Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

131–140 of 284 posts

Re: Bitwarden PINs can be brute-forced

#131

Post by usefulcat »

pmontra wrote: post #123
nebulous1 wrote: post #106

Earlier quoted context omitted.

It already is intentionally "slow". However, for a 4 digit pin there are only 10 thousand combinations. It is not practical for it to be so slow that 10000x it is an infeasible amount of time. Not only would the user have to way too long on each entry, the attacker could just use faster hardware.

Or multiple machines. There are about 31k seconds in a year. 3.1 seconds per iteration seems already slow as a response time to unlock a db so it's about one year for those 10000 attempts. Split it between 10 machines by first digit, it's down to a little more than one month. Split it between 100 machines by the first two digits and it's down to half a week. A four digit PIN is poor security. What Bitwarden could do…

31.5 million seconds in a year

Re: Bitwarden PINs can be brute-forced

#132

Post by chrisandchris »

0xdeafbeef wrote: post #104
morpheuskafka wrote: post #100

Earlier quoted context omitted.

If the PIN is local, only a secure element type of chip could meaningfully enforce this restriction. Otherwise, whatever memory or disk stores the secret encrypted only by the 4-digit PIN could still be brute forced. Just disabling entering a PIN in the UI would not be enough for security.

You can use pbdkf2 with 200k iterations or argon2 to derive key from pin

Which will still be ... nothing?

> [...] As a comparison baseline, a 2.4 GHz Core2 CPU can perform about 2.3 millions of elementary SHA-256 computations per second (with a single core), so this would imply, on that CPU, about 20000 rounds to achieve the "8 milliseconds" goal.

So you'll need something that takes at least as long as entering your full password, at which point you basically could enter the full password (from a UX perspective). They PIN is here to make it faster and it will always be security vs. ease-of-use.

[1] https://security.stackexchange.com/questions/3959/recommende...

Re: Bitwarden PINs can be brute-forced

#133

Post by IshKebab »

asveikau wrote: post #126
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

They could make it take more time to derive a key from a pin. That would make it more difficult to brute force.

Consider how long you need to make it before it is infeasible to brute force a 4 digit PIN.

Re: Bitwarden PINs can be brute-forced

#134

Post by lyu07282 »

asveikau wrote: post #126
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

They could make it take more time to derive a key from a pin. That would make it more difficult to brute force.

They do that already:

> This brute-force will very likely be successful, since PINs are usually very low-entropy. Now, granted, the key derivation function is PBKDF2 with 100000 iterations (+ HKDF), but that won't help with a 4 digit pin.

It would be better to not have that feature at all, that convenience feature goes a bit too far. But nice to see that's the only thing they found, I'm sure they looked for more severe issues but found none.

Re: Bitwarden PINs can be brute-forced

#135

Post by TJSomething »

0xdeafbeef wrote: post #104
morpheuskafka wrote: post #100

Earlier quoted context omitted.

If the PIN is local, only a secure element type of chip could meaningfully enforce this restriction. Otherwise, whatever memory or disk stores the secret encrypted only by the 4-digit PIN could still be brute forced. Just disabling entering a PIN in the UI would not be enough for security.

You can use pbdkf2 with 200k iterations or argon2 to derive key from pin

An Nvidia RTX 4090 can crack a 4 digit pin using PBKDF2 with 200k iterations in less than a quarter of a second. Argon2 is definitely the better option, but even at 1 hash per second, that's less 3 hours.

Re: Bitwarden PINs can be brute-forced

#136

Post by chrisandchris »

pmontra wrote: post #123
nebulous1 wrote: post #106

Earlier quoted context omitted.

It already is intentionally "slow". However, for a 4 digit pin there are only 10 thousand combinations. It is not practical for it to be so slow that 10000x it is an infeasible amount of time. Not only would the user have to way too long on each entry, the attacker could just use faster hardware.

Or multiple machines. There are about 31k seconds in a year. 3.1 seconds per iteration seems already slow as a response time to unlock a db so it's about one year for those 10000 attempts. Split it between 10 machines by first digit, it's down to a little more than one month. Split it between 100 machines by the first two digits and it's down to half a week. A four digit PIN is poor security. What Bitwarden could do…

Split it to 5000 machines, which will be "quite easy to get" for a computation that takes a single line in most languages. Then we're talking about 6 seconds and 50% success on first try.

Re: Bitwarden PINs can be brute-forced

#137

Post by IshKebab »

subeadia wrote: post #114

"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png

That's about as unclear as I could imagine. "If you use this option please ensure you take the appropriate precautions."

Re: Bitwarden PINs can be brute-forced

#138

Post by nabakin »

FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

Re: Bitwarden PINs can be brute-forced

#139

Post by intelVISA »

lucb1e wrote: post #81
intelVISA wrote: post #69

Earlier quoted context omitted.

TPM interdiction is readily possible.

I web searched it and found a dedicated wikipedia page https://en.wikipedia.org/wiki/Interdiction but I still can't figure out what TPM interdiction is supposed to mean Anyway if a TPM was trivially bypassable then there would be no point to having them so I'm doubtful of whatever this off-hand comment is supposed to mean

Some early/naive attacks in this category would be serial bus interposition.

Re: Bitwarden PINs can be brute-forced

#140

Post by progbits »

asveikau wrote: post #126
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

They could make it take more time to derive a key from a pin. That would make it more difficult to brute force.

The pin space is just too small. What's the longest an user is willing to wait? 10 seconds?

Times 10k that is just 27 hours. Spend a couple of bucks on a few beefy EC2 instances and you crack that in an hour or two.

Post reply on HN