Flashpoint says this is possible as 'some content hosting providers allow hosting arbitrary content under a subdomain of their official domain, which also serves their login page'.įree hosting sites allow for this kind of subdomain creation, but there are a lot of legitimate domains do not allow the registering of subdomains based on them. These subdomains can be used in phishing scams, where threat actors create fake pages using subdomains of legitimate website to steal your details. More of a concern, though, was that Bitwarden's autofill feature would even operate on subdomains of base domains for which you have a saved username and password for. However, Flashpoint found that the risk of such an attack was low as many legitimate and popular websites do not contain iframes on their login pages.

> One of the best password managers around now offers an additional layer of protection (opens in new tab) > Bitwarden vs 1Password: 2023 Features Comparison (opens in new tab) Another top password manager is doing away with passwords (opens in new tab)

Bitwarden open source