Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

231–240 of 284 posts

Re: Bitwarden PINs can be brute-forced

#231

Post by chrismorgan »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

> Of course the PIN can be brute forced.

There’s no “of course” about it. Every place I can think of having used a PIN in the last decade has not been susceptible to brute-force attacks, due to the PIN being stored off-site (e.g. payment card) or in a TPM (e.g. Windows Hello), and a few incorrect attempts triggering blocking of the payment card or PIN or whatever.

If you think carefully about the description of this specific feature, and where and how it’s running, then yes, you’ll probably realise that the PIN will be brute-forceable. But people are probably used to the idea that PINs actually aren’t susceptible to this kind of attack.

Re: Bitwarden PINs can be brute-forced

#232

Post by fomine3 »

brewdad wrote: post #201
twblalock wrote: post #191

Earlier quoted context omitted.

> Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though. Most people really don’t know that. It is not obvious to a normal user.

I realize math education in the US sucks but are really suggesting most people can’t figure out that 0 to 9999 is all the possibilities you get from 4 digits?

Average user: Bank card requires 4 digits PIN, so it must be safe

Re: Bitwarden PINs can be brute-forced

#233

Post by thrashh »

ar9av wrote: post #192
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be…

Your database IS protected with a pass phrase

When you enable the PIN, you deliberately weaken your security for convenience. However, when the database unloads, your database is still protected by your pass phrase.

Re: Bitwarden PINs can be brute-forced

#234

Post by munchbunny »

teekert wrote: post #187
nabakin wrote: post #141

Earlier quoted context omitted.

> Of course the PIN can be brute forced. This is obvious to those that know anything about security, but it is not obvious to the average user. It is Bitwarden's job to keep the user safe within their platform and if they provide a pin option, the average user knows no better than to use it. If Bitwarden does not explain how insecure pins are, then the fault 100% lies with them. Blaming the user is rarely ever an eff…

I always wonder, with a keylogger on my device, I’m probably more f-ed using my master password all the time, right? Isn’t that a large threat? Larger than the one from op?

Yes, with a keylogger watching you you’re typically pretty f-ed. Though that’s also one of the reasons using a physical FIDO token as a second factor is a good idea, since the keylogger isn’t going to be able to steal your private key off the hardware token, unlike for TOTP.

Though that also begs the question, if I can get a keylogger onto your device, why wouldn’t I try to implant something slightly more capable?

Re: Bitwarden PINs can be brute-forced

#235

Post by [deleted] »

8ytecoder wrote: post #101
SV_BubbleTime wrote: post #91

Earlier quoted context omitted.

They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…

And add other defensive mechanisms like lockout after n retries.

[deleted]

Re: Bitwarden PINs can be brute-forced

#236

Post by hartator »

> If accessing device-local data is outside of the threat model, why are we encrypting these data at all? We might as well store them in plain text.

Yes, exactly. I feel a lot of these tools are doing this. And it’s okay if it explicits that the data is plain text. However why annoying users with a PIN in the first place?

I am sorry bitwarden didn’t fake this seriously.

Let me know if you are looking for a job. We have several positions open. Feel free to shoot me an email julien -at—serpapi.com

Re: Bitwarden PINs can be brute-forced

#237

Post by benatkin »

gengkev wrote: post #128
0xdeafbeef wrote: post #104

Earlier quoted context omitted.

You can use pbdkf2 with 200k iterations or argon2 to derive key from pin

Suppose it takes 2 seconds of 100% cpu usage to compute the password hash (you probably wouldn't want to wait much longer). Then brute forcing a 4 digit PIN will take 20000 seconds ≈ 6 hours maximum. There's no way around that, no matter what hash function you use.

In that case make it take a week to unlock your password store, then it will take 200 years to unlock it!

Re: Bitwarden PINs can be brute-forced

#238

Post by benatkin »

cryptonector wrote: post #160
Wowfunhappy wrote: post #15

Earlier quoted context omitted.

Okay, but my laptop doesn't have that either.

How old is your laptop?

Wowfunhappy's laptop has a keyboard which can be used to enter a long enough password.

Pity that the only reasonable option is rejected.

Re: Bitwarden PINs can be brute-forced

#239

Post by halayli »

nabakin wrote: post #138
FfejL wrote: post #89

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

It's a bit of a stretch to label Bitwarden users as average user. Average users don't know about password managers beyond whatever their browser supports.

Re: Bitwarden PINs can be brute-forced

#240

Post by userbinator »

beachy wrote: post #169
nabakin wrote: post #138

Earlier quoted context omitted.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

Some things fall into the "obvious" category, users should just know them, and it's not 100% on Bitwarden to make the world a safe place. Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that. Is it a good idea to use your name and date of birth as a password? No, and this should be obvious, not something Bitwarden needs to educate you…

Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that.

Yes it is, if your threat model excludes physical access; and in that case, it's probably more secure than anything software can do.

Post reply on HN