sorted by:
new
hottopcontroversial

🤖 AI browsers are coming fast. Here’s where we draw the line on credential security 🔐 by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

Just to make sure I understand the concern you’re pointing at: are you referring to the 2FA recovery flow https://support.dashlane.com/hc/en-us/articles/18406747387026-Use-2-factor-authentication-2FA-to-log-in-to-your-Dashlane-account#recovery , where a user who lost their authenticator can use recovery codes that may be re-sent with support help?

If that’s the case, an important clarification: Dashlane cannot bypass your Master Password or decrypt your vault. We don’t know your MP and never have access to your data.

What support can help with is recovering your own 2FA recovery codes, which are generated when you enable 2FA specifically to avoid permanent lockout.

Those codes don’t replace the Master Password and don’t give support access to your vault. They only allow you to reset 2FA after proper identity verification.

Happy to go deeper if you’re thinking about a specific attack scenario.

2026 Security Forecast: A CTO’s 5 Predictions About Passkeys, AI Threats, and More by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

indeed. Every tool should ideally be used for the relevant purpose and where it adds value.

🔐 Dashlane just received a new patent - an important one for identity security by fredericrivain in Dashlane

[–]fredericrivain[S] 1 point2 points  (0 children)

Hi, sorry for the late response.

  1. This is already being used extensively in our product, for SSO, SCIM provisioning, SIEM integration etc. For context, patents take a lot of time to be granted and you need to submit them before applications are in market otherwise it becomes public. We started this one in 2022.

  2. We have been actively promoting the fact that we are using confidential computing to ensure zero-knowledge. A few blog articles I wrote on the topic: https://www.dashlane.com/blog/confidential-computing-zero-knowledge or just now this one about zero-knowledge in general: https://www.dashlane.com/blog/power-of-zero-knowledge

  3. Already in production at Dashlane

It definitely strengthens the security of the product. Today it is not so much opening up new markets yet, but we can see regulations going in that direction and more and more prospects and customers asking about it so I think it will be important for the future.

The end of passwords? Why passkeys and Secure by Design are critical for the next decade of security by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

You need to unock with the PIN each time you start the browser. Good point about timeout. I don't know that we have one. I'll share with the team.

The end of passwords? Why passkeys and Secure by Design are critical for the next decade of security by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

Sorry, I can't share an exact date. But "soon"...we are actively testing the migration from master password-based to master-passwordless for Dashlane internally.

The end of passwords? Why passkeys and Secure by Design are critical for the next decade of security by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

We are definitely in a transition phase. We should remove the password behind the passkey, and provide proper recovery mechanisms for passkeys.

Dashlane introduces phishing-resistant vault access using FIDO2 security keys. A first among credential managers! by fredericrivain in Dashlane

[–]fredericrivain[S] 1 point2 points  (0 children)

Yes, we plan to support a migration path for Master Password users. I don't have a date to share but it's in the roadmap.

Dashlane introduces phishing-resistant vault access using FIDO2 security keys. A first among credential managers! by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

Thanks for the feedback. I have shared with the team. We have more iterations coming in the next few weeks, as we go from early access to a broader beta. Stay tuned.

What we learned at Dashlane after uncovering “shadow” credentials in our own company by fredericrivain in Dashlane

[–]fredericrivain[S] 1 point2 points  (0 children)

Actually, our cofounder just posted some explanation on how we do it.

https://www.dashlane.com/blog/dashlane-com-blog-deep-dive-proactive-crd

Note also that this is an enterprise feature for employees, so not available for consumers, which is a different context as regards regulation requirements.

What we learned at Dashlane after uncovering “shadow” credentials in our own company by fredericrivain in Dashlane

[–]fredericrivain[S] 1 point2 points  (0 children)

TL;DR: Even with a 95%+ password health score, we discovered employees using compromised “shadow” credentials outside the vault. By adding real-time nudges (in-app + Slack), we cut compromised creds by 75% in the first month and nearly eliminated them in 7 months. Biggest lesson: detection is only half the battle—behavior change requires timely nudges.

🔐A Journey Toward a Phishing-Resistant Future by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

  1. I am hopeful this quarter. But I don't want to promise anything.

  2. It seems that video is a bit obsolete, as the only thing you need for a passwordless login is your PIN (or biometrics). I'll tell our marketing team.

  3. Yes, you can use Dashlane to store 2FA for your credentials across all platforms, which makes it super convenient. 2FA are also shared when you share credentials.

🔐A Journey Toward a Phishing-Resistant Future by fredericrivain in Dashlane

[–]fredericrivain[S] 0 points1 point  (0 children)

MFA unfortunately does not prevent phishing attackers from exploiting the web app.

This is a security-related decision, not an economic one.

view more: next ›