Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

161–170 of 284 posts

Re: Bitwarden PINs can be brute-forced

#161

Post by jeroenhd »

waboremo wrote: post #61
jeroenhd wrote: post #39

Earlier quoted context omitted.

I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.

Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10…

My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way.

However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.

Re: Bitwarden PINs can be brute-forced

#162

Post by andrewxdiamond »

nabakin wrote: post #141
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

> Of course the PIN can be brute forced. This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an eff…

The user does not need to be aware of the threat model.

OPs point was the pin isn’t protecting much at all because it doesn’t really need to. The user isn’t making a risky decision, because if the attacker gets as far as _being able to put the pin in_, the whole thing is toast regardless of guessing the pin or not

Re: Bitwarden PINs can be brute-forced

#163

Post by cryptonector »

SparkyMcUnicorn wrote: post #51
chiefalchemist wrote: post #11

The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).

I think TPM and secure enclave provide the convenience without compromising security?

They provide the security without compromising convenience (but you do need backup options).

Re: Bitwarden PINs can be brute-forced

#164

Post by jeroenhd »

kayson wrote: post #82
jeroenhd wrote: post #6

Earlier quoted context omitted.

Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking…

Bummer that its not usable on the browser extension though. I used to have the desktop app but it ended up being mostly useless. 99% of my passwords go into the browser where I want autofill, and for the rest I almost always have a browser open anyways so I can just as easily copy/paste from the extension as the app.

You can use biometrics in the browser app, but you have to run the application and unlock that with biometrics after enabling browser integration in the settings. You also can't use the Windows Store version of the Bitwarden app.

https://bitwarden.com/help/biometrics/

Re: Bitwarden PINs can be brute-forced

#165

Post by quickthrower2 »

This is logical right?

1. You can access the passwords if you know the PIN.

2. All state is local.

All you need to do is guess the PIN and restore state, and repeat. Any code in Bitwarden to prevent (obscure) you from doing this is just a cat and mouse game.

Perhaps a way around this is to not have all state local. Have the PIN + separate authenticating private key go to their server. You get 3 attempts before you need the full password.

Re: Bitwarden PINs can be brute-forced

#167

Post by [deleted] »

lyu07282 wrote: post #134
asveikau wrote: post #126

Earlier quoted context omitted.

They could make it take more time to derive a key from a pin. That would make it more difficult to brute force.

They do that already: > This brute-force will very likely be successful, since PINs are usually very low-entropy. Now, granted, the key derivation function is PBKDF2 with 100000 iterations (+ HKDF), but that won't help with a 4 digit pin. It would be better to not have that feature at all, that convenience feature goes a bit too far. But nice to see that's the only thing they found, I'm sure they looked for more seve…

[deleted]

Re: Bitwarden PINs can be brute-forced

#169

Post by beachy »

nabakin wrote: post #138
FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

Some things fall into the "obvious" category, users should just know them, and it's not 100% on Bitwarden to make the world a safe place.

Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that.

Is it a good idea to use your name and date of birth as a password? No, and this should be obvious, not something Bitwarden needs to educate you about.

Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though.

Are there people out there who do need this education? Of course. But that's a job for someone with infinite patience and understanding. Not some words on a web page from a supplier.

Case in point, my step dad belonged to a "computers for elders" group and one day he learned about antivirus software. Next time I watched him, he was googling for anti virus software and downloading any he could find, from anywhere on the internet. He ended up with 6 different AV packages, some very dubious looking indeed. I tried to explain the dangers but he couldn't understand how antivirus could actually harm his computer. And he was a practicing doctor of medicine before retirement. It really highlighted the challenges of protecting some people in the brave new digital world.

Re: Bitwarden PINs can be brute-forced

#170

Post by Eisenstein »

e12e wrote: post #148
FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

With a secure enclave of some kind, there could conceivably be a three attempt limit before the temporary key associated with the pin is deleted, and full pass phrase is required. In such a setup pin might make sense. As it is - I'm not sure if pin makes sense even if there's user demand? Then again I do use biometric unlock - and that's not really great either. At least the bitwarden installs are behind fde (macOS)…

If the user setup the PIN and uses it every time the chances that they know the master password is about 50/50.
Post reply on HN