Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

71–80 of 284 posts

Re: Bitwarden PINs can be brute-forced

#71

Post by gowings97 »

Suddenly getting Error Code 7 (unusual network detected - https://bitwarden.com/help/unusual-traffic-error/) when attempting to login. Googling and looking on Twitter - people have been complaining about this happening to them as well.

- https://www.reddit.com/r/Bitwarden/comments/110gpkt/traffic_...

-https://www.reddit.com/r/Bitwarden/comments/11vplwv/network_...

- https://twitter.com/lazminutes/status/1624946344564781056

Locking me out of 2FA because of you don't like my network traffic? Yeah, I will be immediately leaving your service, bye. That's Google like bro, lol. Clown stuff. Insane that they would even think of doing this.

Re: Bitwarden PINs can be brute-forced

#72

Post by hn_throwaway_99 »

Semaphor wrote: post #46
Kwpolska wrote: post #33

Earlier quoted context omitted.

If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.

> including copying the Bitwarden file and using a GPU farm to crack the master password. That should still take essentially forever, or did I miss some advances in brute forcing?

Lots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords.

1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 128) value, which does make cracking impossible. The user has to print out this value so that if they need to sign in on a new device that they can enter the value, so it adds a little friction, but 1P has the right idea that humans just can't be relied upon to generate and memorize high entropy strings, in general.

Re: Bitwarden PINs can be brute-forced

#74

Post by Macha »

Veliladon wrote: post #17
jeroenhd wrote: post #6

Earlier quoted context omitted.

Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…

>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's no…

With that said, after a nasty experience with the zen 2 fTPM repeatedly resetting, I have a hard time trusting the reliability of the AMD fTPM.

Re: Bitwarden PINs can be brute-forced

#76

Post by waboremo »

mt360 wrote: post #65
waboremo wrote: post #47

Earlier quoted context omitted.

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

I wouldn't put too much faith in biometrics either, a real shame considering their convenience. https://blog.kraken.com/post/11905/your-fingerprint-can-be-h... Personally I advocate using BitWarden for commonly used logins that, if they were compromised, would not be catastrophic; perhaps in some cases because 2FA provides another, tautologically, factor, and KeePass secured with a FIDO2 device in challenge response…

That's an absurd amount of effort to bypass fingerprint biometrics, nice.

However, it's important to note here that biometrics isn't just about fingerprints and every OS handles their available biometrics options differently. For example, I would recommend face authentication on apple devices, however I would avoid using face for windows, and instead recommend a windows hello PIN (yes, it's handled differently than the PIN in the above article).

Ultimately, you're just trying to create a balance between the layers of protection and reasonable attacks. There's only so much you can protect against, nobody can withstand someone who is cloning fingerprints, stealing devices, has access to your separate device 2FA, etc. without severely affecting their lifestyle.

Re: Bitwarden PINs can be brute-forced

#77

Post by Macha »

IceWreck wrote: post #9
billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

It already exists: keepass and sync your DB on all your devices with syncthing (which is p2p). Or host vaultwarden on your homeserver and access it only through wireguard/nebula self hosted VPN.

Note the KeePass's resistance to the attack mentioned depends on the security of .NET's secure string, which, here's what Microsoft has to say about it (https://github.com/dotnet/platform-compat/blob/master/docs/D...)

As for KeePassXC, last I checked it didn't even bother.

Re: Bitwarden PINs can be brute-forced

#78

Post by GordonS »

vel0city wrote: post #41
waselighis wrote: post #31

Earlier quoted context omitted.

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's s…

I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.

I've never had the problem the GP had, but I have had Windows Hello "forget" biometrics were even configured - it's happened at least 3 times now, I guess after a Windows Update. Each time I go to login with a fingerprint, but it gives an error message and insists on the password instead, and then I have to setup Windows Hello from scratch.

It's mind-boggling how shit Windows Hello is :-/

Re: Bitwarden PINs can be brute-forced

#79

Post by waboremo »

jjeaff wrote: post #62
waboremo wrote: post #49

Earlier quoted context omitted.

I think you're confused. Windows Hello works offline. You were probably trying to sign into your Microsoft account, which IS online. Mind you, the forced Microsoft account for new Windows 11 users is a huge problem. But it's a different one.

I am using my Microsoft account to login to my windows 11 systems. And they do seem to cache for offline access. Because I am still able to login without internet access.

Thanks for letting me know, I couldn't find any reputable sources on if they cache for offline when used with a Microsoft account.

Re: Bitwarden PINs can be brute-forced

#80

Post by Semaphor »

hn_throwaway_99 wrote: post #72
Semaphor wrote: post #46

Earlier quoted context omitted.

> including copying the Bitwarden file and using a GPU farm to crack the master password. That should still take essentially forever, or did I miss some advances in brute forcing?

Lots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 12…

I’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.
Post reply on HN