News
- Dropbox is dropping Passwords from its product portfolio
- The app and browser extension will be discontinued soon
- Users will still be able to access their data until October 28, 2025
For users of Dropbox Passwords, it's time to take a look at the best password managers and find a new service to use, after the cloud storage company revealed it will soon discontinue the service.
The end of service for Dropbox Passwords will be October 28, 2025, giving users ample time to find a new credential manager to suit their needs.
In the announcement, Dropbox said it was discontinuing the tool, “as part of our efforts to focus on enhancing other features in our core product.”
So long, Dropbox PasswordsDropbox Passwords users will still have ample time to access their saved usernames, passwords, and stored credit card information for export until October 28, but there will be some key changes before then.
On August 28, 2025 the password manager will become view-only on both mobile devices and on through the browser extension. You won’t be able to add any more credentials nor use the autofill feature from this date.
On September 11, the mobile app will be depreciated and will no longer be available for use. Your data will remain available through the browser extension.
The fateful date of October 28 will see all Dropbox Password data securely deleted and the dark web monitoring feature will cease to function.
In its blog post, Dropbox has provided some key information on how to export your data from both the app and browser extension. Mobile app users can follow these instructions to export their data:
- Open the Dropbox Passwords mobile app.
- Tap (settings).
- Tap Export.
- Tap Export to confirm.
To export data from the browser extension, do the following:
- Open the Dropbox Passwords browser extension.
- Click your avatar (profile picture or initials) in the bottom-left corner.
- Click Preferences.
- Click the Account tab.
- Click Export.
- Click Export to confirm.
- These are the best parental control apps
- We've rounded up all the best secure email providers
- PayPal will now let you pay in Bitcoin and other cryptocurrencies - but with one crucial condition
- A critical flaw in SAP NetWeaver is still being abused, months after patching
- Researchers saw it used to deploy Auto-Color
- This backdoor remains dormant when not in use
A vulnerability in SAP NetWeaver is being exploited to deploy Linux malware capable of running arbitrary system commands and deploying additional payloads, experts have warned.
Security researchers from Palo Alto Networks’ Unit 42 discovered a piece of malware called Auto-Color, a Linux backdoor, dubbed for its ability to rename itself after installation.
The researchers found it was capable of opening reverse shells, executing arbitrary system commands, acting as a proxy, uploading and modifying files, as well as adjusting settings dynamically. It was also discovered that the backdoor remains mostly dormant if its C2 server is unreachable, effectively evading detection by staying inactive until the operator instructions arrive.
Salt TyphoonHowever, the researchers weren’t able to determine the initial infection vector - how the malware made it onto target endpoints remained a mystery - until now.
Responding to an incident in April 2025, cybersecurity experts from Darktrace investigated an Auto-Color infection on a US-based chemicals company. They were able to determine that the initial infection vector was a critical vulnerability in SAP NetWeaver, a technology platform developed that serves as the technical foundation for many SAP applications.
The vulnerability was found in the platform’s Visual Composer Metadata Uploader element, which was not protected with a proper authorization. As a result, unauthenticated agents were allowed to upload potentially malicious executable binaries that could do severe damage. It is tracked as CVE-2025-31324, and was given a severity score of 9.8/10 - critical.
SAP fixed the issue in late April 2025, but at the time, multiple security firms were already seeing attacks in the wild. ReliaQuest, Onapsis, watchTowr, Mandiant, all reported observing threat actors leveraging this flaw, and among them - Chinese state-sponsored groups, as well.
Given the destructive potential of the flaw, and the fact that a patch is available for months now, Linux admins are advised to apply it without hesitation and mitigate potential threats.
Via BleepingComputer
You might also like- SAP patches recently exploited zero-day in wake of NetWeaver server attacks
- Take a look at our guide to the best authenticator app
- We've rounded up the best password managers
- Google has just confirmed that it hasn't received any official request from the UK government to weaken encryption or provide backdoor access to user data
- Earlier this year, Apple was asked to provide an encryption backdoor in its iCloud’s Advanced Data Protection feature
- This marks a growing divide in how tech giants are affected by the UK’s controversial Investigatory Powers Act and its global implications for privacy
Google has just admitted that the UK government hasn't requested access to end-to-end encrypted user data.
Meanwhile, Apple has been hit by a Technical Capability Notice (TCN) under the 2016 Investigatory Powers Act (IPA), forcing it to shutter its iCloud Advanced Data Protection feature in the UK as a result.
The backlash that followed the UK's request for access to end-to-end encrypted data from Apple echoed throughout the rest of the world. It now turns out that the request may have been more targeted than it first seemed, with Google seemingly immune to it for now.
"We haven't received a technical capabilities notice"(Image credit: Shutterstock / nikkimeel)In February this year, the UK authorities requested that Apple break its end-to-end encryption policies in the Advanced Data Protection (ADP) feature. ADP isn't on by default, but when enabled, it adds an extra layer of security. Not even Apple itself can access the data that's been encrypted in this way; it's completely private.
Unsurprisingly, the order was not met with a warm reception. Mounting scrutiny of the UK's Investigatory Powers Act (IPA) led US senators to investigate whether other companies have also received similar requests.
According to TechCrunch, Google refused to answer questions about any involvement from the UK government when prompted by US Senator Roy Wyden. Companies that are subject to government surveillance orders are unable to disclose them under UK law.
However, Wyden disclosed that at least one technology giant confirmed that it hasn't received such a notice. That turned out to be Meta, which told Wyden's office back in March that it hadn't been served an order to backdoor its encryption services.
Although Google remained silent, it appears to have broken that vow of silence in a statement to TechCrunch. Karl Ryan, Google spokesperson, said: "We haven't received a technical capabilities notice."
That's as good a confirmation as we're going to get in this situation. If Google had received such a notice, it would imply that the UK government was surveying whether a backdoor could be added to its end-to-end encryption or not.
Ryan also told TechCrunch: "We have never built any mechanism or 'backdoor' to circumvent end-to-end encryption in our products. If we say a product is end-to-end encrypted, it is."
The UK government might still back downWhen asked to build a backdoor in its ADP service, Apple instead chose to turn off the feature for users in the UK, leaving them without access to additional data protection.
Although using one of the best VPN services can help boost Brits’ online privacy, it's certainly not going to replace iCloud’s end-to-end encryption protection that users in other countries are able to benefit from.
The order was widely criticized worldwide, with US lawmakers warning against "systemic vulnerabilities." Meanwhile, Apple decided to challenge the request in Court.
More recently, two senior British officials disclosed that the UK government might have to give up on pursuing encryption backdoors due to pushback from the US government. "They don't want us messing with their tech companies," they said.
No matter where this case ultimately leads, the fact that Apple was involved, but Google walked away unscathed, is an interesting development. Google’s hands-off status may offer reassurance that the UK’s encryption demands aren’t as sweeping as they first appeared — at least not yet.
You might also like