@dangoodin@infosec.exchange @cibyr@omg.wtf.sh Dashlane works with APIs keys. If you have the API key, you can download the vault. The API key is protected by an emailed 6 digit code. An attacker only needs the email to try to register a new device. Once the attacker has the vault they can crack it offline. Last I checked they used Argon2d m=32MiB, t=3, p=2. Which means an attacker should get around 3500 guesses/second on an RTX 5080. At only 32 MiB it will be bandwidth limited: (GPU memory bandwidth) / (32*1024*1024*(3*3-1)) So 960,000,000,000 / 268,435,456 = 3576 H/s