15 ms·

Bitwarden PINs can be brute-forced

441 points by aborsy 4y ago

Veliladon 4y ago
The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.
- jeroenhd 4y ago
  Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking. I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices, where access to the underlying key store is near impossible so brute-forcing is much less of a risk. Biometrics are usually available there as well, but if you don't trust them with your most secure passwords (you probably shouldn't) or if you want a backup, a PIN would be an excellent defence mechanism for when you've left your phone unlocked and a stranger is trying to steal your passwords.
  - Wowfunhappy 4y ago
    > I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices. Note that on desktop Bitwarden allows PINs to be alphanumeric, and any length. I use a PIN because my master password is more than 20 characters and I don't want to type it every time I restart my browser. My PIN is a decently strong password in its own right, but shorter than my actual master password.
  - Veliladon 4y ago
    >Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.
    - _cenw 4y ago
      Intel only added PTT - their soft TPM - with Coffee Lake.
    - jeroenhd 4y ago
      I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.
      - waboremo 4y ago
        Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
        Veliladon 4y ago
        You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
        jeroenhd 4y ago
        My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.
  - capitainenemo 4y ago
    I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.
    - jeroenhd 4y ago
      Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.
      - capitainenemo 4y ago
        I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
  - kayson 4y ago
    Bummer that its not usable on the browser extension though. I used to have the desktop app but it ended up being mostly useless. 99% of my passwords go into the browser where I want autofill, and for the rest I almost always have a browser open anyways so I can just as easily copy/paste from the extension as the app.
    - jeroenhd 4y ago
      You can use biometrics in the browser app, but you have to run the application and unlock that with biometrics after enabling browser integration in the settings. You also can't use the Windows Store version of the Bitwarden app. https://bitwarden.com/help/biometrics/ https://bitwarden.com/help/biometrics/
      - kayson 4y ago
        Clunky, but hey I'll take it. Thanks!
- fortran77 4y ago
  I think that’s why the POC was on Linux.
- cma 4y ago
  Weirdly chrome seems to prompt for windows hello pin to view passwords but not to auto fill them. Is it using the TPM to store them securely in any way?
- waselighis 4y ago
  Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's servers. Every. Single. Time. There's no way to use another device either. I recall, back in the day, you could activate Windows XP without internet by calling a number which would give you a long code to type in and would activate Windows. But nothing like that exists for Windows Hello. No internet? Tough luck. In the end, I had to reinstall Windows and I'm never touching Windows Hello again.
  - vel0city 4y ago
    I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.
    - GordonS 4y ago
      I've never had the problem the GP had, but I have had Windows Hello "forget" biometrics were even configured - it's happened at least 3 times now, I guess after a Windows Update. Each time I go to login with a fingerprint, but it gives an error message and insists on the password instead, and then I have to setup Windows Hello from scratch. It's mind-boggling how shit Windows Hello is :-/
  - Dalewyn 4y ago
    Security enthusiasts will scream bloody murder, but fact of the matter is nothing beats a simple password for balancing security and practicality.
  - SparkyMcUnicorn 4y ago
    I remember some of the piracy tools activated windows by generating these phone codes.
  - 4y ago
- willis936 4y ago
  KeepassXC does this on Windows (and is free). Strongbox uses secure enclave for master password storage on iOS.
Wowfunhappy 4y ago
It's a tricky problem, because on devices without biometric authentication I really don't want to type in my long master password every time! I think I'd appreciate an option such that: 1. If I'm online, I can unlock with a pin. Some critical piece of information would be kept server-side, and the server would limit unlock attempts. 2. If I'm offline and need access to my vault—which happens but not too often—I need to use my full master password. I think this should be doable? Could you retain enough end-to-end encryption such that if Bitwarden itself is hacked, my vault couldn't be decrypted via only my pin?
- _cenw 4y ago
  You don't actually need biometrics, you just need a TPM to handle your pin-to-password function with an attempt limit.
  - Wowfunhappy 4y ago
    Okay, but my laptop doesn't have that either.
    - cryptonector 4y ago
      How old is your laptop?
      - benatkin 4y ago
        Wowfunhappy's laptop has a keyboard which can be used to enter a long enough password. Pity that the only reasonable option is rejected.
      - Wowfunhappy 4y ago
        Coming up on a decade old now, actually.
    - noname120 4y ago
      Buy a U2F USB key.
billconan 4y ago
the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.
- krab 4y ago
  KeePass plus Dropbox. Or Syncthing for really using only your devices.
- neandrake 4y ago
  Codebook might be suitable. You can sync to Dropbox or google drive, or instead only sync between devices on the lan. https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/
- IceWreck 4y ago
  It already exists: keepass and sync your DB on all your devices with syncthing (which is p2p). Or host vaultwarden on your homeserver and access it only through wireguard/nebula self hosted VPN.
