Live data from Hacker News

Bitwarden design flaw: Server side iterations

palant.info

181–190 of 264 posts

Re: Bitwarden design flaw: Server side iterations

#181
post #159
post #149

Earlier quoted context omitted.

Nit: yes, it's true that making the iteration count high could actually make some devices unlock very slowly. BUT: - This only occurs when performing key derivation, i.e. when you're unlocking. It does not matter once the key is in memory. Therefore, it's actually OK if it takes a few seconds. When unlocking with biometrics, the key derivation function is not used, so on mobile devices, this occurs even less often. -…

Bitwarden already takes a couple of instants more than I'd like, each time the vault is unlocked in my phone. It's always one of those moments where I'm doing something that requires a new login, and usually the step of having to derive attention to the password manager is an undesired distraction, agravated by watching an idle screen for at least a couple of seconds while the vault decides to open, and at last I can…

If you are using PIN entry: It's the same story. Key derivation is only occurring when you actually unlock the vault, in other cases the passphrase is not used and therefore key derivation is not needed. If PIN unlocks are taking too long, it has nothing to do with PBKDF2.

If you're entering the master passphrase every time: Obviously this has the benefit of not keeping the derived key cached anywhere, even if where it's cached is 'secure'. However, if you choose a slightly less secure key, even just a couple of characters shorter, you have to keep in mind that this dramatically lowers your security. You are better off avoiding this and using features that cache the derived key on mobile devices where it's feasible to do this.

Nobody is suggesting you can't use less secure settings to make up for having slow devices. You totally can. The defaults, however, should not be designed around your needs. They should be designed around security tradeoffs that give the best outcome to the broader public. People with special requirements should be the ones touching settings like this.

I'm not sure you're actually dealing with a problem where PBKDF2 iterations are eating up a significant amount of time, though. You may just be underestimating how many iterations of PBKDF2 can fit in a second on a modern mobile SoC. I would actually guess that the reason why opening the vault takes long is unrelated to the actual unlocking process.

edit: To make it more explicit, check out this benchmark from 2012 of a pure JavaScript PBKDF2 implementation.

https://wiki.allizom.org/SJCL_PBKDF2_Benchmark

If a Google Nexus One can get 38k iterations/s on a 2010 SoC using a pure JavaScript implementation of PBKDF2 (using old browsers even!), I can assure you that the time it takes to do a couple hundred thousand rounds in native code is absolutely nothing at all on a phone from a few years later.

Re: Bitwarden design flaw: Server side iterations

#182
One way that I've many people using is to have a long random password stored on a yubikey that will be entered on long press, then you have a shorter password that you remember and type in.

So when you enter your masterpassword, you first type the part of the password you remember, then long press the yubikey to get it to enter the long static password.

Re: Bitwarden design flaw: Server side iterations

#183
post #170

Earlier quoted context omitted.

The current (and very recently updated) OWASP recommendation[1] is a minimum of 600 000 iterations [1] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

I read that as a "total of 600 000" iterations, so 300 000 locally and 300 000 on the server. Am I wrong?

[deleted]

Re: Bitwarden design flaw: Server side iterations

#185
post #118

Earlier quoted context omitted.

What are your expected failure modes? Consider this pretty common scenario: ahe user lost their one and only enrolled device. How can the user reinstate access? I suppose the user must have printed the real root password / secret key / whatever and put the paper somewhere in a safe. That password should allow to reinstate access when all hardware is lost. But it should not be required daily.

Apples solution for this with their new hardware 2fa stuff is to not let you turn it on without registering two hardware keys. So perhaps forcing two enrolled devices might work? (I have all my totp seeds on my iPhone and my iPad, for that reason.)

Tying my entire life (every account etc) to two devices that can be remote-killed by a corporation which is not your friend is definitely a risk that I would not take.

You really keep no access to your life that isn't under someone else's control?

Re: Bitwarden design flaw: Server side iterations

#186

Earlier quoted context omitted.

Apples solution for this with their new hardware 2fa stuff is to not let you turn it on without registering two hardware keys. So perhaps forcing two enrolled devices might work? (I have all my totp seeds on my iPhone and my iPad, for that reason.)

Tying my entire life (every account etc) to two devices that can be remote-killed by a corporation which is not your friend is definitely a risk that I would not take. You really keep no access to your life that isn't under someone else's control?

Please explain to us how FIDO keys can be "remote-killed".

Re: Bitwarden design flaw: Server side iterations

#187

Earlier quoted context omitted.

Apples solution for this with their new hardware 2fa stuff is to not let you turn it on without registering two hardware keys. So perhaps forcing two enrolled devices might work? (I have all my totp seeds on my iPhone and my iPad, for that reason.)

Tying my entire life (every account etc) to two devices that can be remote-killed by a corporation which is not your friend is definitely a risk that I would not take. You really keep no access to your life that isn't under someone else's control?

I was under the impression that the user is using 2 iOS devices as key generators for their 2FA. And Apple can certainly blacklist their device, delete their Account, and remotely disable their devices permanently.

If they are just registering yubikeys to their iphone and ipad so they can use their apple account... then sure, welcome to 2012.

Re: Bitwarden design flaw: Server side iterations

#188
post #118

Earlier quoted context omitted.

What are your expected failure modes? Consider this pretty common scenario: ahe user lost their one and only enrolled device. How can the user reinstate access? I suppose the user must have printed the real root password / secret key / whatever and put the paper somewhere in a safe. That password should allow to reinstate access when all hardware is lost. But it should not be required daily.

Apples solution for this with their new hardware 2fa stuff is to not let you turn it on without registering two hardware keys. So perhaps forcing two enrolled devices might work? (I have all my totp seeds on my iPhone and my iPad, for that reason.)

The obvious question is: what if you lose both keys?

Deep down, I think it's something that requires cooperating with real world entities (governments, banks, basically real world trust), not something that tech bros seem to want to do for ideological reasons

Re: Bitwarden design flaw: Server side iterations

#189
post #11

Oof, my Bitwarden account was created a while ago and was set to only 5,000 iterations. You can see and change the number of iterations here: https://vault.bitwarden.com/#/settings/security/security-key... (or if you don't trust links for something like your password manager: log into your web vault, click on the top-right dropdown menu, then Account settings > Security > Keys). I've updated it to 600,000 iterations…

I've set it up to 2 millions when I created my account. My OnePlus2 freeze for 10 seconds when logging in ^^'.

Re: Bitwarden design flaw: Server side iterations

#190

Earlier quoted context omitted.

Please elaborate, how can you pick bad words for a passphrase? (Except obviously a movie title or an everyday sentence) Like, if I go "street bologna drawer sunset fang", did I do well?

Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think. Completely random choice of words is good, but it is not feasible to remember random passphrases for all of your accounts. Other common methods include appending a particular character to each word or alternate words...creating a pattern of sort, but this again makes it diff…

> Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think.

In English. Not all books in all languages ever published are "somewhere out there".

Post reply on HN