Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

121–130 of 284 posts

Re: Bitwarden PINs can be brute-forced

#121

Post by _8j50 »

forty wrote: post #115
_8j50 wrote: post #111

Earlier quoted context omitted.

Ugh..no it does not work that way. You are thinking in hypotheticals like many developers do. Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc... If you have keepass2 with a memory argon2 and a pas…

I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext. Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.

If it is not the default behavior then I agree with you.

Re: Bitwarden PINs can be brute-forced

#122

Post by lucb1e »

tete wrote: post #10
billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

Wouldn't it be enough to use something like Keepassxc and sync with whatever you use for syncing?

It would, so long as you're aware that the password has to be strong.

Let's quantify that. The default KDF that keepassx uses is iirc ~50ms seconds of computation on modern hardware. It might dynamically determine the KDF rounds based on your system, but it never updates it (hmm, is that a vuln as well?) so it'll be old either way. A GPU gets a ~thousand-fold speed-up compared to CPU for pbkdf2, so let's say 20k guesses per second per GPU (note: this is just a ballpark number). An attacker might have a dozen GPUs available and care to spend a month on your vault (does that sound like a fair upper bound? Tweak it for your personal threat model), which means they run through some log(20e3 guesses_per_second × 12 gpus × (3600×24×31) seconds)/log(2) ≃ 40 bits of entropy.

If you pick random words from a diceware-sized dictionary (7776 words), you need 4 random words to be secure (because log(7776⁴)/log(2)>40). If you pick random characters from a-z,A-Z,0-9, you need a 7-character randomly generated password (because log(62⁷)/log(2)>40).

Edit: it looks like KeepassX has stopped development and says to use KeepassXC now. Their source code has some mentions of Argon2id so this may be outdated advice! Your password/-phrase may be able to be shorter than this, but it'll be hard to quantify because all Argon2 crackers suck ("For Argon2, the fastest cracking software that I can find is a CPU implementation." I wrote two years ago in https://security.stackexchange.com/a/249384/10863).

Re: Bitwarden PINs can be brute-forced

#123

Post by pmontra »

nebulous1 wrote: post #106
SV_BubbleTime wrote: post #91

Earlier quoted context omitted.

They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…

It already is intentionally "slow". However, for a 4 digit pin there are only 10 thousand combinations. It is not practical for it to be so slow that 10000x it is an infeasible amount of time. Not only would the user have to way too long on each entry, the attacker could just use faster hardware.

Or multiple machines. There are about 31k seconds in a year. 3.1 seconds per iteration seems already slow as a response time to unlock a db so it's about one year for those 10000 attempts. Split it between 10 machines by first digit, it's down to a little more than one month. Split it between 100 machines by the first two digits and it's down to half a week.

A four digit PIN is poor security. What Bitwarden could do is removing that feature.

Re: Bitwarden PINs can be brute-forced

#124

Post by warkdarrior »

pmontra wrote: post #123
nebulous1 wrote: post #106

Earlier quoted context omitted.

It already is intentionally "slow". However, for a 4 digit pin there are only 10 thousand combinations. It is not practical for it to be so slow that 10000x it is an infeasible amount of time. Not only would the user have to way too long on each entry, the attacker could just use faster hardware.

Or multiple machines. There are about 31k seconds in a year. 3.1 seconds per iteration seems already slow as a response time to unlock a db so it's about one year for those 10000 attempts. Split it between 10 machines by first digit, it's down to a little more than one month. Split it between 100 machines by the first two digits and it's down to half a week. A four digit PIN is poor security. What Bitwarden could do…

Uhm, 31k seconds is about 8.7 hours.

Re: Bitwarden PINs can be brute-forced

#125

Post by nabakin »

d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

Exactly. So many people in this comments section are saying 'well obviously a pin can be cracked' but the point is, the average user does not know this. Once they give their information to Bitwarden, they expect it to be safe. They shouldn't have to understand the nuances of security in order to keep their data safe. If the pin can be cracked, Bitwarden should not offer it as an option or at least explain to users how vulnerable they will be before they enable it.

Re: Bitwarden PINs can be brute-forced

#126

Post by asveikau »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

They could make it take more time to derive a key from a pin. That would make it more difficult to brute force.

Re: Bitwarden PINs can be brute-forced

#127

Post by shiftingleft »

subeadia wrote: post #114

"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png

It looks like this is a popup for a different setting. Did you watch the video outlined in the post?

The author is arguing that such a popup should also exist when locking a vault with a PIN only.

Re: Bitwarden PINs can be brute-forced

#128

Post by gengkev »

0xdeafbeef wrote: post #104
morpheuskafka wrote: post #100

Earlier quoted context omitted.

If the PIN is local, only a secure element type of chip could meaningfully enforce this restriction. Otherwise, whatever memory or disk stores the secret encrypted only by the 4-digit PIN could still be brute forced. Just disabling entering a PIN in the UI would not be enough for security.

You can use pbdkf2 with 200k iterations or argon2 to derive key from pin

Suppose it takes 2 seconds of 100% cpu usage to compute the password hash (you probably wouldn't want to wait much longer).

Then brute forcing a 4 digit PIN will take 20000 seconds ≈ 6 hours maximum. There's no way around that, no matter what hash function you use.

Re: Bitwarden PINs can be brute-forced

#129

Post by aidenn0 »

_8j50 wrote: post #121
forty wrote: post #115

Earlier quoted context omitted.

I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext. Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.

If it is not the default behavior then I agree with you.

I've been using bitwarden for years and didn't know this feature existed, so it at least wasn't the default in the past.

Re: Bitwarden PINs can be brute-forced

#130

Post by [deleted] »

forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

[deleted]
Post reply on HN