  - Macha 4y ago
    Note the KeePass's resistance to the attack mentioned depends on the security of .NET's secure string, which, here's what Microsoft has to say about it (https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...) As for KeePassXC, last I checked it didn't even bother.
- tete 4y ago
  Wouldn't it be enough to use something like Keepassxc and sync with whatever you use for syncing?
  - lucb1e 4y ago
    It would, so long as you're aware that the password has to be strong. Let's quantify that. The default KDF that keepassx uses is iirc ~50ms seconds of computation on modern hardware. It might dynamically determine the KDF rounds based on your system, but it never updates it (hmm, is that a vuln as well?) so it'll be old either way. A GPU gets a ~thousand-fold speed-up compared to CPU for pbkdf2, so let's say 20k guesses per second per GPU (note: this is just a ballpark number). An attacker might have a dozen GPUs available and care to spend a month on your vault (does that sound like a fair upper bound? Tweak it for your personal threat model), which means they run through some log(20e3 guesses_per_second × 12 gpus × (3600×24×31) seconds)/log(2) ≃ 40 bits of entropy. If you pick random words from a diceware-sized dictionary (7776 words), you need 4 random words to be secure (because log(7776⁴)/log(2)>40). If you pick random characters from a-z,A-Z,0-9, you need a 7-character randomly generated password (because log(62⁷)/log(2)>40). Edit: it looks like KeepassX has stopped development and says to use KeepassXC now. Their source code has some mentions of Argon2id so this may be outdated advice! Your password/-phrase may be able to be shorter than this, but it'll be hard to quantify because all Argon2 crackers suck ("For Argon2, the fastest cracking software that I can find is a CPU implementation." I wrote two years ago in https://security.stackexchange.com/a/249384/10863 https://security.stackexchange.com/a/249384/10863).
chiefalchemist 4y ago
The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).
- juve1996 4y ago
  Most people have been told that even though you're centralizing passwords (meaning if hacked you're in big trouble), the benefits gained from being able to generate strong passwords overcome this. Is this no longer true, for most people?
  - Dalewyn 4y ago
    I can count on one hand the number of services that are important/crucial enough to warrant unique, strong passwords. All the rest I just reuse simple passwords because they simply aren't important and aren't worth the time to care. Someone wants my Discord? Go for it, I don't care. My Reddit goes with it? Sure, I don't care. My HN account too? Daring today, aren't we. So no, personally I haven't felt a need nor desire for a password manager. Arguably it will cause me more grief than convenience.
  - chiefalchemist 4y ago
    The idea is...centralize your PWs but "harden" them behind a single longer and less brute-forceable master pw. And since the PW manager is doing the fill in, those can be longer and more random as well. Perfect? No. 100x better than what most people do? Yes!!! Moi? For the important stuff? I add in a YubiKey. Perfect? Again, no. But closer than no YK at all. As a side note: I do contract web dev work for various agencies. Generally, talk about a lazy approach to clients' PWs. They think 1PW makes things secure. Meanwhile I generally have access to all vaults, even projects I'm not working on. Good sec is bases on less trust, not too much blind trust.
  - lucb1e 4y ago
    I would say this is definitely true for the common Joe, but of course it helps to not run much arbitrary software from the web and keep your browser up-to-date to avoid drive-by malware. If you've got a habit of pirating games, you may want to keep your princess in another castle. My mom doesn't have any reason to download and run untrusted software ever, and she'd call me if she needs something, so for her it's definitely better to have secure passwords with the risk of having all eggs in one basket. The risk of her being tricked into running software that steals the vault is lower than the guessable and reused passwords that she used before. If you are more like me and regularly download software to try it out, pull random github repos to toy with them, etc., then it might be wise to keep the password database on an Android/iOS device which have app isolation. You can download all the malware you want, but if you don't grant it root, it won't be able to access the database stored in /data/data/com.example.keepass/database/.
markstos 4y ago
It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.
- ris58h 4y ago
  Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.
  - prophesi 4y ago
    To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your application's local vault database. > If you are worried about attack vectors that involve your device's local data being compromised, > you may want to reconsider the convenience of using a PIN. https://bitwarden.com/help/unlock-with-pin/#enable-unlock-with-pin https://bitwarden.com/help/unlock-with-pin/#enable-unlock-wi...
    - yazzku 4y ago
      Then why encrypt it in the first place? That's the point the author makes (text in bold).
