TLDR Tech / InfoSec
Dashlane explains how attackers managed to download encrypted password vaults
Attackers abused Dashlane's device-enrollment APIs to spray one-time 2FA codes across many accounts and brute force valid tokens, letting them register new devices on fewer than 20 accounts and download encrypted vaults. They still need to crack master passwords, which Dashlane hardens with Argon2, but weak or reused passwords remain exposed, so affected users should change master passwords and stored credentials.
Read the full story