A bug in Keeper password manager leads to sparring over “zero-knowledge” claim

Keeper, a password manager maker that recently and controversially sued a reporter, has fixed a bug that a security researcher claimed could have allowed access to a user’s private data. The bug — which the company confirmed and has since fixed — filed anonymously to a public security disclosure list, detailed how anyone controlling Keeper’s API server could gain access to the decryption key to a user’s vault of passwords and other sensitive information. The researcher found the issue in the company’s Python-powered script called Keeper Commander, which allows users to rotate passwords, eliminating the need for hardcoded passwords in software and systems.

According to the write-up, the researcher said it’s possible that someone in control of Keeper’s API — such as employees at the company — could unlock an account, because the API server stores the information used to produce an intermediary decryption key. The potential security implications of the bug aside, the researcher questioned the company’s claim that Keeper has ‘zero knowledge’ of user data. The company insists that employees have no way to access customer data, for example, to satisfy a search warrant or a court order.

Keeper chief technology officer Craig Lurey confirmed the bug in an email.

Source: zdnet.com