Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden PINs can be brute-forced

ambiso.github.io

Post reply on HN
Print view View original

241–250 of 284 posts

Re: Bitwarden PINs can be brute-forced

#241

Post by Thorrez »

beachy wrote: post #169
nabakin wrote: post #138

Earlier quoted context omitted.

You're assuming the average user understands security when that is definitely not the case. The job of Bitwarden is to help all users (even ones ignorant of security) to secure their data. If Bitwarden has no warning explaining that pins are unsecure, then the fault 100% lies with Bitwarden.

Some things fall into the "obvious" category, users should just know them, and it's not 100% on Bitwarden to make the world a safe place. Is it a good idea to leave your password on a piece of paper under your keyboard? No, and you shouldn't need Bitwarden to tell you that. Is it a good idea to use your name and date of birth as a password? No, and this should be obvious, not something Bitwarden needs to educate you…

>Is it safe to rely on a 4 digit PIN? Obviously not, when there are only 10000 possible combinations. You shouldn't need Bitwarden to tell you that though.

Normal users see that Bitwarden blocks you after 5 guesses, therefore an attacker will never get past all 10000 guesses. They won't realize that this block is easily evadable.

Re: Bitwarden PINs can be brute-forced

#243

Post by giancarlostoro »

_cenw wrote: post #24
markstos wrote: post #14

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

Different threat model. If someone steals your laptop, your hardware is seized or your employer wants their backdoored machine (but not backdoored in this specific way) back, you probably do not want to leak your password manager contents either.

I use the practice of creating a new employee specific password manager account instead. Once I have an employee email address, I use that to register on either Mozilla's password manager, or BitWarden. It works out nicely, isolates everything, and should I ever leave and someone needs an account I once had, I can safely pass along an old password with ease.

Re: Bitwarden PINs can be brute-forced

#244

Post by Operative0198 »

stockhorn wrote: post #179
Operative0198 wrote: post #171

Glad I transitioned my passwords from Bitwarden to an offline password manager that doesn't have a similar "easy PIN password mode" feature. I used to use Bitwarden with this feature though, just that I recently came to the conclusion that the product probably isn't the most secure offering and it has some issues on Android with native autofill when you aren't using Google Services.

What issues are you talking about on android? Using e/os/ here with native autofill and yes this seems to have some issues :/ (mainly keyboard not auto-closing I think)

Maybe I was a bit too harsh on Bitwarden for a moment there, it's chiefly an issue with chromium. https://github.com/bromite/bromite/issues/547

Re: Bitwarden PINs can be brute-forced

#245

Post by eviks »

Aeolun wrote: post #220
eviks wrote: post #149

Earlier quoted context omitted.

Why did you jump to a 4 digit PIN instead of a 10 letter word? (which is still faster than the full 20 letter master password with many special symbols) Is it because of the name PIN? So there is your simple answer of what problem Bitwarden needs to fix

Why would you think the master password has many special symbols and 20 characters? You can just have the 4 digit pin as your master password.

Your mirroring fails precisely because it's a password, and it's pretty common to set minimum requirements, so you can't have 4 digit pin

Similarly with your first point - I don't think the master password has many special symbols, I'm just asking a question that illustrates the issue with the original faulty assumption

Re: Bitwarden PINs can be brute-forced

#246

Post by eptcyka »

TylerE wrote: post #214
eptcyka wrote: post #208

Earlier quoted context omitted.

When it comes to 4 or 6 digit pins, its almost impossible to ensure that no pin has been used before. At 8 digits, you might as well be using diceware anyway.

At least by not allowing 4 you get rid of the two most common lazy date formats (and YYYY)

Does it matter if you can bruteforce a 4 digit pin in a day, if there's no TPM guarding it?

Re: Bitwarden PINs can be brute-forced

#247

Post by rstuart4133 »

hedora wrote: post #193

The article and comments don’t really answer the most important question here: Most modern hardware supports access to secure key storage via biometrics or pins that lock after a few attempts. Is the issue that bitwarden fails to use these properly (e.g., by storing a short pin in the touch id enclave), or that the person reporting the bug is using a machine without such an enclave, and enabled pins anyway?

> Is the issue that bitwarden fails to use these properly

It's not so easy. Bitwarden runs in a browser on PC's. As far as I know, browsers don't provide a javascript API to the TPM. They probably supply a javascript API to their password store which may even be backed by a TPM (Firefox on Windows is I think), but they also allow you to browse their passwords while the browser is running so I wouldn't be keen on that.

Bitwarden also runs on Android. I haven't seen an Android TPM API. Instead Android supplies a "Keystore". It stores secrets that can be unlocked using phone managed secrets - like a PIN, fingerprint and so on. Yes, they have limited retries - but they come with the limitation that if you can unlock the phone, you can unlock Bitwarden. Not ideal - in fact pretty much the same situation as a browser, now I think about it.

So I suspect that while it's true "most modern hardware supports secure storage", the issue is Bitwarden doesn't run directly on the hardware. Instead it runs on platforms like Anroid or a browser that don't expose the hardware's secure storage directly.

Re: Bitwarden PINs can be brute-forced

#248

Post by jdmichal »

senectus1 wrote: post #212
forty wrote: post #105

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…

It would not be a terrible idea for the pin to "expire" if tried more than "x" times unsuccessfully in a row, defaulting back to the master password.

The Bitwarden client does this. The issue is that nothing prevents the attacker from taking the encrypted database and working with it directly, thereby bypassing that client protection.

Re: Bitwarden PINs can be brute-forced

#249

Post by jve »

munchbunny wrote: post #234
teekert wrote: post #187

Earlier quoted context omitted.

I always wonder, with a keylogger on my device, I’m probably more f-ed using my master password all the time, right? Isn’t that a large threat? Larger than the one from op?

Yes, with a keylogger watching you you’re typically pretty f-ed. Though that’s also one of the reasons using a physical FIDO token as a second factor is a good idea, since the keylogger isn’t going to be able to steal your private key off the hardware token, unlike for TOTP. Though that also begs the question, if I can get a keylogger onto your device, why wouldn’t I try to implant something slightly more capable?

> since the keylogger isn’t going to be able to steal your private key off the hardware token, unlike for TOTP

How? I mean how can keylogger get the secret from which TOTPs are being generated?

And why wouldn't some other malware won't be able to read whatever data hardware token inputs? I'm myself yubikey user and would like to know in what ways it is more secure than TOTP, even in the scenario when my workstation gets compromised.

I assumed if someone can install something on my computer, I'm toast.

Re: Bitwarden PINs can be brute-forced

#250

Post by ambiso »

thrashh wrote: post #233
ar9av wrote: post #192

Earlier quoted context omitted.

Bitwarden argues that the finding is out of scope because from what I can gather the claim that exploiting this requires access to the device. If that were the case, I'd agree with them. But having access to the Bitwarden database is not the same as having access to the device. There are plenty of vulnerabilities that give you limited read access. Simply selling your hard drive without erasing the data first would be…

Your database IS protected with a pass phrase When you enable the PIN, you deliberately weaken your security for convenience. However, when the database unloads, your database is still protected by your pass phrase.

> However, when the database unloads, your database is still protected by your pass phrase.

This is not the case if you disable the "lock with master password on restart" option. In that case only your PIN is guarding access the the vault data.

Using a PIN shouldn't have to mean weakening the security, since there's several secure implementation options of a PIN. (See other comments about Windows Hello for example)

Post reply on HN