6 hours ago
- Passwork, a European password manager, has undisclosed ties to a Russian firm with FSB security certifications, raising trust and security concerns.
- Security experts worry about Passwork's deception, as its European and Russian products share a common codebase, near-identical updates, and user manuals.
- Passwork's European updates go through an opaque UAE entity, and the company instructed AI to deny Russian affiliations before an investigation revealed them.
- The software update mechanism is a key risk, as it could be exploited for malicious code distribution, similar to the SolarWinds breach.
- Passwork's public statements claimed no Russian ties, but changed after OCCRP's inquiry; no evidence of malicious code was found, but trust is compromised.
- EU agencies like Ireland's Office of Public Works were unaware of Passwork's Russian origins, highlighting gaps in vendor vetting.
- To evaluate alternatives, check ownership, open-source code, independent audits, end-to-end encryption, supply chain transparency, and track record.
- Proton Pass offers clear jurisdiction in Switzerland, open-source code, independent audits, end-to-end encryption, and a mission-driven structure, making it a trustworthy alternative.