81–90 of 284 posts
Earlier quoted context omitted.
Using a TPM: https://en.wikipedia.org/wiki/Trusted_Platform_Module
TPM interdiction is readily possible.
Anyway if a TPM was trivially bypassable then there would be no point to having them so I'm doubtful of whatever this off-hand comment is supposed to mean
The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…
Earlier quoted context omitted.
A PIN is a de-facto very weak password. Of course it can be brute forced!
In the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.
The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).
Most people have been told that even though you're centralizing passwords (meaning if hacked you're in big trouble), the benefits gained from being able to generate strong passwords overcome this. Is this no longer true, for most people?
Perfect? No. 100x better than what most people do? Yes!!!
Moi? For the important stuff? I add in a YubiKey. Perfect? Again, no. But closer than no YK at all.
As a side note: I do contract web dev work for various agencies. Generally, talk about a lazy approach to clients' PWs. They think 1PW makes things secure. Meanwhile I generally have access to all vaults, even projects I'm not working on. Good sec is bases on less trust, not too much blind trust.
The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Earlier quoted context omitted.
Lots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 12…
I’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.
Earlier quoted context omitted.
I’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.
Yet, people stole LastPass vaults. Why bother stealing them if you don't plan to actually crack them? At least someone saw the potential for some ROI.
If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.
Earlier quoted context omitted.
> including copying the Bitwarden file and using a GPU farm to crack the master password. That should still take essentially forever, or did I miss some advances in brute forcing?
Lots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 12…