Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

191–200 of 284 posts

Re: Bitwarden PINs can be brute-forced

#191

Post by twblalock »

beachy wrote: post #169
nabakin wrote: post #138

Earlier quoted context omitted.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

Some things fall into the "obvious" category, users should just know them, and it's not 100% on Bitwarden to make the world a safe place. Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that. Is it a good idea to use your name and date of birth as a password? No, and this should be obvious, not something Bitwarden needs to educate you…

> Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though.

Most people really don’t know that. It is not obvious to a normal user.

Re: Bitwarden PINs can be brute-forced

#192

Post by ar9av »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be a very common scenario.

That's why SSH keys or GPG keys are typically protected by a pass phrase. Not a PIN, not a password, a pass phrase. At least that's the wording that OpenSSH uses, and Bitwarden should do the same. Secure your database with a pass phrase, not a PIN, or else you might be vulnerable. That's how it should be communicated to the user. These details matter.

Re: Bitwarden PINs can be brute-forced

#193

Post by hedora »

The article and comments don’t really answer the most important question here: Most modern hardware supports access to secure key storage via biometrics or pins that lock after a few attempts.

Is the issue that bitwarden fails to use these properly (e.g., by storing a short pin in the touch id enclave), or that the person reporting the bug is using a machine without such an enclave, and enabled pins anyway?

Re: Bitwarden PINs can be brute-forced

#194

Post by mcronce »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

I agree with you. Short PINs are for preventing well-intentioned people from accidentally using the wrong account (which I do consider quite valuable, for the record) - not for keeping bad actors out.

Re: Bitwarden PINs can be brute-forced

#195

Post by yunwal »

Semaphor wrote: post #80
hn_throwaway_99 wrote: post #72

Earlier quoted context omitted.

Lots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 12…

I’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.

My guess is that most people who have high value passwords also have weak passwords. CEOs and CFOs can probably authorize huge financial transactions with little oversight and tend to be security illiterate.

Re: Bitwarden PINs can be brute-forced

#196

Post by ThatPlayer »

1attice wrote: post #159
lucb1e wrote: post #97

Earlier quoted context omitted.

> That's a downgrade attack for sure. "... is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. an encrypted connection) in favor of an older, lower-quality mode of operation (e.g. cleartext) that is typically provided for backward compatibility with older systems." from https://en.wikipedia.org/wiki/Downgrade_attack Guessing a…

Allowing people to choose an insecure means of securing their work just is a stochastic downgrade attack. Think it through.

Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack?

Re: Bitwarden PINs can be brute-forced

#197

Post by hedora »

nabakin wrote: post #144

Yes, pins can be bruteforced when they are stored locally, on device. That should be pretty obvious to those of us who know anything about security. However, the average user doesn't know about security. They shouldn't be expected to understand the nuance of security. So many people in this comments section are saying 'well obviously a pin can be cracked' but it's not obvious for the average user! Stop blaming the us…

Local pins can’t be brute-forced on the majority of my machines. The exception is a decade+ old intel desktop, and, even then, I think it has a wonky tpm slot (or I could buy a yubikey. They support locking pins after too many retries, right?)

Re: Bitwarden PINs can be brute-forced

#198

Post by ddulaney »

ar9av wrote: post #192
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be…

I really like the way 1Password and MacOS work together for security [0].

Even if my laptop is unlocked, each 1Password interaction needs my fingerprint. That unlocks a secret stored in the Secure Enclave, which I trust. (Security is hard and flaws are possible, but Apple has done a reasonably good job here from what I can tell.) I only have to mess around with typing a long string of nonsense in when I'm registering a new device, rather than every time I want to use my SSH or GPG key (or trusting an agent to hold it in memory, which... I'll do it, but I won't like it).

I wish I could rely on similar things from Linux, but the user experience just isn't there on the desktop. A previous employer issued laptops that had both a fingerprint reader and some kind of HSM, so the hardware was there, but I remember both of them missing drivers at the time, and even with drivers the userland software support would've been very hacky.

[0]: https://support.1password.com/touch-id-apple-watch-security-...

Re: Bitwarden PINs can be brute-forced

#199

Post by d1lanka »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Where’s my KeePassXC gang at.

Re: Bitwarden PINs can be brute-forced

#200

Post by KennyBlanken »

ddulaney wrote: post #198
ar9av wrote: post #192

Earlier quoted context omitted.

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be…

I really like the way 1Password and MacOS work together for security [0]. Even if my laptop is unlocked, each 1Password interaction needs my fingerprint. That unlocks a secret stored in the Secure Enclave, which I trust. (Security is hard and flaws are possible, but Apple has done a reasonably good job here from what I can tell.) I only have to mess around with typing a long string of nonsense in when I'm registering…

KeepassXC does the same thing. Once you enter your password, you can unlock with your fingerprint.
Post reply on HN