Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

201–210 of 284 posts

Re: Bitwarden PINs can be brute-forced

#201

Post by brewdad »

twblalock wrote: post #191
beachy wrote: post #169

Earlier quoted context omitted.

Some things fall into the "obvious" category, users should just know them, and it's not 100% on Bitwarden to make the world a safe place. Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that. Is it a good idea to use your name and date of birth as a password? No, and this should be obvious, not something Bitwarden needs to educate you…

> Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though. Most people really don’t know that. It is not obvious to a normal user.

I realize math education in the US sucks but are really suggesting most people can’t figure out that 0 to 9999 is all the possibilities you get from 4 digits?

Re: Bitwarden PINs can be brute-forced

#202

Post by xxkylexx »

nabakin wrote: post #144

Yes, pins can be bruteforced when they are stored locally, on device. That should be pretty obvious to those of us who know anything about security. However, the average user doesn't know about security. They shouldn't be expected to understand the nuance of security. So many people in this comments section are saying 'well obviously a pin can be cracked' but it's not obvious for the average user! Stop blaming the us…

The Bitwarden docs warn users about the exact risk this article talks about. https://bitwarden.com/help/unlock-with-pin/

Re: Bitwarden PINs can be brute-forced

#203

Post by xxkylexx »

Criticisms from this article:

>Bitwarden does not warn about this risk…… Bitwarden takes little effort in communicating the risks of choosing a short low-entropy PIN. Currently there is very little information to be found about the PIN in Bitwarden documentation

Bitwarden's help docs on using PINs: https://bitwarden.com/help/unlock-with-pin/.

>Warning: Using a PIN can weaken the level of encryption that protects your application's local vault database. If you are worried about attack vectors that involve your device's local data being compromised, you may want to reconsider the convenience of using a PIN.

Re: Bitwarden PINs can be brute-forced

#204

Post by 1letterunixname »

nabakin wrote: post #141
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

> Of course the PIN can be brute forced. This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an eff…

The remediation is human and pw/pin policy: make sure users pick a good pin and that they're not using it anywhere else.

Re: Bitwarden PINs can be brute-forced

#206

Post by 1letterunixname »

jeron wrote: post #48
LorenPechtel wrote: post #26

Earlier quoted context omitted.

A PIN is a de-facto very weak password. Of course it can be brute forced!

If you limit number of attempts, can it still be brute forced?

Unless blocking brutes by IP, this creates a DoS to legitimate users.

Re: Bitwarden PINs can be brute-forced

#207

Post by 1letterunixname »

ericpauley wrote: post #59
KMnO4 wrote: post #52

Earlier quoted context omitted.

How can you enforce a limit when the decryption is done client side?

Using a TPM: https://en.wikipedia.org/wiki/Trusted_Platform_Module

Needs SecureEnclave, Android, and browser support to be comprehensive.

Re: Bitwarden PINs can be brute-forced

#208

Post by eptcyka »

1letterunixname wrote: post #204
nabakin wrote: post #141

Earlier quoted context omitted.

> Of course the PIN can be brute forced. This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an eff…

The remediation is human and pw/pin policy: make sure users pick a good pin and that they're not using it anywhere else.

When it comes to 4 or 6 digit pins, its almost impossible to ensure that no pin has been used before. At 8 digits, you might as well be using diceware anyway.

Re: Bitwarden PINs can be brute-forced

#210

Post by 1letterunixname »

markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

Yup unless encrypted and password locked. Never leave a machine unlocked.

There are/were some highly-sophisticated attacks using peripheral bus exploits (firewire, thunderbolt, etc.), but that's a very unlikely threat to most people.

Post reply on HN