Is VMP Pass safe?

Question

Is VMP Pass safe?

Accepted Answer

VMP Pass is high risk. When you use this password manager to fill in or save credentials on a website, the extension sends your account email address, the full URL of that page, the page title, and the domain name to a custom analytics server run by the developer at passwordmanager.themebeaver.com. This happens without notifying the user in the background on every autofill and autosave interaction. Dynamic analysis confirmed a canary email address injected into extension storage appeared in the POST body sent to this server. Every time this password manager extension loads — either when Chrome starts or when you open the popup — it without notifying the user contacts ipapi.co, a third-party geolocation service, to look up the city, region, country, and country code associated with your IP address. That location data is then bundled into analytics payloads sent to the developer's own server at passwordmanager.themebeaver.com. Your IP address is exposed to ipapi.co even if you never interact with the extension's geolocation features.

Is VMP™ Pass Password Manager safe?

Findings