Just for the heck of it I created a test account with their password manager with a few honeypot accounts on a VPS server.
Within 2 hours one of the "honeypot" SSH accounts I put in my password manager was accessed with the creds I provided in the password manager. Now I understand there is internet wide scanning but a succesfull login with a random 12 character username and password I had in my password safe is very unlikely to be a random bot account.
Tomorrow I might have a bit more time to throw a few more honeypot accounts in there and see if they attempt to login.
For the time being I would highly discourage anyone store their passwords there.
(using a random throwaway account for obvious reasons, I don't want any retaliation against my startup on my main account from these guys.)
Within 2 hours one of the "honeypot" SSH accounts I put in my password manager was accessed with the creds I provided in the password manager. Now I understand there is internet wide scanning but a succesfull login with a random 12 character username and password I had in my password safe is very unlikely to be a random bot account.
Tomorrow I might have a bit more time to throw a few more honeypot accounts in there and see if they attempt to login.
For the time being I would highly discourage anyone store their passwords there.
(using a random throwaway account for obvious reasons, I don't want any retaliation against my startup on my main account from these guys.)