Keeper Security Files Bullshit SLAPP Suit Against Ars Technica, Letting Many More People Know Not To Use Its Software

from the fuck that dept

If you’re a security software company and you want to know the best way to make sure that no security professional ever recommends your software ever again, you should do what Keeper Security did and sue a respected security journalist for reporting on your security flaws. As first reported by Zack Whittaker (link above), Keeper Security has filed a totally bullshit SLAPP lawsuit against Ars Technica and its widely respected security reporter Dan Goodin. Last week Goodin published a story about a major flaw in the browser extension for Keeper’s password manager, that was bundled with Windows.

The flaw was actually discovered by Google’s Tavis Ormandy, who has a long history of discovering fairly high profile bugs — especially in password managers (he famously found a big flaw in LastPass, earlier this year). Notice how LastPass responded, though. It worked with Tavis on fixing the problem and rushing out a solution. Compare that to how Keeper responded. It fixed the bug… but it’s also filed a lawsuit — but not against Ormandy. Instead, it’s suing Ars and Goodin. And, let’s be clear: the lawsuit is bullshit.

The crux of the complaint from Keeper is that it wasn’t Keeper’s main software that had the vulnerability, but rather its browser extension plugin. This is a meaningless and silly distinction. Almost anyone using a software password manager (as you should) will install the browser plugins to go with the software. The software without the browser plugins is almost useless. The fact that Goodin didn’t initially note the very trivial detail that the browser plugin wasn’t included in the initial bundle, but would only be installed later once someone started using Keeper is meaningless, and not even close to defamatory.

Here’s how Keeper describes it in their own lawsuit:

Before any such “vulnerability” could have any chance to impact a user, the user would have to be subject to specific conditions and take the following steps: (1) the user would have to separately install the Keeper Browser Extension; then (2) sign into the Keeper Browser Extension (which requires the user to first have a registered Keeper account); then (3) create and store (or have existing and previously created) website login credentials inside their Keeper Vault; then (4) visit a malicious website set up to steal a user’s website login credentials; then (5) the malicious website would have to inject a specific type of malware into the Keeper Browser Extension. This omission from all versions of the Article was material because without this relevant information, readers were misled to believe that their computers were infected simply by having Keeper software installed on their devices.

Whether or not it is “material” or even whether or not it is good reporting, is not meaningful when it comes to the question of defamation.Basically all of the statements that Goodin made that Keeper claims are defamatory are statements of opinion, in which Goodin laid out the facts on which he based his statements. Providing the underlying facts and stating an opinion is not defamatory. For example, among the statements that Keeper claims are defamatory are the following:

1) “For 8 days Windows bundled a password manager with a critical plugin flaw.”

2) “plugin for Win 10 Version of Keeper had bug allowing sites to steal passwords.”

3) “For about eight days, some versions of Windows 10 quietly bundled a password manager that contained a critical vulnerability in its browser plug in, a researcher said Friday.”

4) “If an outsider can find a bug similar to the 16-month-old vulnerability so quickly and easily, it stands to reason people inside the software company should have found it first.”

5) “It’s also possible third-party apps don’t come with the same security assurances of other Microsoft software.”

None of those are even close to defamatory. They are a mix of statements based on disclosed facts and opinion. Even more ridiculously, Keeper claims that Goodin and Ars published this story “knowing and intending that the Article would cause injury to Keeper.” That’s bullshit. There is no way that Goodin would be publishing a story with knowing falsehoods or one “intending” to cause harm to a company like Keeper. He was just reporting on the facts of the story, which Keeper itself does not dispute.

The lawsuit was filed in Illinois, where Keeper is based, and Keeper and its lawyers probably should have noticed that Illinois has an Anti-SLAPP law, which says they’ll have to pay Ars and Goodin’s attorneys’ fees if the case is determined to be a SLAPP suit, which it almost certainly should be. Either way, the lawsuit has made many more people (a) aware that Keeper’s software had a bug in it and (b) that it is not software worth using. Lots of people in the security world are now making sure that lots of people know to stay away from Keeper. There are better products on the market, offered up by companies who don’t try to abuse the judicial system to stop reporters from commenting on their flaws. Use those products instead.

Next time, maybe fix the flaw and apologize without suing reporters for writing about it.

Filed Under: , , , , , , ,
Companies: conde nast, keeper security

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Keeper Security Files Bullshit SLAPP Suit Against Ars Technica, Letting Many More People Know Not To Use Its Software”

Subscribe: RSS Leave a comment
Mike Masnicksays:


Ars Technica is a California based company. I suspect they will ask a California Court to hear it as they have no presence in Illinois.

Keeper is based in Illinois, so they’ll claim jurisdiction. It would be surprising if they were able to transfer the case — so surprising that I doubt Ars would even try. Besides, as I note in the post, Illinois has a decent anti-SLAPP law, so they can just make use of that.


Re: The software without the browser plugins is almost useless.

I use a different password manager and I am also fine with the copy and paste method. It helps keep the attack surface smaller because there is less code and the clipboard is very easy to clear.

I can see why people would like the browser extension but I feel it is a negligible feature.

Re: Re: The software without the browser plugins is almost useless.

