Researchers have shown that some commercial password managers may not be a watertight way to ensure cyber security. After creating a malicious app to impersonate a legitimate Google app, they were able to fool two out of five of the password managers they tested into giving away a password.