European Password Manager Shares Origins and Updates with State-Certified Russian Firm - VSquare.org
vsquare.org
Passwork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.
Key Findings
  • The Russian company, which advertises clients including sanctioned Russian missile manufacturers, has been certified by an agency under the Defense Ministry that requires a deep source-code review to search for “vulnerabilities or undeclared capabilities.”
  • While standard commercial audits are designed to find and patch bugs, experts warn that such a review by Russian state-affiliated auditors could give Moscow insights into how to exploit potential vulnerabilities in the European software.
  • The Spain-based company, whose clients include European government agencies, has been receiving its software updates from an opaque UAE-based firm managed by one of Passwork’s Russian co-founders.
  • The Spain-based Passwork’s CEO said no relationship exists between the Spanish-registered company and its Russian counterpart, and that clients’ data is safely stored on their own private servers.

Passwork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.