Bitwarden PINs can be brute-forced • Hacker News Board

Re: Bitwarden PINs can be brute-forced

#21

Post by SV_BubbleTime » Sun, Mar 19, 2023, 3:51 PM UTC

waselighis wrote: post #19

The problem is these password managers are lucrative targets, especially being able to gain access to a person's financial accounts. Simply disregarding the issue and categorizing it as "Attacks requiring physical access to a user's device" isn't good enough. Yes, there's only so much Bitwarden can do from the software side of things, without hardware support to back it up. But Bitwarden should still do what it can t…

BW is/has switched to Argon2 over PBKDF2, fwiw. Although Argon2 trades the iterations field for an allocated amount of memory, so time will tell if there isn’t a “BW accounts with 16MB of argon2 allocation are no longer considered secure”.

Re: Bitwarden PINs can be brute-forced

#22

Post by Wowfunhappy » Sun, Mar 19, 2023, 3:53 PM UTC

billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

I like self-hosting things, but for something as sensitive as my passwords I trust a professional company much more than I trust myself. Yes, companies can and do screw things up all the time, but that doesn't mean I would do better, and I'm a single person with other responsibilities in my life.

Re: Bitwarden PINs can be brute-forced

#23

Post by ris58h » Sun, Mar 19, 2023, 3:53 PM UTC

markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.

Re: Bitwarden PINs can be brute-forced

#24

Post by _cenw » Sun, Mar 19, 2023, 3:54 PM UTC

markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

Different threat model. If someone steals your laptop, your hardware is seized or your employer wants their backdoored machine (but not backdoored in this specific way) back, you probably do not want to leak your password manager contents either.

Re: Bitwarden PINs can be brute-forced

#25

Post by dathinab » Sun, Mar 19, 2023, 3:55 PM UTC

A rule of thump: Nearly everything which is called PIN can be reasonably brute-forced as long as it doesn't get locked after a few attempts (and only unlocked through another factor e.g. a PUCK).

Re: Bitwarden PINs can be brute-forced

#26

Post by LorenPechtel » Sun, Mar 19, 2023, 3:56 PM UTC

d-z-m wrote: post #20

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activit…

A PIN is a de-facto very weak password. Of course it can be brute forced!

Re: Bitwarden PINs can be brute-forced

#27

Post by fortran77 » Sun, Mar 19, 2023, 3:56 PM UTC

Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

I think that’s why the POC was on Linux.

Re: Bitwarden PINs can be brute-forced

#28

Post by microtonal » Sun, Mar 19, 2023, 3:57 PM UTC

billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

It doesn't have to be P2P, as long as the vault items are encrypted using device-specific secrets that are in a secure element (like iCloud Keychain). As long as there is no secure element in the loop, the security is limited. Secure elements can rate limit requests, require biometric authentication, etc. Without such limitations, you are only one upstream compromise away from exfiltrating all passwords.

Re: Bitwarden PINs can be brute-forced

#29

Post by cma » Sun, Mar 19, 2023, 3:57 PM UTC

Veliladon wrote: post #2

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

Weirdly chrome seems to prompt for windows hello pin to view passwords but not to auto fill them. Is it using the TPM to store them securely in any way?

Re: Bitwarden PINs can be brute-forced

#30

Post by Diggsey » Sun, Mar 19, 2023, 3:58 PM UTC

billconan wrote: post #4

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

I built my own that does this :) Just working on improving the UX now...

It has some cool features too, like not injecting anything into pages until you activate it (so no performance cost or risk of breaking sites) being less reliant on perfect detection of fields when it is activated, etc.