Bitwarden PINs can be brute-forced • Hacker News Board

Re: Bitwarden PINs can be brute-forced

#61

Post by waboremo » Sun, Mar 19, 2023, 4:31 PM UTC

jeroenhd wrote: post #39

Veliladon wrote: post #17

Earlier quoted context omitted.

>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's no…

I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.

Windows Hello doesn't require 2.0, it works on 1.2.

There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.

Re: Bitwarden PINs can be brute-forced

#62

Post by jjeaff » Sun, Mar 19, 2023, 4:31 PM UTC

waboremo wrote: post #49

waselighis wrote: post #31

Earlier quoted context omitted.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

I think you're confused. Windows Hello works offline. You were probably trying to sign into your Microsoft account, which IS online. Mind you, the forced Microsoft account for new Windows 11 users is a huge problem. But it's a different one.

I am using my Microsoft account to login to my windows 11 systems. And they do seem to cache for offline access. Because I am still able to login without internet access.

Re: Bitwarden PINs can be brute-forced

#63

Post by nicoburns » Sun, Mar 19, 2023, 4:34 PM UTC

d-z-m wrote: post #36

LorenPechtel wrote: post #26

Earlier quoted context omitted.

A PIN is a de-facto very weak password. Of course it can be brute forced!

Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.

If it’s n or convenient then users won’t use a password manager at all:

Re: Bitwarden PINs can be brute-forced

#64

Post by renewiltord » Sun, Mar 19, 2023, 4:36 PM UTC

NoZebra120vClip wrote: post #50

waboremo wrote: post #47

Earlier quoted context omitted.

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

PINs can be changed. How many fingers ya got?

Ten. I don't get why this is a constraint.

If they're rubberhosing me, I'll just give them the master pass. They won't have to take my finger.

If they get my fingerprint some other way, I can just switch to my next finger. And when I'm done, I can use PINs.

I don't think it's mutability that matters. It's just that I leave fingerprints everywhere.

Re: Bitwarden PINs can be brute-forced

#65

Post by mt360 » Sun, Mar 19, 2023, 4:40 PM UTC

waboremo wrote: post #47

prophesi wrote: post #35

Earlier quoted context omitted.

To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your appl…

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

I wouldn't put too much faith in biometrics either, a real shame considering their convenience.

https://blog.kraken.com/post/11905/your-fingerprint-can-be-h...

Personally I advocate using BitWarden for commonly used logins that, if they were compromised, would not be catastrophic; perhaps in some cases because 2FA provides another, tautologically, factor, and KeePass secured with a FIDO2 device in challenge response mode, a passphrase, and possibly setting a higher key stretching work factor to further blunt any brute force attempt, in which more important data is held.

Re: Bitwarden PINs can be brute-forced

#66

Post by CMCDragonkai » Sun, Mar 19, 2023, 4:42 PM UTC

billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

We've been building a p2p password vault called Polykey. https://GitHub.com/MatrixAI/Polykey.

Re: Bitwarden PINs can be brute-forced

#67

Post by folmar » Sun, Mar 19, 2023, 4:43 PM UTC

KMnO4 wrote: post #52

jeron wrote: post #48

Earlier quoted context omitted.

If you limit number of attempts, can it still be brute forced?

How can you enforce a limit when the decryption is done client side?

Using a smart card or compatible, nowadays often a TPM chip/SecureZone/Secure Enclave or similar.

Re: Bitwarden PINs can be brute-forced

#68

Post by waboremo » Sun, Mar 19, 2023, 4:44 PM UTC

NoZebra120vClip wrote: post #50

waboremo wrote: post #47

Earlier quoted context omitted.

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

PINs can be changed. How many fingers ya got?

I'm pretty sure you can register the same finger over and over again for new "keys". Assuming you go through the tedious process of disabling, restarting, etc whatever each one of the underlying OS demands. It's an additional layer that Bitwarden (and other apps) do not get direct access to.

So no excuse if you value convenience, PINs are not good. Short easy to remember and enter PINs are also the reason Apple is under fire due to how easily you can avoid biometrics and just use the 6 digit PIN.

Re: Bitwarden PINs can be brute-forced

#69

Post by intelVISA » Sun, Mar 19, 2023, 4:46 PM UTC

ericpauley wrote: post #59

KMnO4 wrote: post #52

Earlier quoted context omitted.

How can you enforce a limit when the decryption is done client side?

Using a TPM: https://en.wikipedia.org/wiki/Trusted_Platform_Module

TPM interdiction is readily possible.

Re: Bitwarden PINs can be brute-forced

#70

Post by duxup » Sun, Mar 19, 2023, 4:47 PM UTC

NoZebra120vClip wrote: post #56

LorenPechtel wrote: post #26

Earlier quoted context omitted.

A PIN is a de-facto very weak password. Of course it can be brute forced!

In the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.

TIL

Thanks, when windows moved to the PIN I was wondering how that worked/ they kept it secure but still easy to login.