      - prophesi 4y ago
        It's a choice on the user to weaken the encryption. I don't use Bitwarden, but if they communicate that properly to the user, it's a valid compromise for convenience-versus-security.
        yazzku 4y ago
        This doesn't answer the question. Why is there a choice to encrypt something when it's completely unnecessary (according to their threat model)? No point in building unnecessary complexity into software, especially software meant for security.
neilv 4y ago
> However this 5 guesses limit is enforced completely within the client's logic: it relies on the attacker using the official Bitwarden client. I'd guess a software engineer working on that part of a security system would probably consider that, while the implementation approach for that part was being decided. If so, why did it happen anyway? Did they communicate the weakness to users?
waselighis 4y ago
The problem is these password managers are lucrative targets, especially being able to gain access to a person's financial accounts. Simply disregarding the issue and categorizing it as "Attacks requiring physical access to a user's device" isn't good enough. Yes, there's only so much Bitwarden can do from the software side of things, without hardware support to back it up. But Bitwarden should still do what it can to mitigate such attacks, such as significantly increasing the number of PBKDF2 iterations for PINs (at least stored on disk; a key could be cached in RAM with fewer iterations because RAM is far less likely to be compromised than files on disk), and discouraging (or even preventing) users from using short PINs that could be quickly brute forced.
- SV_BubbleTime 4y ago
  BW is/has switched to Argon2 over PBKDF2, fwiw. Although Argon2 trades the iterations field for an allocated amount of memory, so time will tell if there isn’t a “BW accounts with 16MB of argon2 allocation are no longer considered secure”.
d-z-m 4y ago
The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activity by an attacker is occurring. However, users probably have the reasonable expectation that if their laptop is stolen, their device-local vault data(supposedly encrypted on disk) is not compromised as a result. Bitwarden should either disallow weak pins/pin-access altogether, or they should caveat more clearly the weaknesses of pin-only access to device-local vault data. [0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- LorenPechtel 4y ago
  A PIN is a de-facto very weak password. Of course it can be brute forced!
  - d-z-m 4y ago
    Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.
    - poisonborz 4y ago
      It's the user's choice.
      - mynameisvlad 4y ago
        I mean, sure, but if the user isn’t appropriately informed of the risks (such as this attack) how would you expect them to make a good choice?
      - d-z-m 4y ago
dathinab 4y ago
A rule of thump: Nearly everything which is called PIN can be reasonably brute-forced as long as it doesn't get locked after a few attempts (and only unlocked through another factor e.g. a PUCK).
- throwaway742 4y ago
  What is a PUCK?
  - dathinab 4y ago
    PIN unlock Key (PUK) if you mistyped the PIN to often the thing is locked until the PUK is entered, often followed by resetting the PIN to a new potentially different value. most often know from SIM cards
    - throwaway742 4y ago
      thank you
Waterluvian 4y ago
On the spectrum of security, I think a PIN is closer to a privacy lock than a security lock.
ddtaylor 4y ago
> Now, granted, the key derivation function is PBKDF2 with 100000 iterations FWIW on a GPU using SHA1 or SHA256 this is not very much time-protection.
- sneak 4y ago
  Someone should tell them! https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52
upofadown 4y ago
>If accessing device-local data is outside of the threat model, why are we encrypting these data at all? We might as well store them in plain text. The PIN is still potentially useful in that it prevents anyone with access to the device from getting access to the secret information without having to perform an overt act. The difference between leaving a piece of paper with the passwords laying about and locking it in a drawer.
gowings97 4y ago
Suddenly getting Error Code 7 (unusual network detected - https://bitwarden.com/help/unusual-traffic-error/ https://bitwarden.com/help/unusual-traffic-error/) when attempting to login. Googling and looking on Twitter - people have been complaining about this happening to them as well. - https://www.reddit.com/r/Bitwarden/comments/110gpkt/traffic_from_your_network_looks_unusual_connect/ https://www.reddit.com/r/Bitwarden/comments/110gpkt/traffic_... -https://www.reddit.com/r/Bitwarden/comments/11vplwv/network_error_on_web_login/ https://www.reddit.com/r/Bitwarden/comments/11vplwv/network_... - https://twitter.com/lazminutes/status/1624946344564781056 https://twitter.com/lazminutes/status/1624946344564781056 Locking me out of 2FA because of you don't like my network traffic? Yeah, I will be immediately leaving your service, bye. That's Google like bro, lol. Clown stuff. Insane that they would even think of doing this.
1attice 4y ago
Well, there goes my trust in another old friend. That's a downgrade attack for sure.
- lucb1e 4y ago
  > That's a downgrade attack for sure. "... is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. an encrypted connection) in favor of an older, lower-quality mode of operation (e.g. cleartext) that is typically provided for backward compatibility with older systems." from https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack Guessing a 4-digit number with unlimited attempts available is not a downgrade attack but a brute-force attack https://en.wikipedia.org/wiki/Brute-force_attack https://en.wikipedia.org/wiki/Brute-force_attack
  - 1attice 4y ago
    Allowing people to choose an insecure means of securing their work just is a stochastic downgrade attack. Think it through.
