Bitwarden Heist – How to break into password vaults without using passwords • Hacker News Board

Re: Bitwarden Heist – How to break into password vaults without using passwords

#121

Post by spacephysics » Wed, Jan 03, 2024, 9:07 PM UTC

zelon88 wrote: post #49

walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

I agree in a perfect world, but I believe the OS should have a design that “forces” the programmer to maintain the correct abstraction.

Or at least have the override for such abstractions be blatant and explicit if the programmer wants to circumvent them.

And of course, given the age of Windows OS/ecosystem, it’s a pipe dream to have a redesign that isn’t backwards compatible

Re: Bitwarden Heist – How to break into password vaults without using passwords

#122

Post by zelon88 » Wed, Jan 03, 2024, 9:16 PM UTC

spacephysics wrote: post #121

zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

I agree in a perfect world, but I believe the OS should have a design that “forces” the programmer to maintain the correct abstraction. Or at least have the override for such abstractions be blatant and explicit if the programmer wants to circumvent them. And of course, given the age of Windows OS/ecosystem, it’s a pipe dream to have a redesign that isn’t backwards compatible

How do you tell the program what belongs where? How does the OS know that the application is reading a file full of configuration entries that should be in the registry? What is the difference between reading a file full of data and reading a file containing your own configuration?

How does the OS know that the file you're writing to belongs in AppData or not?

To create the system calls for this you would break everything about windows file permissions. Currently, you interact as a user account. In order to accomplish the real time heuristics you're proposing you would also need an application user account in addition to the users user account.

At what point does the responsibility for knowing how to code fall on the programmer? How much capability are you willing to take away from effective programmers, to artificially protect the ineffective ones from themselves?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#123

Post by johnny22 » Wed, Jan 03, 2024, 9:27 PM UTC

Aerroon wrote: post #99

zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

But why split up the application like that? Why not have a folder for each application that just contains everything? Everything being in one place by default also means that a user can just copy the entire application folder as a backup.

Because it'd be really nice to have a place with just application data to backup. no configs, no application state. Or alternatively it's nice to have a place to just factory reset all your app config, but keep all the data.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#124

Post by withinboredom » Wed, Jan 03, 2024, 9:33 PM UTC

fragmede wrote: post #116

withinboredom wrote: post #92

Earlier quoted context omitted.

I still can't use a password manager to keep my apple account secure. You must memorize your password, and be able to type ... uh, I mean, draw, no, write? your password on a watch as well (if you get one of those). iOS is not exactly safe until I can use it without knowing my apple password.

I don't know my Apple password, it's in 1password. I don't use it on my watch though, I have a PIN there.

My watch somehow became unpaired from my phone and needs my password. I just ignore the prompt because all attempts to enter the password fail for one reason or another. Even moving my wrist too much or taking too long clears the prompt.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#125

Post by jabroni_salad » Wed, Jan 03, 2024, 9:41 PM UTC

zelon88 wrote: post #49

walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

You forgot about "my documents", which is of course a great catch-all location for all four types of data you mentioned.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#126

Post by Aerbil313 » Wed, Jan 03, 2024, 9:51 PM UTC

Tangential, what is the state of security on Linux desktop nowadays? Say out-of-the-box Debian 12 using Wayland. Is it still just that nobody is attacking Linux so it's safe?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#127

Post by jtriangle » Wed, Jan 03, 2024, 9:57 PM UTC

zelon88 wrote: post #49

walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

>an .ini file should not be a thing in Windows

Hard, hard disagree there. Having config files available is vastly preferable to using the unmitigated shitshow that is the windows registry. That and a config file at least gives users a prayer at being able to provide some sort of troubleshooting information, and provides savvy users with a way to actually solve problems on their own.

>half ass ports it to windows

Redmond, themselves, do all sorts of seemingly 'wrong' things with their directory structure, which tells me the 'free for all' nature of it is intentional, and not wrong at all. It is a terrible structure, it does cause problems, but, that's the conditions you work under while using windows. It's mostly OK in practice, but as bitwarden found out, there are conditions that developers have to account for if you require security and safety.

And factually, your presumed solution of "put things in the right place" is doubly broken, because if one acquires the correct privileges, there is no location on a windows machine where cleartext data is safe. The solution is not "store it in the correct location" the solution is to encrypt sensitive data at rest, regardless of location, which is more or less what bitwarden did. That's the correct strategy, and it's operating system agnostic.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#128

Post by rdl » Wed, Jan 03, 2024, 10:15 PM UTC

The complexity of deployed identification/auth chain/secrets management/ec. is pretty terrifying; even if you can somehow understand it for one OS and hardware platform, if your service needs to support multiple OSes plus web plus multiple auth technologies plus a recovery path and everything else, dragons.

This is one of the few things cryptocurrency gets right in one specific way better than most other applications -- in most cases, everything is explicitly about operations with a key, and you build up protections on both sides of that. Unfortunately those protections themselves are often inadequate (hence billions of dollars in losses), but it's at least conceptually simpler and potentially could be fixed.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#129

Post by dzhiurgis » Wed, Jan 03, 2024, 10:27 PM UTC

tamimio wrote: post #63

WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

You can use password vaults without creating a single point of failure by enabling 2FA for the accounts in the vault, without storing the keys there. Of course, it would still be bad if the vault was compromised, but it would be unlikely that anyone could access those accounts without accessing your 2FA.

Is there is a good solution/mitigation to sharing passwords with 2FA's in vault?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#130

Post by calamari4065 » Wed, Jan 03, 2024, 10:34 PM UTC

jtriangle wrote: post #127

zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

>an .ini file should not be a thing in Windows Hard, hard disagree there. Having config files available is vastly preferable to using the unmitigated shitshow that is the windows registry. That and a config file at least gives users a prayer at being able to provide some sort of troubleshooting information, and provides savvy users with a way to actually solve problems on their own. >half ass ports it to windows Redm…

Agreed. The windows registry needs to be killed with fire.

There's no appreciable difference between the registry and a directory of config files except that instead of an INI parser you have to use the much, much worse WIN32 API.

Editing config files is fairly safe and user-intuitive. Sure you can break something by writing the wrong config file, but you do not risk breaking everything. But clumsy use of regedit does have a chance of totally borking the entire system.

And then you have maniacs who store user data in the registry. I know of at least one game which stores save files in the registry.

I get the intention of the registry, but it's just not fit for purpose. Maybe it was better back in the 90s, but it's just a hellscape now.