Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

41–50 of 284 posts

Re: Bitwarden PINs can be brute-forced

#41

Post by vel0city »

waselighis wrote: post #31
Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.

Re: Bitwarden PINs can be brute-forced

#42

Post by Dalewyn »

waselighis wrote: post #31
Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

Security enthusiasts will scream bloody murder, but fact of the matter is nothing beats a simple password for balancing security and practicality.

Re: Bitwarden PINs can be brute-forced

#43

Post by yazzku »

prophesi wrote: post #40
yazzku wrote: post #38

Earlier quoted context omitted.

Then why encrypt it in the first place? That's the point the author makes (text in bold).

It's a choice on the user to weaken the encryption. I don't use Bitwarden, but if they communicate that properly to the user, it's a valid compromise for convenience-versus-security.

This doesn't answer the question. Why is there a choice to encrypt something when it's completely unnecessary (according to their threat model)? No point in building unnecessary complexity into software, especially software meant for security.

Re: Bitwarden PINs can be brute-forced

#44

Post by SparkyMcUnicorn »

waselighis wrote: post #31
Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

I remember some of the piracy tools activated windows by generating these phone codes.

Re: Bitwarden PINs can be brute-forced

#45

Post by Dalewyn »

juve1996 wrote: post #32
chiefalchemist wrote: post #11

The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).

Most people have been told that even though you're centralizing passwords (meaning if hacked you're in big trouble), the benefits gained from being able to generate strong passwords overcome this. Is this no longer true, for most people?

I can count on one hand the number of services that are important/crucial enough to warrant unique, strong passwords.

All the rest I just reuse simple passwords because they simply aren't important and aren't worth the time to care. Someone wants my Discord? Go for it, I don't care. My Reddit goes with it? Sure, I don't care. My HN account too? Daring today, aren't we.

So no, personally I haven't felt a need nor desire for a password manager. Arguably it will cause me more grief than convenience.

Re: Bitwarden PINs can be brute-forced

#46

Post by Semaphor »

Kwpolska wrote: post #33
d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.

> including copying the Bitwarden file and using a GPU farm to crack the master password.

That should still take essentially forever, or did I miss some advances in brute forcing?

Re: Bitwarden PINs can be brute-forced

#47

Post by waboremo »

prophesi wrote: post #35
ris58h wrote: post #23

Earlier quoted context omitted.

Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your appl…

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison.

It is something they should remove entirely in an upcoming version after giving users enough warning.

Re: Bitwarden PINs can be brute-forced

#48

Post by jeron »

LorenPechtel wrote: post #26
d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

A PIN is a de-facto very weak password. Of course it can be brute forced!

If you limit number of attempts, can it still be brute forced?

Re: Bitwarden PINs can be brute-forced

#49

Post by waboremo »

waselighis wrote: post #31
Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

I think you're confused. Windows Hello works offline. You were probably trying to sign into your Microsoft account, which IS online.

Mind you, the forced Microsoft account for new Windows 11 users is a huge problem. But it's a different one.

Re: Bitwarden PINs can be brute-forced

#50

Post by NoZebra120vClip »

waboremo wrote: post #47
prophesi wrote: post #35

Earlier quoted context omitted.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your appl…

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

PINs can be changed. How many fingers ya got?
Post reply on HN