I still haven't seen a clear explanation of how the # of iterations scales in relation to password length. If it is true a few extra characters is as good as having sky-high iterations, the guidance should be on 'forcing' users choose long-enough passwords, not in this nitpicking over the 'right' # of iterations.
Number of iterations being discussed is how many times the password is hashed. It is a setting the system chooses and is independent of the password length the user chooses. If you are asking if the length of the password by itself be sufficient to create a secure password, then the answer is mostly no. You need many iterations of the hashing process otherwise brute force attacks become trivial given today's hardware…
Bitwarden design flaw: Server side iterations
21–30 of 264 posts
Re: Bitwarden design flaw: Server side iterations
#22I still haven't seen a clear explanation of how the # of iterations scales in relation to password length. If it is true a few extra characters is as good as having sky-high iterations, the guidance should be on 'forcing' users choose long-enough passwords, not in this nitpicking over the 'right' # of iterations.
The number of iterations scales linearly with the cost of brute-forcing. The cost scales exponentially with the length of the password, assuming a random password (stops scaling when you reach the hash size I think). Both are important because you can't freely increase the password length, they become more annoying to enter and remember.
If we choose our password from only ~24 chars then you can get the same effect of 100K iterations form just 4 more characters, or ~1 more dictionary word.
That doesn't seem excessive
Re: Bitwarden design flaw: Server side iterations
#23Earlier quoted context omitted.
Even a fairly middling password manager implementation is better than just about any other strategy that anyone is likely to use. Especially because for the vast majority, the other strategy is going to be reusing the same password ~everywhere and if you're lucky the might use a special password for their bank or something.
I guess for most people online, writing all their passwords down in a notebook is more secure than using a password manager. It’s just less convenient.
Re: Bitwarden design flaw: Server side iterations
#24Oof, my Bitwarden account was created a while ago and was set to only 5,000 iterations. You can see and change the number of iterations here: https://vault.bitwarden.com/#/settings/security/security-key... (or if you don't trust links for something like your password manager: log into your web vault, click on the top-right dropdown menu, then Account settings > Security > Keys). I've updated it to 600,000 iterations…
Re: Bitwarden design flaw: Server side iterations
#25I still haven't seen a clear explanation of how the # of iterations scales in relation to password length. If it is true a few extra characters is as good as having sky-high iterations, the guidance should be on 'forcing' users choose long-enough passwords, not in this nitpicking over the 'right' # of iterations.
The number of iterations scales linearly with the cost of brute-forcing. The cost scales exponentially with the length of the password, assuming a random password (stops scaling when you reach the hash size I think). Both are important because you can't freely increase the password length, they become more annoying to enter and remember.
Re: Bitwarden design flaw: Server side iterations
#26Earlier quoted context omitted.
Even a fairly middling password manager implementation is better than just about any other strategy that anyone is likely to use. Especially because for the vast majority, the other strategy is going to be reusing the same password ~everywhere and if you're lucky the might use a special password for their bank or something.
I guess for most people online, writing all their passwords down in a notebook is more secure than using a password manager. It’s just less convenient.
If your notebook is destroyed (e.g. dog eats it, fire, water damage, et al) then all your passwords are gone. With most good password managers you can actually backup and store a copy of your vault data locally.
Re: Bitwarden design flaw: Server side iterations
#27Re: Bitwarden design flaw: Server side iterations
#28If you think it's ok to be putting all your passwords on some random server owned by a random company then I don't know if you care about any other design flaws. This also includes the websites you visited and just happened to either accidentally or on purpose save your login. Now multiply the privacy/security implications of that when said company is pumped and dumped by a major VC.
Re: Bitwarden design flaw: Server side iterations
#29Oof, my Bitwarden account was created a while ago and was set to only 5,000 iterations. You can see and change the number of iterations here: https://vault.bitwarden.com/#/settings/security/security-key... (or if you don't trust links for something like your password manager: log into your web vault, click on the top-right dropdown menu, then Account settings > Security > Keys). I've updated it to 600,000 iterations…
Re: Bitwarden design flaw: Server side iterations
#30Oof, my Bitwarden account was created a while ago and was set to only 5,000 iterations. You can see and change the number of iterations here: https://vault.bitwarden.com/#/settings/security/security-key... (or if you don't trust links for something like your password manager: log into your web vault, click on the top-right dropdown menu, then Account settings > Security > Keys). I've updated it to 600,000 iterations…