**Dashlane Explains How Attackers Snuck In—And Why It Matters More Than You Think (Deep Dive 🧵)**
Hey folks — I went deep on this today and the story is genuinely fascinating! Ars Technica's Dan Goodin broke down how Dashlane users were targeted in a coordinated attack that started Sunday, June 2nd: unknown threat actors used device-enrollment API endpoints to spray brute-force codes across *thousands of accounts simultaneously* instead of hammering one user. Here's the clever part — with only six digits (1 million possible combos) and three hours per token validity window, attacking thousands at once boosted each attempt from ~1 in 500K for single-account attacks up to massive success rates by exploiting distributed rate limiting. The attack vector: add a device → get your one-time code via email or authenticator app → enter it within the valid window → boom, encrypted vault lands on attacker's machine ready for offline cracking with Argon2 hashing and GPU power!
Here's where I got chills reading Dan Goodin's breakdown — fewer than 20 personal users actually had their vaults successfully downloaded before Dashlane pulled the plug. Now here's a key nuance that caught me off guard: attackers technically *obtained* those encrypted containers but still need to crack master passwords, which is where Argon2 makes things very hard for them since it dramatically increases hashing costs even with GPU acceleration; only users who picked weak, dictionary-friendly passwords face meaningful risk. This echoes the 2022 LastPass breach in spirit — that one worked because certain fields like URLs stayed unencrypted (readable without password) and some vaults used outdated algorithms — but Dashlane's all-fields-encrypted + auto-updating-algorithm approach means attackers' odds are notably lower, even if not zero! The catch? Your affected users got confused by initial notifications missing details on risk level.
Bottom line: Out of abundance of caution (and for under 20 victims especially), both master passwords AND vault contents should be rotated ASAP to dramatically reduce remaining attack surface — all unaffected Dashlane users can relax, no action required there! It's a reminder that even "impenetrable" password managers have edge cases when their backend logic allows enough simultaneous testing across large user pools.
Source: https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/
Hey folks — I went deep on this today and the story is genuinely fascinating! Ars Technica's Dan Goodin broke down how Dashlane users were targeted in a coordinated attack that started Sunday, June 2nd: unknown threat actors used device-enrollment API endpoints to spray brute-force codes across *thousands of accounts simultaneously* instead of hammering one user. Here's the clever part — with only six digits (1 million possible combos) and three hours per token validity window, attacking thousands at once boosted each attempt from ~1 in 500K for single-account attacks up to massive success rates by exploiting distributed rate limiting. The attack vector: add a device → get your one-time code via email or authenticator app → enter it within the valid window → boom, encrypted vault lands on attacker's machine ready for offline cracking with Argon2 hashing and GPU power!
Here's where I got chills reading Dan Goodin's breakdown — fewer than 20 personal users actually had their vaults successfully downloaded before Dashlane pulled the plug. Now here's a key nuance that caught me off guard: attackers technically *obtained* those encrypted containers but still need to crack master passwords, which is where Argon2 makes things very hard for them since it dramatically increases hashing costs even with GPU acceleration; only users who picked weak, dictionary-friendly passwords face meaningful risk. This echoes the 2022 LastPass breach in spirit — that one worked because certain fields like URLs stayed unencrypted (readable without password) and some vaults used outdated algorithms — but Dashlane's all-fields-encrypted + auto-updating-algorithm approach means attackers' odds are notably lower, even if not zero! The catch? Your affected users got confused by initial notifications missing details on risk level.
Bottom line: Out of abundance of caution (and for under 20 victims especially), both master passwords AND vault contents should be rotated ASAP to dramatically reduce remaining attack surface — all unaffected Dashlane users can relax, no action required there! It's a reminder that even "impenetrable" password managers have edge cases when their backend logic allows enough simultaneous testing across large user pools.
Source: https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/