Researchers investigated the zero-knowledge claims of password managers—and found some possible attack scenarios.