Indeed. Given the number of vulnerabilities we’ve seen in password-storing browser plugins, I can’t imagine why anybody would use one. Copying and pasting from an external app adds a couple of steps, sure, but you can rest assured that the external app’s not going to be pwned through your browser.

Anonymous Cowtardsays:

Re: Re: Re: The software without the browser plugins is almost useless.

“Copying and pasting from an external app adds a couple of steps, sure, but you can rest assured that the external app’s not going to be pwned through your browser.”

Sure, but then the clipboard can be read from the browser if you have javascript enabled.

If c/p works, it also works to just select and drop the password in the textfield. Saving the extra steps and foils clipboard snooping.

Re: Re: Re: Re: The software without the browser plugins is almost useless.

Sure, but then the clipboard can be read from the browser if you have javascript enabled.

I’m not aware of any modern browser that gives JS unrestricted access to the clipboard. (IE used to, but it’s been disabled by default since IE8.) JS can only read the clipboard on a Paste event.

Machin Shinsays:

Re: The software without the browser plugins is almost useless.

Still doesn’t make this any less of a security problem. Many people would have installed the plugin and opened themselves up to this security issue.

Also it is about like someone coming to your house and getting food poisoning. Then when they complain about how the meatloaf poisoned them you sue saying “No it was NOT my meatloaf. It was my salad!”

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Older Stuff
15:51 [UPDATED]: Myanmar's Military Junta Sentences American Journalist To Eleven Years In Prison (8)
12:01 Hong Kong Government Now Directly Censoring Films In Hopes Of Shutting Down Protest-Related Documentaries (21)
10:50 Fifth Circuit Appeals Court Strips Immunity For Officers Who Arrested A Journalist For Asking Questions (16)
10:44 Why Falsely Claiming It's Illegal To Shout Fire In A Crowded Theater Distorts Any Conversation About Online Speech (85)
05:36 Massachusetts College Decides Criticizing The Chinese Government Is Hate Speech, Suspends Conservative Student Group (144)
16:07 Court Says City Of Baltimore's 'Heckler's Veto' Of An Anti-Catholic Rally Violates The First Amendment (28)
12:19 Chicago Court Gets Its Prior Restraint On, Tells Police Union Head To STFU About City's Vaccine Mandate (385)
11:03 LinkedIn (Mostly) Exits China, Citing Escalating Demands For Censorship (24)
12:10 Court Tells Arkansas Troopers That Muting Anti-Cop Terms On Its Facebook Page Violates The 1st Amendment (37)
13:43 Right-Wing Commentator Dan Bongino Runs Into Florida Anti-SLAPP Law, Now Owes Daily Beast $32,000 In Legal Fees (14)
20:41 North Carolina Sued By Flying Dog Brewery Over Regulatory Body Refusing To Allow Sales Due To 'Offensive' Label (19)
09:59 Now Josh Hawley Is Threatening Google Over 1st Amendment Protected Expression (44)
12:08 PETA Sues NIH And HHS Directors For Blocking Comments With 'PETA' And '#StopAnimalTesting' (59)
10:57 Appeals Court Says The First Amendment Protects Minnesota Woman's Right To Be Super-Shitty About Nearby Islamic School (68)
12:00 Elizabeth Warren Threatens Amazon For Selling Books Containing Misinformation; Perhaps Forgetting The 1st Amendment (49)
09:26 8th Circuit's Bizarre Ruling In Devin Nunes' SLAPP Suit Against Reporter Ryan Lizza (13)
10:43 Satire Site Gets Ridiculous Threat Letter From Baseball Team; cc's Barbra Streisand In Its Response (20)
12:12 Commentator Insists That Fact Checking Is An Attack On Free Speech (163)
13:34 Court: Just Because An Anonymous Yelp Reviewer Is Mean, Doesn't Mean You Get To Unmask The Reviewer (26)
12:06 Computer Repair Shop Owner Has To Pay Twitter's Legal Fees Over Bogus SLAPP Suit Regarding Hunter Biden's Laptop (108)
13:36 Report Shows DOJ Engaged In Selective Prosecution To Maximize Punishment For 'Black Lives Matter' Protesters (22)
16:02 Appeals Court Shuts Down Kansas' 30-Year-Old Ag Gag Law (23)
13:39 Ninth Circuit Affirms MSNBC's Anti-SLAPP Motion Against OAN Network's Bullshit Defamation Lawsuit (102)
10:51 Appeals Court Says Iowa's Ag-Gag Law Is About 50 Percent Constitutional (15)
13:45 Nassau County Executive Vetoes Bill That Would Punish People For Making Cops Feel Bad (15)
12:24 Shiva Ayyadurai Drops His Potentially Interesting Lawsuit About Massachusetts Officials Complaining To Twitter About Tweets (33)
12:03 President Of France Sues Citizen Over Billboard Comparing Macron To Hitler (20)
10:44 Top German Court Says Facebook Must Inform Users About Deleting Their Posts Or Suspending Their Account, Explain Why, And Allow Them To Respond (17)
10:44 Superior Court Dumps BS Charges Brought Against New Jersey Homeowner For Her 'Fuck Biden' Signs (20)
03:27 Appeals Court Denies Immunity To University Officials Who Apparently Banned A Christian Student Group Just Because They Didn't Like It (33)
More arrow
This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it