Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

141–150 of 284 posts

Re: Bitwarden PINs can be brute-forced

#141

Post by nabakin »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

> Of course the PIN can be brute forced.

This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an effective or useful argument.

Re: Bitwarden PINs can be brute-forced

#142

Post by sowbug »

8ytecoder wrote: post #101
SV_BubbleTime wrote: post #91

Earlier quoted context omitted.

They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…

And add other defensive mechanisms like lockout after n retries.

That's a bit like putting a website password check in the client-side JavaScript. Attacker removes lockout, continues brute-forcing.

There really isn't a solution if the entropy is low and the enforcement mechanisms are in the hands of the attacker. Even a TPM or secure element is just a financial obstacle to a sufficiently motivated attacker.

Re: Bitwarden PINs can be brute-forced

#143

Post by Veliladon »

waboremo wrote: post #61
jeroenhd wrote: post #39

Earlier quoted context omitted.

I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.

Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10…

You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.

Re: Bitwarden PINs can be brute-forced

#144

Post by nabakin »

Yes, pins can be bruteforced when they are stored locally, on device. That should be pretty obvious to those of us who know anything about security. However, the average user doesn't know about security. They shouldn't be expected to understand the nuance of security. So many people in this comments section are saying 'well obviously a pin can be cracked' but it's not obvious for the average user! Stop blaming the user here when Bitwarden should only offer features which are secure or at the very least provide a warning when a feature is unsecure.

Re: Bitwarden PINs can be brute-forced

#145

Post by Kwpolska »

macrolime wrote: post #120
Kwpolska wrote: post #33

Earlier quoted context omitted.

If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.

FDE does not protect against malware

I never said it does. If you’ve got malware, you should consider all your credentials fully compromised.

Re: Bitwarden PINs can be brute-forced

#146

Post by cryptonector »

sowbug wrote: post #142
8ytecoder wrote: post #101

Earlier quoted context omitted.

And add other defensive mechanisms like lockout after n retries.

That's a bit like putting a website password check in the client-side JavaScript. Attacker removes lockout, continues brute-forcing. There really isn't a solution if the entropy is low and the enforcement mechanisms are in the hands of the attacker. Even a TPM or secure element is just a financial obstacle to a sufficiently motivated attacker.

> Even a TPM or secure element is just a financial obstacle to a sufficiently motivated attacker.

For sure, but currently it's a fairly big step function for an attacker to have to teardown a TPM (or find a vulnerability in its firmware).

Re: Bitwarden PINs can be brute-forced

#147

Post by cryptonector »

generalizations wrote: post #84
NoZebra120vClip wrote: post #56

Earlier quoted context omitted.

In the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.

Does the TPM limit retries or something? If it's a 4-6 digit number, you can just count upwards and try them all in a trivial amount of time.

It can. TPMs have a "dictionary attack" (DA) protection feature.

You can't set the number of bad attempts that trip lockout, or how long to lock out for differently for different objects -- those are global configuration parameters. But you can configure which objects / policies require DA protection and which ones don't.

Re: Bitwarden PINs can be brute-forced

#148

Post by e12e »

FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

With a secure enclave of some kind, there could conceivably be a three attempt limit before the temporary key associated with the pin is deleted, and full pass phrase is required. In such a setup pin might make sense.

As it is - I'm not sure if pin makes sense even if there's user demand? Then again I do use biometric unlock - and that's not really great either.

At least the bitwarden installs are behind fde (macOS) - and possibly (?) file based encryption (Android 13+).

Re: Bitwarden PINs can be brute-forced

#149

Post by eviks »

FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

Why did you jump to a 4 digit PIN instead of a 10 letter word? (which is still faster than the full 20 letter master password with many special symbols)

Is it because of the name PIN? So there is your simple answer of what problem Bitwarden needs to fix

Re: Bitwarden PINs can be brute-forced

#150

Post by e12e »

monocasa wrote: post #108
bkettle wrote: post #94

Earlier quoted context omitted.

I think they are talking about the definition under the Espionage section, i.e. a hardware supply chain attack: > The term interdiction is also used by the NSA when an electronics shipment is secretly intercepted by an intelligence agency (domestic or foreign) for the purpose of implanting bugs before they reach their destination.

I read the original comment instead about sniffing the data path between the TPM and the user to get the PIN.

Which is just one way of circumventing the pin (keylogger will work on pass phrase too!). But that's not brute forcing the pin.
Post reply on HN