Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

111–120 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#111

Post by whoisthemachine »

thereddaikon wrote: post #106
newZWhoDis wrote: post #93

Earlier quoted context omitted.

Is this post sarcastic and I’m just missing it? 4 different locations to store program data, some of which are hidden, is freaking stupid design. Like, beyond moronic design. Everything, and I mean everything, about a program should be in a single folder structure and the OS should by-default lock that application to only accessing it’s own folder unless otherwise granted permission (in a centrally auditable/revocabl…

That makes managing a user's application specific data difficult though. For one you have different user's data intermingling which potentially causes new problems. But on top of that you make managing and backing up that data more difficult. As it works now with appdata you can back up a user's profile folder under C:\users and get everything they have assuming they haven't gone out of their way to save data to a st…

Ideally a new instance of the application is installed for each user. This also provides better isolation if one user upgrades/removes/breaks their application instance. I, for one, have really come around to the AppImage model [0] in the last couple of years.

[0] https://appimage.org/

Re: Bitwarden Heist – How to break into password vaults without using passwords

#112

Post by sjfjsjdjwvwvc »

bhdlr wrote: post #76
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

So - the moral of the story is to never use Windows?

Or don’t use their „security“ features. AFAICT everything would have been fine if they used a hardware key as second factor.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#113

Post by ben0x539 »

Zetobal wrote: post #21
elzbardico wrote: post #8

Earlier quoted context omitted.

The problem is that an unsophisticated user doesn't necessarily think like that, and could come to the conclusion that it is not a big deal to leave his workstation unlocked while going to fetch a coffee, after all, well... "I have a password manager, and to have access to it, it requires unlocking". Then some colleague calls them for an ongoing meeting so they can share some insight about some question that was rais…

If you have machines that have users logged in, are unlocked when none of your users are working on them and that are in reach of a 3rd party you have bigger problems than this.

Everybody thinks their machines aren't within reach of a 3rd party until they are!

Re: Bitwarden Heist – How to break into password vaults without using passwords

#114

Post by nytesky »

EvanAnderson wrote: post #81
bhdlr wrote: post #77

Earlier quoted context omitted.

Can't blame the programmer for that - Windows shouldn't allow the programmer to do stupid shit

The sheer volume of legacy software prevents this from being realistic. Microsoft's commitment to backwards compatibility has reaped rewards for them. Any restrictions would have a user-controllable toggle. If APIs prevent programmers from stupid shit the devs would encourage the end users to blame Windows and, more than likely, turn off the restrictions. (Case in point: User Account Control and making users non-Admi…

My Steam Microsoft Flight Sim requires admin rights, so clearly this is a lost battle. We just need to have containers for every app.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#115

Post by pi-e-sigma »

AlienRobot wrote: post #53
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

There's probably nothing that I hate in programming more than having full access to the file system. Any time I write a program that has to delete a file I just make it move into a trash folder instead just in case I mess up somewhere and accidentally delete the entire file system.

Obligatory: https://youtu.be/buoNv4v_UKE

Re: Bitwarden Heist – How to break into password vaults without using passwords

#116

Post by fragmede »

withinboredom wrote: post #92
mrguyorama wrote: post #65

Earlier quoted context omitted.

It's called iOS. Browsers are also NOT safe. You know what was safe? Not letting random endpoints ship you code to run. HTML was safe, though implementations at the time likely had security flaws. You cannot make a turing complete language that JIT compiles into machine code and verify it as "safe". Machine code is not safe, so anything that lets you generate arbitrary machine code cannot be proven to be safe. If you…

I still can't use a password manager to keep my apple account secure. You must memorize your password, and be able to type ... uh, I mean, draw, no, write? your password on a watch as well (if you get one of those). iOS is not exactly safe until I can use it without knowing my apple password.

I don't know my Apple password, it's in 1password. I don't use it on my watch though, I have a PIN there.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#117

Post by EvanAnderson »

pi-e-sigma wrote: post #110
EvanAnderson wrote: post #87

Earlier quoted context omitted.

A dev is going to include UI to manage the settings if non-technical users are expected to modify them. Whether those settings go in an INI or the registry doesn't matter at all for that UI. Having said, that level of technical skill req'd to edit an INI or the registry is about the same. Either way you're talking about a non-technical user descending thru a hierarchy of strange-to-them named containers to get to an…

How is the registry going to make that administration any easier? The registry is its own micro cosmos, doesn't matter if some setting is in an INI file somewhere on the filesystem or somewhere in the registry

Sysadmins have great tooling to deal with the registry (Group Policy, Local Group Policy for non-domain machines). The tooling for INI files isn't very good.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#118

Post by dingaling »

zelon88 wrote: post #49
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

Makes /bin/, /usr/bin/ and /opt/ seem simple

Re: Bitwarden Heist – How to break into password vaults without using passwords

#119

Post by eddythompson80 »

Dalewyn wrote: post #64
eddythompson80 wrote: post #15

Earlier quoted context omitted.

To this day I don’t understand how “computer repair” shops are in business. When I was a shithead 16 year old I used to work at one. I found it amusing to see what files people deleted before giving us full physical access to their machines. I definitely saw things I shouldn’t have seen. It wasn’t until I saw something illegal that I freaked out and stopped doing it. I was so paranoid that I srm’ed my entire drive an…

For most people (ie: not us), computers are just another household appliance in the same vein as televisions, washing machines, refrigerators, and air conditioners. If it breaks, you get it fixed by a technician or go and get a new replacement.

Yet they instinctively understand that they should delete certain files and prepare their computers for repair. We've had many who would walk in asking "hey, my computer is doing X is this fixable?" we would have no idea of course. We'd always ask can we see it, and they would say "I just don't wanna have to get it ready for repair if it wasn't possible"

This is why I totally understand when Apple or MS go overzealous with encryption or T2 or secure boot. Despite "people like us" complaining about it.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#120

Post by wongarsu »

nytesky wrote: post #114
EvanAnderson wrote: post #81

Earlier quoted context omitted.

The sheer volume of legacy software prevents this from being realistic. Microsoft's commitment to backwards compatibility has reaped rewards for them. Any restrictions would have a user-controllable toggle. If APIs prevent programmers from stupid shit the devs would encourage the end users to blame Windows and, more than likely, turn off the restrictions. (Case in point: User Account Control and making users non-Admi…

My Steam Microsoft Flight Sim requires admin rights, so clearly this is a lost battle. We just need to have containers for every app.

We may just get that. Microsoft's attempt to introduce sandboxing with UWP/msix was ignored by developers. Since then MS has added Windows Sandbox to Win 10 Pro and up, essentially disposable VMs for running sketchy software. I wouldn't be surprised if a couple versions down the line we get the option for more permament app-specific VMs, with integration into the window manager similar to QubesOS. A lot of groundwork for that already exists for WSL2, like more efficient memory use between VMs and shared GPU access.
Post reply on HN