⚛️Ars Technica•Stalecollected in 3h
Dashlane explains breach of encrypted password vaults
💡Learn how to harden your authentication infrastructure against mass-download attacks and credential scraping.
⚡ 30-Second TL;DR
What Changed
Attackers utilized large-scale targeting to increase success rates
Why It Matters
This incident highlights the importance of robust rate-limiting and anomaly detection in authentication systems, critical for any AI-based service handling user credentials.
What To Do Next
Implement rate-limiting and behavior-based anomaly detection on your API endpoints to prevent mass data scraping.
Who should care:Developers & AI Engineers
Key Points
- •Attackers utilized large-scale targeting to increase success rates
- •Encrypted vaults were accessed but remained protected by user master passwords
- •Dashlane is reviewing security protocols to prevent similar mass-download attempts
🧠 Deep Insight
Web-grounded analysis with 19 cited sources.
🔑 Enhanced Key Takeaways
- •The attack specifically targeted Dashlane's two-factor authentication (2FA) during the device registration flow, allowing attackers to register new devices on existing user accounts by brute-forcing 6-digit codes.
- •Attackers utilized automated software to rapidly submit every possible numeric combination for time-based 2FA codes, aiming to guess the correct sequence before the short-lived code expired.
- •Fewer than 20 personal plan users had their encrypted vaults downloaded, and Dashlane emphasized that its internal systems were not compromised.
- •Dashlane's initial communication regarding the incident and temporary account suspensions drew criticism from some users on platforms like Reddit, who felt there was a lack of timely information.
- •The vulnerability stemmed from a 'quirk' in Dashlane's login system for certain accounts, where a correct six-digit verification code during device registration was sufficient to download an encrypted vault without first requiring the master password.
📊 Competitor Analysis▸ Show
| Feature/Pricing/Benchmarks | Dashlane | Bitwarden | 1Password | NordPass |
|---|---|---|---|---|
| Free Plan | Limited free account | Unlimited (truly free) | 14-day trial | Free plan available |
| Individual Premium (Annual) | ~€3.68/month (excl. tax) | $19.80/year (~€1.41/month) | €43.80/year (excl. tax) | Not cheapest option |
| Family Plan (Annual) | ~€5.55/month (excl. tax) for 10 accounts | $47.88/year for 6 users (~€3.40/month) | €69/year (excl. tax) for 5 users | |
| Encryption | AES-256-CBC-HMAC | Advanced encryption, open-source audited | AES 256-bit encryption | XChaCha20 encryption |
| Zero-Knowledge Architecture | Yes | Yes, open-source for transparency | Yes | |
| Unique Features | Includes Hotspot Shield VPN with Premium plan | Open-source, self-hosting option, bug bounty program | Watchtower, Travel Mode, advanced Secure Notes | Dark web monitoring (BreachWatch, add-on) |
| Open Source | Mobile apps (Android/iOS) only | Fully open source | No | No |
| Compliance | AICPA SOC2 Type 2, GDPR, CCPA, EU-U.S. Data Privacy Framework |
🛠️ Technical Deep Dive
- Dashlane employs a zero-knowledge architecture, meaning user data is encrypted and decrypted locally on their devices, and Dashlane itself cannot access vault contents.
- Vault data is encrypted using AES-256-CBC-HMAC for confidentiality and integrity.
- Key derivation for master passwords utilizes Argon2d with 3 iterations, 32 MB memory cost, and 2 threads, designed to be GPU-resistant.
- Device authentication is managed by a unique 40-byte Device Key generated for each new device, which authenticates to Dashlane servers independently of the vault encryption key.
- To extend zero-knowledge protection to the cloud, Dashlane leverages confidential computing and secure cloud enclaves, specifically AWS Nitro Enclaves, to isolate cryptographic operations and encryption key management.
- The brute-force attack exploited the device registration flow, where a six-digit one-time token sent to the user's email or generated by an authenticator app was sufficient to register a new device and download the encrypted vault, without an initial master password prompt.
🔮 Future ImplicationsAI analysis grounded in cited sources
Password managers will face increased scrutiny regarding the robustness of their 2FA implementations, especially during critical operations like device registration.
The Dashlane breach highlighted a vulnerability where a 6-digit 2FA code, without prior master password verification, was sufficient to download an encrypted vault, prompting a re-evaluation of such flows across the industry.
The incident will likely accelerate the industry's shift towards more advanced passwordless authentication methods.
As brute-force attacks on 2FA codes demonstrate the limitations of current authentication paradigms, passwordless solutions, which Dashlane has already been developing, offer a more secure alternative.
Companies will prioritize clearer and more proactive communication strategies during security incidents to maintain user trust.
Dashlane's initial communication during the outage drew user criticism, underscoring the importance of transparent and timely updates to manage public perception and reassure affected customers.
⏳ Timeline
2009-07
Dashlane founded in Paris.
2012-05
First software release, including AES-256 encrypted password manager.
2016
Launched Dashlane Business.
2023-12
Dashlane offered a fully passwordless experience for mobile account creation.
2025-08
Security researcher Marek Tóth presented a DOM-based extension clickjacking vulnerability affecting Dashlane, which was addressed by August 1, 2025.
2026-05-31
Brute-force attack against Dashlane user accounts began, targeting 2FA for device registration.
📎 Sources (19)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Ars Technica ↗