Keeper, a password manager maker that recently and controversially sued a reporter, has fixed a bug that a security researcher claimed could have allowed access to a user’s private data. From a report: The bug — which the company confirmed and has since fixed — filed anonymously to a public security disclosure list, detailed how anyone controlling Keeper’s API server could gain access to the decryption key to a user’s vault of passwords and other sensitive information. The researcher found the issue in the company’s Python-powered script called Keeper Commander, which allows users to rotate passwords, eliminating the need for hardcoded passwords in software and systems. According to the write-up, the researcher said it’s possible that someone in control of Keeper’s API — such as employees at the company — could unlock an account, because the API server stores the information used to produce an intermediary decryption key. “What seems to appear in the code of Keeper Commander from November 2015 to today is blind trust of the API server,” said the researcher.
of this story at Slashdot.