

If it’s the problem that I’ve seen people complain about in the past, it’s effectively the same as HTTPS ‘not supporting’ end to end encryption because it runs over IP and IP packets contain the IP address of where they need to go, so someone can see that two IP addresses are communicating, which is unavoidable as otherwise there’s nothing to say where the data needs to go, so no way for it to get there. Someone did a blog post a couple of years ago claiming Matrix was unsecure as encrypted messages had their destination homeserver in plaintext, but that doesn’t carry any information that isn’t implied by the fact that the message is being sent to that homeserver’s IP.

Password managers are supposed to be designed to resist a situation where they’re compromised, and are only ever supposed to see a mysterious blob of encrypted data without ever having access to any information that would help decrypt it. The headline’s more like M1 Abrams Tanks Vulnerable to Small Arms Fire - it’d be totally expected that most things die when shot with bullets, but the point of a tank is that it doesn’t, so it’s a big deal if it does.