11–20 of 284 posts
Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).
the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…
Note that on desktop Bitwarden allows PINs to be alphanumeric, and any length. I use a PIN because my master password is more than 20 characters and I don't want to type it every time I restart my browser. My PIN is a decently strong password in its own right, but shorter than my actual master password.
It's a tricky problem, because on devices without biometric authentication I really don't want to type in my long master password every time! I think I'd appreciate an option such that: 1. If I'm online, I can unlock with a pin. Some critical piece of information would be kept server-side, and the server would limit unlock attempts. 2. If I'm offline and need access to my vault—which happens but not too often—I need…
You don't actually need biometrics, you just need a TPM to handle your pin-to-password function with an attempt limit.
I'd guess a software engineer working on that part of a security system would probably consider that, while the implementation approach for that part was being decided.
If so, why did it happen anyway? Did they communicate the weakness to users?
The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…
How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.
Earlier quoted context omitted.
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…
>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's no…
The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activity by an attacker is occurring.
However, users probably have the reasonable expectation that if their laptop is stolen, their device-local vault data(supposedly encrypted on disk) is not compromised as a result. Bitwarden should either disallow weak pins/pin-access altogether, or they should caveat more clearly the weaknesses of pin-only access to device-local vault data.
[0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...