[image] Skiff Pages/Drive (Productivity Tools) We require both productivity tools and notebooks to be open-source This is interesting requirement considering that you recommend 1Password, a closed source password manager that arguably protects even more sensitive data. So, your stricter requir…

Cloud password managers are a life saver for anyone dealing working in complex business and hundreds, if not thousands, of passwords. Alas, a local KeePass is almost always better in a case of a public vulnerability like the one I shared in the other thread. That being said, I won’t lie that I don’…

Official reply from 1P Hi all, Thanks for all the questions and the thoughtful discussion. We wanted to provide a bit more context about the research and what it means for 1Password users. A researcher identified a variation of a clickjacking attack, where a malicious website can trick someone in…

“It’s the opinion of the Socket Security Team that, if this is the case, the mitigations currently implemented by other password managers may also be bypassable.” https://socket.dev/blog/password-manager-clickjacking#:~:text=It’s%20the%20opinion%20of%20the%20Socket%20Security%20Team%20that%2C%20if…

[image] Natha: I won’t lie that I don’t feel comfortable using 1Password anymore. Unless they take care of the matter in a radically different way, this is a breach of trust. [image] anon11657877: 1Password and LastPass don’t care. The lack of doing anything by 1Password is much worse …

[image] anonymous378: I do wonder if other PMs providing “fixes” that will be bypassed (if 1Password is correct) isn’t much more then security theater that gives users a false impression that they are now safe from clickjacking attacks. You’re not the only one wondering what their own fix is …

Not just “cloud-based”, it affects any that provide autofill within a browser as a plugin. I’d argue about the severity of it too, the precondition of exploiting this is having the website already compromised. That is, they could already steal your password if you logged in, the vulnerability just a…

The thing is that it isn’t just about logins. It’s also about credit cards and identities stored in these password managers. Cache poisoning is still a thing, the overlay exploit (mentioned by the researcher who found the vulnerabilities) could fool anyone, hijacked domains do happen, etc. Yes, it…

I am in favor of this proposition. Open-source is not a magic thing that makes programs secure. As do audits. However, there are reasons to think that the open-source PM we recommend are well tested and reviewed, in addition to their audits. I think that the apps we recommend that do client-side …

[image] mangomango: So we can look at the encryption they use, etc. Why would this require open-source? You can do this with source-available as well, like how Bitwarden was for multiple months. I’m sorry but I haven’t seen a single convincing argument so far why open-source is better for pri…

Privacy Guides Community

Require Open Source for Password Managers

Site Development

Natha (Nathanaël Havez) August 22, 2025, 12:44am 422

I’ve posted an update for the 11 password managers mentioned: Zero-Day Clickjacking Vulnerabilities in Major Password Managers - #25 by Natha

Topic		Replies	Views
Denote source availability for recommended tools Site Development	20	872	September 15, 2024
Should I use Bitwarden, Proton Pass, or 1Password? Questions	43	25034	June 12, 2025
Remove 1Password Tool Suggestions rejected	83	8826	July 25, 2026
Proton Pass web (early access) General	5	772	December 26, 2023
Remove Strongbox Tool Suggestions completed	35	5584	March 14, 2025

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Require Open Source for Password Managers

Related topics