Bitwarden PINs can be brute-forced
ambiso.github.io
Bitwarden PINs can be brute-forced
1–10 of 284 posts
Re: Bitwarden PINs can be brute-forced
#2The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Re: Bitwarden PINs can be brute-forced
#3It's a tricky problem, because on devices without biometric authentication I really don't want to type in my long master password every time!
I think I'd appreciate an option such that:
1. If I'm online, I can unlock with a pin. Some critical piece of information would be kept server-side, and the server would limit unlock attempts.
2. If I'm offline and need access to my vault—which happens but not too often—I need to use my full master password.
I think this should be doable? Could you retain enough end-to-end encryption such that if Bitwarden itself is hacked, my vault couldn't be decrypted via only my pin?
Re: Bitwarden PINs can be brute-forced
#4the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
Re: Bitwarden PINs can be brute-forced
#5It's a tricky problem, because on devices without biometric authentication I really don't want to type in my long master password every time! I think I'd appreciate an option such that: 1. If I'm online, I can unlock with a pin. Some critical piece of information would be kept server-side, and the server would limit unlock attempts. 2. If I'm offline and need access to my vault—which happens but not too often—I need…
You don't actually need biometrics, you just need a TPM to handle your pin-to-password function with an attempt limit.
Re: Bitwarden PINs can be brute-forced
#6The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/
Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking.
I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices, where access to the underlying key store is near impossible so brute-forcing is much less of a risk. Biometrics are usually available there as well, but if you don't trust them with your most secure passwords (you probably shouldn't) or if you want a backup, a PIN would be an excellent defence mechanism for when you've left your phone unlocked and a stranger is trying to steal your passwords.
Re: Bitwarden PINs can be brute-forced
#7the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
KeePass plus Dropbox. Or Syncthing for really using only your devices.
Re: Bitwarden PINs can be brute-forced
#8the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
Codebook might be suitable. You can sync to Dropbox or google drive, or instead only sync between devices on the lan.
Re: Bitwarden PINs can be brute-forced
#9the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
It already exists: keepass and sync your DB on all your devices with syncthing (which is p2p).
Or host vaultwarden on your homeserver and access it only through wireguard/nebula self hosted VPN.
Re: Bitwarden PINs can be brute-forced
#10the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
Wouldn't it be enough to use something like Keepassxc and sync with whatever you use for syncing?