> It can be observed that since the algorithm is removing up to two top level domains, it actually treats victim.co.uk, victim.com, victim.de and even test.victim.co.at as if they were identical

> it has been noticeable that the development process of the RememBear suite was affected by tight deadlines. Evidencing this was the fact that builds were generally provided only one or two days before actual testing started, leaving little room for in-depth reconnaissance

TunnelBear's pull-quote @ https://www.remembear.com/blog/remembear-security-audit/:

> we’re proud to share that no critical security issues were discovered

I'd consider putting credentials on an incorrect domain a showstopper for a password manager, but whatever.