Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

111–120 of 284 posts

Re: Bitwarden PINs can be brute-forced

#111

Post by _8j50 »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Ugh..no it does not work that way.

You are thinking in hypotheticals like many developers do.

Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc...

If you have keepass2 with a memory argon2 and a password/passphrase none of that is a concern.

Yes, the malware could also be a keylogger/RAT and you'd be screwed then. One the most important security mindsets to have is "perfection is the enemy of good", specific security controls exist to address specific threats/risk not to address arbitrary and and an unbounded number of possible threats.

Re: Bitwarden PINs can be brute-forced

#112

Post by lucb1e »

CMCDragonkai wrote: post #66
billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

We've been building a p2p password vault called Polykey. https://GitHub.com/MatrixAI/Polykey .

> No server is currently available to service your request.

Found the SPOF! But also, "AI"? And "we've been building" doesn't sound like it's production-ready yet. I don't know, lots of red flags here to me.

Re: Bitwarden PINs can be brute-forced

#113

Post by mmis1000 »

8ytecoder wrote: post #101
SV_BubbleTime wrote: post #91

Earlier quoted context omitted.

They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…

And add other defensive mechanisms like lockout after n retries.

Unless you are using a hardware based pin. Lockout is useless. I can just backup the file before lockout and restore

Or… I can just stop the software, change computer time. And the timeout is over.

Re: Bitwarden PINs can be brute-forced

#115

Post by forty »

_8j50 wrote: post #111
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

Ugh..no it does not work that way. You are thinking in hypotheticals like many developers do. Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc... If you have keepass2 with a memory argon2 and a pas…

I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext.

Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.

Re: Bitwarden PINs can be brute-forced

#117

Post by sohtym »

NoZebra120vClip wrote: post #56
LorenPechtel wrote: post #26

Earlier quoted context omitted.

A PIN is a de-facto very weak password. Of course it can be brute forced!

In the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.

> So forget what you know about ATM PINs; this is a markedly different concept.

I mean it's actually the same concept (something you have, something you know) with a different implementation.

Re: Bitwarden PINs can be brute-forced

#119

Post by macrolime »

bkettle wrote: post #94
lucb1e wrote: post #81

Earlier quoted context omitted.

I web searched it and found a dedicated wikipedia page https://en.wikipedia.org/wiki/Interdiction but I still can't figure out what TPM interdiction is supposed to mean Anyway if a TPM was trivially bypassable then there would be no point to having them so I'm doubtful of whatever this off-hand comment is supposed to mean

I think they are talking about the definition under the Espionage section, i.e. a hardware supply chain attack: > The term interdiction is also used by the NSA when an electronics shipment is secretly intercepted by an intelligence agency (domestic or foreign) for the purpose of implanting bugs before they reach their destination.

There was a comment on another hacker news thread the other day that a difference between secure element and TPM is that the pin code is entered on the keyboard and passes through memory while with secure enclave, at least the biometric stuff is connected directly to the secure enclave instead. Maybe that's what

Re: Bitwarden PINs can be brute-forced

#120

Post by macrolime »

Kwpolska wrote: post #33
d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.

FDE does not protect against malware
Post reply on HN