Dashlane Confirms Hackers Stole Password Vaults, Pentagon Location Tracking, and Hackers Trick Meta's AI

On Our Radar 🎯

Dashlane Got Breached, And It's Being Way Too Quiet

A password manager getting compromised is a headline nobody wants to read, but we got it this week: Dashlane confirmed that hackers obtained at least a dozen, likely around 20, encrypted customer vaults during a recent attack. There are a lot of asterisks on this so far, but it's already starting to feel a lot like the LastPass data breach from a few years ago...

Here's what we actually know, and it's not much so far. Dashlane says hackers brute-forced their way past the company's two-factor authentication and got into roughly 20 customer accounts, then downloaded copies of those encrypted vaults. The company claims there's no evidence its own systems were compromised, but it hasn't explained how the attackers defeated 2FA, hasn't said whether a ransom was demanded, and didn't respond to requests for comment. I'm left wondering how vaults were stolen without the attackers compromising their systems...?

The (somewhat) reassuring part is that these were encrypted vaults, meaning those user's data should be encrypted. But LastPass taught us that "encrypted" isn't a magic word. Attackers who steal an encrypted vault can sit and brute-force it for as long as it takes, and people who used weak master passwords in the LastPass breach have seen millions of dollars drained from crypto wallets years after the original breach—and those vaults are still being attacked today. So the concern isn't really today, it's the slow attack against whoever in that group of 20 had a weak master password.

The other takeaway: Dashlane needs to step up. This is the most sensitive software a person can use, it's literal access to your entire life. Even if the investigation is genuinely ongoing, there's no excuse for not reaching out directly to the affected customers with specifics of what's currently known and not known.

What you can do: No matter which password manager you use, make sure your master password is long, strong, and unique. Use a security key if you're able to for phishing resistance. If you're a Dashlane customer, watch for direct communication from them if they decide to step up. I'm expecting some more updates on this one!

Bits & Bytes 🤖

~ Story 1: The Pentagon Admits US Troops Were Tracked With Commercial Location Data
Senator Ron Wyden revealed the US Department of Defense confirmed that adversaries surveilled military personnel using commercial location data, the same kind harvested by app trackers and SDKs, aggregated by data brokers, and sold to anyone willing to pay. Wyden called the data broker industry a national security threat.

My take: You can't build a surveillance economy that only watches "regular" people! The same data broker pipeline that tracks you also tracks soldiers, politicians, and everyone else. For once, "national security threat" is being applied to something that genuinely is one, and the fix isn't exemptions for the powerful; it's actual privacy protections for everyone. We're now in the world where even those in power can't escape these issues, and the sooner we guarantee basic digital rights—the sooner we can finally start getting ahead of this.

~ Story 2: Europe Is Accelerating Its Move Away From Big Tech
Europe is doing what it can to move away from big tech companies with Euro Office! This means they are dropping Google in favor of Qwant, swapping Microsoft for Nextcloud, and Gmail for Tuta...this is all part of a broader European push toward digital sovereignty.

My take: This is ultimately a geopolitical story, but the message is simple: if even entire countries are realizing the risk of depending on big tech, that's a signal these companies aren't just more powerful than individuals, they're more powerful than governments. The world is waking up to the harsh reality of the havoc these companies have caused (and continue to cause) and everyone's looking for a way off the sinking ship.

~ Story 3: Hackers Hijacked Celebrity Instagram Accounts By Just Asking Meta's AI

In one of the most absurd stories of the year, hackers gained access to high-profile Instagram accounts by essentially just asking for an email change, and the AI complied. Meta has since started alerting affected users.

My take: A support chatbot with the power to modify account details is a reckless design decision, and reflects Meta's lack of care for user safety. This is the same company firing real people in the effort to replace them with AI, the same company trying to add AI 'engagement' on their platforms to keep people engaged, the same platform knowingly exploiting children, the same platform who's CEO wants to AI-clone himself in meetings, and that same CEO won't even let his children use the platform. This story is just one more infuriating drop in the bucket of Meta's decades of controversies.

This Week on Techlore 📺

This week we had a couple exciting pieces of content! To start, we had DuckDuckGo on Techlore Talks to discuss their role in the fight for digital rights:

DuckDuckGo’s Director of Product on Ads, Google, and the Ecosystem They’re Actually Building

Techlore Talks brings you in-depth conversations with the experts at the forefront of digital rights, privacy and security.

TechloreTori

And we partnered with Cape, the private cellular provider, to make an in-depth guide on what all of us can realistically do to protect ourselves on cellular networks:

The Truth About Phone Carrier Tracking (It’s Worse Than You Think)

Your cell carrier knows your name, your location, who you called, when you called them, how long you talked, and more. What’s worse, this data sits on their servers for years. VPNs and Signal help, but they don’t touch the infrastructure layer. Here’s what you can actually do, and how

TechloreTori

And finally, our SPA Tools are OFFICIALLY LIVE! Here's how it all comes together:

Take the SPA Quiz to discover your archetype. Carry it into SPA Tools, where that same archetype filters the best tools for you. The VPN Finder puts your top VPN contenders side by side until the right choice is obvious. And any time you want to understand why, the brand new SPA Wiki is right there for you to learn. I'll be doing more formal announcements for these soon, they took months of effort and I wish I had access to these tools when I started my journey.

Action Item ✅

Take two minutes this week to check your password manager's master password. If it's anything short, reused, or guessable, change it to something long, unique, and random, ideally a passphrase you can actually remember. The Dashlane breach is a reminder that an encrypted vault only protects you as well as the password locking it.

Written by

Share

Copied