heise Security says it has taken apart eesy, a password manager that keeps its secrets on paper, and cracked the scheme. The product sits in a small but stubborn niche: instead of storing credentials in an app, it gives users a printed booklet from which they work out their passwords by hand. The appeal is obvious — nothing sits on a server, so there is nothing to lift remotely.
The catch is structural, and not specific to one vendor. A printed booklet contains the scheme itself, which is to say the key to every password derived from it. Anyone who understands the booklet — or simply photographs all of it — can derive the credentials without ever having had access to an account. Unlike software, there is no patch: a scheme that has been disclosed cannot be repaired after the fact, and the affected passwords cannot be rotated centrally. Losing the booklet, or having it copied, is therefore not an incident but a total loss.
For users, the practical advice is to treat every derived password as compromised once a booklet is lost, photographed or published, and to replace them one by one. The full analysis, including the attack method, is behind heise+'s paywall and was not available to us for this summary.
