Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

181–190 of 284 posts

Re: Bitwarden PINs can be brute-forced

#181

Post by femto113 »

_8j50 wrote: post #111
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Ugh..no it does not work that way. You are thinking in hypotheticals like many developers do. Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc... If you have keepass2 with a memory argon2 and a pas…

There really needs to be another standard class of vulnerability besides "physical access to the device" along the lines of "access to a copy of the on disk data". There are so many paths to this and some never required physical access or even an accidental exposure on the part of the user, it could be a breach of a provider (ala LastPass).

Re: Bitwarden PINs can be brute-forced

#183

Post by capitainenemo »

jeroenhd wrote: post #180
capitainenemo wrote: post #175

Earlier quoted context omitted.

I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random k…

I think it could work, but I wouldn't want to protect my banking passwords and credit card details behind some random script. What I mean is eliminating passwords on most services at all. For everything but real important stuff (banks, email, business accounts, that kind of stuff), I reckon my devices are protected enough that if someone can gain access to my devices unlocked enough, 2FA wouldn't prevent any threads…

Yeah, I understand... but follow me here. If I'm using a 50 character randomly generated password on a website using my typical ({a..k} {m..z} {A..H} {J..N} {P..Z} {2..9}) token generation, then they are going to be brute forcing 6×10⁸⁷ combinations right? That's not happening. So. Randomly generated passwords for sites, managed by a password manager, are much like device bound keys, but with the added advantage that I can still type it into something that doesn't support the device if I really need to... I still like the idea of dongles especially to enhance the master password. I just don't see what it wins me over a random site password.

And, I'm absolutely going to have a password on my dongle or laptop in case of loss. I don't really trust biometrics in that scenario either really. Especially fingerprints that would be all over the laptop. Biometrics are just a convenience that I recognise offers some modicum of security. That's why hooking it up to TPM seems to not add much.

... I do get hardening where the passwords are stored though... although, if the disc is encrypted using TPM (which linux definitely supports), I guess the main attack you'd be concerned about would be the OS being compromised while running, but aren't we just back to loggers then?

Re: Bitwarden PINs can be brute-forced

#184

Post by [deleted] »

1attice wrote: post #159
lucb1e wrote: post #97

Earlier quoted context omitted.

> That's a downgrade attack for sure. "... is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. an encrypted connection) in favor of an older, lower-quality mode of operation (e.g. cleartext) that is typically provided for backward compatibility with older systems." from https://en.wikipedia.org/wiki/Downgrade_attack Guessing a…

Allowing people to choose an insecure means of securing their work just is a stochastic downgrade attack. Think it through.

[deleted]

Re: Bitwarden PINs can be brute-forced

#185

Post by dathinab »

throwaway742 wrote: post #166
dathinab wrote: post #25

A rule of thump: Nearly everything which is called PIN can be reasonably brute-forced as long as it doesn't get locked after a few attempts (and only unlocked through another factor e.g. a PUCK).

What is a PUCK?

PIN unlock Key (PUK)

if you mistyped the PIN to often the thing is locked until the PUK is entered, often followed by resetting the PIN to a new potentially different value.

most often know from SIM cards

Re: Bitwarden PINs can be brute-forced

#186

Post by d-z-m »

poisonborz wrote: post #58
d-z-m wrote: post #36

Earlier quoted context omitted.

Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.

It's the user's choice.

Currently it is, yes. In this case, I'm arguing that it should not be.

Re: Bitwarden PINs can be brute-forced

#187

Post by teekert »

nabakin wrote: post #141
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

> Of course the PIN can be brute forced. This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an eff…

I always wonder, with a keylogger on my device, I’m probably more f-ed using my master password all the time, right? Isn’t that a large threat? Larger than the one from op?

Re: Bitwarden PINs can be brute-forced

#188

Post by e12e »

Eisenstein wrote: post #170
e12e wrote: post #148

Earlier quoted context omitted.

With a secure enclave of some kind, there could conceivably be a three attempt limit before the temporary key associated with the pin is deleted, and full pass phrase is required. In such a setup pin might make sense. As it is - I'm not sure if pin makes sense even if there's user demand? Then again I do use biometric unlock - and that's not really great either. At least the bitwarden installs are behind fde (macOS)…

If the user setup the PIN and uses it every time the chances that they know the master password is about 50/50.

50/50 chance the pass phrase is secure against keylogger!

Re: Bitwarden PINs can be brute-forced

#189

Post by throwaway742 »

dathinab wrote: post #185
throwaway742 wrote: post #166

Earlier quoted context omitted.

What is a PUCK?

PIN unlock Key (PUK) if you mistyped the PIN to often the thing is locked until the PUK is entered, often followed by resetting the PIN to a new potentially different value. most often know from SIM cards

thank you

Re: Bitwarden PINs can be brute-forced

#190

Post by poisonborz »

d-z-m wrote: post #186
poisonborz wrote: post #58

Earlier quoted context omitted.

It's the user's choice.

Currently it is, yes. In this case, I'm arguing that it should not be.

That would go against the nature of such software. Let's treat users as adults. There should be warnings. But this is a feature. Users shouldn't be able to eg. select weak crypto algos, there is no additional functionality in that. But setting whatever pin is a convenience, and users should be able to decide what threat vectors they accept.
Post reply on HN