercase, lowercase, numbers, and symbols simultaneously in passwords. LLMs produce passwords based on token prediction, not on uniformly random sampling, making generated passwords predictable and reused.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.