Security of SecurePass

Well... There's a bit of contradiction here.

I've read the privacy policy already and if you look closely at chapter 7.2 it states: "Bitdefender provides two password management solutions: Bitdefender Password Manager provided through a third-party provider and Bitdefender SecurePass, a password manager built on open-source technology."

I'd like to emphasise the "built on open-source technology" bit there. This can be read in two different ways. It's entirely possible that it means that the source code of the app could be open source - whilst still being in possession of the server backgrounds. But it'd show the tech savvy users and community how the encryption operates. Other solutions are open source as well whilst requiring a subscription. The part that matters here is transparency. I wouldn't have to raise these questions if the code was available. Some service providers provide their program sourcecode and audit their backend+code independently.

Also the "Bitdefender Password Manager provided through a third-party provider" bit is already a bit shady. Has bitdefender ever been in full control of the front and backend or is SecurePass the first time? If so that could mean a huge improvement to the old Bitdefender Password Manager with its unknown third party operator. I'm willing to put more trust in bitdefender than in unnamed third parties.

And then again chapter 7.2 states: "You will have full control all the time to your personal data in the Passwords vaults which may contain usernames, emails, passwords, secret keys, notes, addresses, personal IDs and credit card data. Vaults are not accessible to anyone, except the user; Bitdefender does not have access or control of passwords. All passwords are encrypted with a key, that only the user of the service has knowledge about, in one single place, with complex master password requirements."

"Bitdefender does not have access or control of passwords". This could either mean that the whole vault is encrypted or that it's just the passwords. Metadata such as emails, usernames, notes, etc could technically remain unencrypted. This might seem far fetched at first but in 2022 when LastPass was hacked they shared that the passwords were indeed encrypted but not the corresponding websites. That's a huge privacy risk in case of an attack.

I've also read the "end-to-end encryption" bit already on bitdefenders product webpage - but this still offers a flurry of possibilities. Is it using XCha-Cha20 or AES? If AES which one: 128? 256? Then again, is password hashing done with PBKDF2 like lastpass did it? Or is it Argon2 or bcrypt?

There's a lot of lessons to be learned once you dig into this 2022 lastpass hack and it's ongoing compromisation after that until at least August 26. 2022. Did bitdefender do its homework?

I'm already providing my premium security with loads and loads of trust and permissions - I even provide bitdefender with a flurry of permissions regarding my Gmail and Outlook accounts. Something I'd normally never do. I would've wished to see local spam protection in thunderbird etc to get an overhaul as well. But storing all my passwords in SecurePass based on the "trust" I put in the product is a gamble I'm not willing to take right now. Not with important details still being unknown. If I'd use the 2FA features even my 2FA would be at risk in case of a hack.

I'd love to see a complete post on how SecurePass is meant to stay secure. Technical backgrounds, reasoning, discussions bitdefender had, explanations - ProtonPass has all that on their blog and website easily accessible. They go into detail there whilst trying to explain it for average people. I'd love to see this from Bitdefender. That could mean an increase in sales as well - trust is of the essence in the business of password managers. And even I would consider switching from my trusty, transparent and fully open source KeePass vault. Still one of the gold standards to me. I'd love some password sharing and secure cloud storing. Meanwhile I'm still sitting here with my USB drive and homemade half-arsed cloud xD

Thank you Scott, you've tried your best :)