Security guidance is comparing two ways of handling two-factor authentication codes: storing them inside a password manager alongside saved passwords, or keeping them in a separate dedicated authenticator app. Password managers combine both login factors in one vault for convenience, while authenticator apps keep the second factor physically separate from the password itself, generating or sending one-time codes through methods like text messages, push notifications, email, or in-app codes.
engadget.com
· 2026-09-23
Cybersecurity firm SpyCloud analyzed over 66,000 public-facing systems tied to roughly 10,000 EPA-registered water and wastewater organizations and discovered that infostealer malware had already harvested login credentials from 1,787 of them. At least 250 of those organizations had exposed credentials that could grant access to operational networks controlling physical pumps and water flow. In one case, malware on a device belonging to a metering technology vendor exposed passwords for 167 utilities that relied on its services.
techcrunch.com
· 2026-09-22
Dashlane has introduced a new feature called Vault Enforcement, designed to ensure employees continue using company password managers after initial rollout. The tool addresses what Dashlane calls the 'adoption gap,' where usage of a deployed password manager tends to fade months after onboarding as workers revert to manually typing credentials. IT admins can now require use of the vault rather than merely encouraging it.
9to5mac.com
· 2026-09-19
Android now lets users move saved passwords and passkeys directly between password managers through a built-in OS process, without exporting unencrypted files. The system automatically detects compatible managers installed on the device and lets users review data before approving the transfer. Google confirmed support for Google Password Manager, 1Password, Bitwarden, and Dashlane, with more apps expected to add compatibility.
techspot.com
· 2026-09-11
Google is rolling out a built-in Android feature that lets users securely transfer both passwords and passkeys directly between credential manager apps, replacing the old method of exporting unencrypted text files or manually recreating passkeys. At launch, the tool supports Google Password Manager, 1Password, Bitwarden, and Dashlane, with other providers able to add support via Android's Credentials Transfer API. Users initiate the process from their new password manager, and Android handles detection, review, and authorization before completing the transfer in seconds.
yro.slashdot.org
· 2026-09-10
Google has enabled a new on-device transfer system letting Android users move saved logins between password managers without manually re-entering them. The feature works through an import option within supported apps, currently including Google Password Manager, 1Password, Bitwarden, and Dashlane, provided both apps are installed and synced with credentials.
arstechnica.com
· 2026-09-10
Google rolled out a new Android feature that lets users transfer passwords and passkeys directly between password manager apps without exporting CSV files. The system works by having the new app request an import from the old one, with Android coordinating the transfer so users can review and approve the data before it moves. The feature currently supports Google's own password manager along with Bitwarden, 1Password, and Dashlane, and works on devices running Android 8 or later.
techcrunch.com
· 2026-09-10
X users have reported receiving unsolicited password reset emails following the rollout of the platform's new X Money payment service. X engineer Mridul Singhai confirmed the company is investigating the surge of reset requests, stating no evidence of actual account breaches has been found so far.
techcrunch.com
· 2026-09-01
A developer has released BlindLock, a local password vault that stores encrypted credentials embedded within an image file rather than in a central database. The vault relies on hardware binding and 256-bit authenticated encryption, and incorporates NIST-standardized post-quantum algorithms ML-KEM-1024 and ML-DSA-87 for key exchange and signatures.
blindlock.app
· 2026-08-31
A new password manager called Sesame has been released with its entire codebase published under the AGPL-3.0-or-later license, allowing anyone to inspect, build, and run it independently. The project emphasizes a local-first design and has seen active development, with 147 commits logged in the past 30 days as of August 22, 2026.
usesesame.app
· 2026-08-28
A developer's blog post examines 35 Mac applications and finds that most of their 'File' menus contain almost nothing related to actual file management, instead housing app-specific actions like managing passwords, events, or chats. The author proposes renaming the menu in each app to better reflect its real function, such as 'Password' for 1Password or 'Event' for Calendar.
adam.farkas.pro
· 2026-08-24
Researchers have identified a sophisticated malware toolkit called SynkLoader that revives an old screen-hijacking technique to steal passwords while also incorporating a range of newer capabilities. The malware supports multiple languages and functions as a multitool, suggesting it could serve as a precursor to ransomware deployment.
darkreading.com
· 2026-08-24
GoKawiil