Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

211–220 of 284 posts

Re: Bitwarden PINs can be brute-forced

#211

Post by twblalock »

brewdad wrote: post #201
twblalock wrote: post #191

Earlier quoted context omitted.

> Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though. Most people really don’t know that. It is not obvious to a normal user.

I realize math education in the US sucks but are really suggesting most people can’t figure out that 0 to 9999 is all the possibilities you get from 4 digits?

Yes, most people cannot figure that out, but also it would not occur to most people to consider that when opting for a PIN over a password.

Re: Bitwarden PINs can be brute-forced

#212

Post by senectus1 »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

It would not be a terrible idea for the pin to "expire" if tried more than "x" times unsuccessfully in a row, defaulting back to the master password.

Re: Bitwarden PINs can be brute-forced

#214

Post by TylerE »

eptcyka wrote: post #208
1letterunixname wrote: post #204

Earlier quoted context omitted.

The remediation is human and pw/pin policy: make sure users pick a good pin and that they're not using it anywhere else.

When it comes to 4 or 6 digit pins, its almost impossible to ensure that no pin has been used before. At 8 digits, you might as well be using diceware anyway.

At least by not allowing 4 you get rid of the two most common lazy date formats (and YYYY)

Re: Bitwarden PINs can be brute-forced

#215

Post by pnt12 »

donutshop wrote: post #213

Cars come with seatbelts, one can put them on, or put them on improperly. Not to say that the seatbelts are perfect, but the carmakers have done what they can to provide that safety net.

Not sure if the best analogy... At least in my country you can get a fine if you don't wear a seat belt in a car. So it's not really up to you.

Re: Bitwarden PINs can be brute-forced

#216

Post by 1attice »

ThatPlayer wrote: post #196
1attice wrote: post #159

Earlier quoted context omitted.

Allowing people to choose an insecure means of securing their work just is a stochastic downgrade attack. Think it through.

Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack?

I have no opinion other than it is obviously a downgrade attack.

As a fair to middling organic language model, I cannot tell you how to keep your keys safe; I myself am blessed with a good memory and 160wpm typing speed so I use that.

Re: Bitwarden PINs can be brute-forced

#217

Post by donutshop »

pnt12 wrote: post #215
donutshop wrote: post #213

Cars come with seatbelts, one can put them on, or put them on improperly. Not to say that the seatbelts are perfect, but the carmakers have done what they can to provide that safety net.

Not sure if the best analogy... At least in my country you can get a fine if you don't wear a seat belt in a car. So it's not really up to you.

But you can still choose to not wear it. Am in a country where seatbelts are required by law, but many ignore it because of convenience, bad habits..etc. It's a law, but one that can't be enforced realistically.

Re: Bitwarden PINs can be brute-forced

#218

Post by monocasa »

cryptonector wrote: post #156
monocasa wrote: post #108

Earlier quoted context omitted.

I read the original comment instead about sniffing the data path between the TPM and the user to get the PIN.

You can encrypt sessions to the TPM. To do that you need to securely know a public key for the TPM. The protocol spoken to a TPM is like a micro-TLS. You get to encrypt, or not. You get to authenticate the TPM (like a server), or not. You get to do ephemeral-static key exchange (unlike TLS 1.3, which wants ephemeral-ephemeral key exchange). And you get to do PSK (password), and you get to do it in ways that are not s…

You can generally sniff the LPC bus to the TPM. Even with TPM2.0+ that allows optional encryption on the transport layer, Windows dosn't bother using it.

https://pulsesecurity.co.nz/articles/TPM-sniffing

But I was referring more to a malicious software component between the data flow between the user interface and the TPM, even before the TPM's protocol stack is in the loop.

Re: Bitwarden PINs can be brute-forced

#219

Post by andrewaylett »

ddulaney wrote: post #198
ar9av wrote: post #192

Earlier quoted context omitted.

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be…

I really like the way 1Password and MacOS work together for security [0]. Even if my laptop is unlocked, each 1Password interaction needs my fingerprint. That unlocks a secret stored in the Secure Enclave, which I trust. (Security is hard and flaws are possible, but Apple has done a reasonably good job here from what I can tell.) I only have to mess around with typing a long string of nonsense in when I'm registering…

Bitwarden's fingerprint integration does exactly the same.

Re: Bitwarden PINs can be brute-forced

#220

Post by Aeolun »

eviks wrote: post #149
FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

Why did you jump to a 4 digit PIN instead of a 10 letter word? (which is still faster than the full 20 letter master password with many special symbols) Is it because of the name PIN? So there is your simple answer of what problem Bitwarden needs to fix

Why would you think the master password has many special symbols and 20 characters? You can just have the 4 digit pin as your master password.
Post reply on HN