Post by @dangoodin@infosec.exchange

2026-06-03 17:50 UTC

There's so much I don't understand in Dashlane's disclosure that an attack on its user accounts resulted in the threat actor obtaining 20 encrypted vaults. https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts?7194ef805fa2d04b0f7e8c9521f97343 What does it mean to brute force 2fa? Are we talking about TOTPs? That doesn't make sense because TOTPs change every 30-90 seconds, so there's no way for an attacker to meaningfully exhaust key space before it resets all over -- unless the attacker has the ability to pump all 7,700 combinations in &lt;90 seconds, and DL doesn't have any sort of rate limiting. Also, if the attacker is brute forcing 2fa, doesn't that by necessity mean the attacker already defeated the first factor? How did that occur? I don't know if my confusion is the result of me not knowing the how the Dashlane product works or if it's just Dashlane being opaque. Can anyone help me read the tea leaves?

Replies (5)

@cibyr@omg.wtf.sh 2026-06-03 17:54

@dangoodin@infosec.exchange you only need to try every option if you want to guarantee getting into a particular account. If you try a small number of codes against a large number of accounts, statistically some of them will match. And if that locks out the rest of the accounts, so be it...

Open ##5057672
@lauren@mastodon.laurenweinstein.org 2026-06-03 17:56

@dangoodin@infosec.exchange Without addressing the specifics of this case (about which I know no more than the public info), some 2fa authentication code implementations can be vulnerable if they are not properly rate limited or otherwise protected against high speed stuffing. Usually of course 2fa follows a successful id/password authentication, though not always.

Open ##5187580
@drs1969@mstdn.social 2026-06-03 18:08

@dangoodin@infosec.exchange it may only be 20 encrypted vaults but i reckon a lot more users affected. Because I'm one of them.

Open ##5187588
@SpaceLifeForm@infosec.exchange 2026-06-03 23:51

@dangoodin@infosec.exchange How about that it was an inside job and this is just the cover story?

Open ##5187589
@Per_Eriksson@mastodon.social 2026-06-04 06:48

@dangoodin@infosec.exchange

Open ##5187590