Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

31–40 of 284 posts

Re: Bitwarden PINs can be brute-forced

#31

Post by waselighis »

Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's servers. Every. Single. Time. There's no way to use another device either. I recall, back in the day, you could activate Windows XP without internet by calling a number which would give you a long code to type in and would activate Windows. But nothing like that exists for Windows Hello. No internet? Tough luck.

In the end, I had to reinstall Windows and I'm never touching Windows Hello again.

Re: Bitwarden PINs can be brute-forced

#32

Post by juve1996 »

chiefalchemist wrote: post #11

The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).

Most people have been told that even though you're centralizing passwords (meaning if hacked you're in big trouble), the benefits gained from being able to generate strong passwords overcome this.

Is this no longer true, for most people?

Re: Bitwarden PINs can be brute-forced

#33

Post by Kwpolska »

d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.

Re: Bitwarden PINs can be brute-forced

#34

Post by SparkyMcUnicorn »

markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

1Password requires a secret key that is rarely (if ever) typed.

And there's documented steps on what to do if you've lost physical access to a device.

https://support.1password.com/lost-device/

Re: Bitwarden PINs can be brute-forced

#35

Post by prophesi »

ris58h wrote: post #23
markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN.

Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges.

> Using a PIN can weaken the level of encryption that protects your application's local vault database.

> If you are worried about attack vectors that involve your device's local data being compromised,

> you may want to reconsider the convenience of using a PIN.

https://bitwarden.com/help/unlock-with-pin/#enable-unlock-wi...

Re: Bitwarden PINs can be brute-forced

#36

Post by d-z-m »

LorenPechtel wrote: post #26
d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

A PIN is a de-facto very weak password. Of course it can be brute forced!

Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.

Re: Bitwarden PINs can be brute-forced

#37

Post by capitainenemo »

jeroenhd wrote: post #6
Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…

I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago.

These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything.

https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri...

Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.

Re: Bitwarden PINs can be brute-forced

#38

Post by yazzku »

prophesi wrote: post #35
ris58h wrote: post #23

Earlier quoted context omitted.

Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your appl…

Then why encrypt it in the first place? That's the point the author makes (text in bold).

Re: Bitwarden PINs can be brute-forced

#39

Post by jeroenhd »

Veliladon wrote: post #17
jeroenhd wrote: post #6

Earlier quoted context omitted.

Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…

>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's no…

I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.

Re: Bitwarden PINs can be brute-forced

#40

Post by prophesi »

yazzku wrote: post #38
prophesi wrote: post #35

Earlier quoted context omitted.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your appl…

Then why encrypt it in the first place? That's the point the author makes (text in bold).

It's a choice on the user to weaken the encryption. I don't use Bitwarden, but if they communicate that properly to the user, it's a valid compromise for convenience-versus-security.
Post reply on HN