# Should you still trust your password manager?

Page: https://stenobird.com/podcast/safe-mode-podcast-6421323/should-you-still-trust-your-password-manager
Text version: https://stenobird.com/podcast/safe-mode-podcast-6421323/should-you-still-trust-your-password-manager.md
Podcast: [Safe Mode Podcast](https://stenobird.com/podcast/safe-mode-podcast-6421323)
Published: 2026-02-19T21:08:57+00:00
Episode link: https://soundcloud.com/podcast-defensescoop-com/should-you-still-trust-your
Audio file: https://feeds.soundcloud.com/stream/2269794779-podcast-defensescoop-com-should-you-still-trust-your.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/safe-mode-podcast-6421323/episodes/should-you-still-trust-your-password-manager
Duration seconds: 2200

## Resource

In this episode, Greg explores the gap between password manager marketing claims of "Zero Knowledge Encryption" and the reality uncovered by Swiss researchers who found 25 attacks against Bitwarden, LastPass, and Dashlane. Professor Kenny Patterson joins Greg to discuss why the industry's "honest-but-curious" security model is dangerously inadequate compared to a "malicious server" threat model, diving into three critical vulnerability categories: account recovery mechanisms that allow attackers to swap encryption keys, seemingly innocent features like icon fetching that leak passwords, and "vault malleability" where individual item encryption lets attackers cut-and-paste data between vault fields. They also discuss how legacy code support and backwards compatibility create cryptographic hazards, and what non-negotiable features are needed to build a truly "provably secure" password manager from scratch.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/safe-mode-podcast-6421323/episodes/should-you-still-trust-your-password-manager/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/safe-mode-podcast-6421323/should-you-still-trust-your-password-manager.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.