    - ThatPlayer 4y ago
      Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack?
      - 1attice 4y ago
        I have no opinion other than it is obviously a downgrade attack. As a fair to middling organic language model, I cannot tell you how to keep your keys safe; I myself am blessed with a good memory and 160wpm typing speed so I use that.
        ThatPlayer 4y ago
        As you say yourself, that is a blessing, and not everyone has it. Only allowing those with such blessings to use Bitwarden doesn't help anyone.
qainsights 4y ago
I disabled it for purpose :)
FfejL 4y ago
"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.
- SV_BubbleTime 4y ago
  They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…
  - morpheuskafka 4y ago
    If the PIN is local, only a secure element type of chip could meaningfully enforce this restriction. Otherwise, whatever memory or disk stores the secret encrypted only by the 4-digit PIN could still be brute forced. Just disabling entering a PIN in the UI would not be enough for security.
    - 0xdeafbeef 4y ago
      You can use pbdkf2 with 200k iterations or argon2 to derive key from pin
      - barsonme 4y ago
        This has very limited benefit for weak passcodes, like PINs.
      - gengkev 4y ago
        Suppose it takes 2 seconds of 100% cpu usage to compute the password hash (you probably wouldn't want to wait much longer). Then brute forcing a 4 digit PIN will take 20000 seconds ≈ 6 hours maximum. There's no way around that, no matter what hash function you use.
forty 4y ago
Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hopeless (as someone mentioned, they probably can install some key logger and steal the master password and everything else later). It never hurts to be clear on the threat model (And they should probably go with the option 1. suggested by the author), but I feel in that case the behavior matches reasonable expectations and the author is a bit of bad faith. For solution 2. if you want to check a pin server side without trivial access to the PIN from the server you can do it à la signal using secure enclaves https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
- _8j50 4y ago
  Ugh..no it does not work that way. You are thinking in hypotheticals like many developers do. Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc... If you have keepass2 with a memory argon2 and a password/passphrase none of that is a concern. Yes, the malware could also be a keylogger/RAT and you'd be screwed then. One the most important security mindsets to have is "perfection is the enemy of good", specific security controls exist to address specific threats/risk not to address arbitrary and and an unbounded number of possible threats.
  - forty 4y ago
    I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext. Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.
    - 4y ago
subeadia 4y ago
"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png https://i.imgur.com/BzXJmos.png
- shiftingleft 4y ago
  It looks like this is a popup for a different setting. Did you watch the video outlined in the post? The author is arguing that such a popup should also exist when locking a vault with a PIN only.
- IshKebab 4y ago
  That's about as unclear as I could imagine. "If you use this option please ensure you take the appropriate precautions."
  - Wowfunhappy 4y ago
    That's not what it says though. How would you phrase it? I don't think they do a great job but this is pretty hard to explain in two sentences if you're targeting a non-technical person.
    - IshKebab 4y ago
      "If you use this option then your passwords will not be stored securely. Any program or person that can read your files can also read your passwords."
- Wowfunhappy 4y ago
  I'm pretty sure that comes up only if you disable vault timeout entirely, not if you enable a timeout but allow unlock with PIN.
iLoveOncall 4y ago
This posts reads like "Hey guess what, if you store your passwords in a file called passwords.txt on your desktop and install a virus, people can steal your passwords.". Water is wet.
bobleeswagger 4y ago
Convenience is the enemy of good security.
nabakin 4y ago
Yes, pins can be bruteforced when they are stored locally, on device. That should be pretty obvious to those of us who know anything about security. However, the average user doesn't know about security. They shouldn't be expected to understand the nuance of security. So many people in this comments section are saying 'well obviously a pin can be cracked' but it's not obvious for the average user! Stop blaming the user here when Bitwarden should only offer features which are secure or at the very least provide a warning when a feature is unsecure.
- hedora 4y ago
  Local pins can’t be brute-forced on the majority of my machines. The exception is a decade+ old intel desktop, and, even then, I think it has a wonky tpm slot (or I could buy a yubikey. They support locking pins after too many retries, right?)
- xxkylexx 4y ago
  The Bitwarden docs warn users about the exact risk this article talks about. https://bitwarden.com/help/unlock-with-pin/ https://bitwarden.com/help/unlock-with-pin/
eviks 4y ago
The name is part of the problem You can have shorter alphanumeric password per device for frequent unlocks, it doesn't have to be your typical 4 number PIN that jumps to mind It would not offer the same protection as your main much longer password, but then that longer password protects against a bigger threat than local access, and it's still much more convenient (and not much less inconvenient vs the 4 digit PIN, like on a full computer keyboard typing a longer word is faster than shifting your fingers to the top numbers row) And it would be nice if password managers explains the much much bigger risk of these very short numbers-only poorly named PINs so that users can make an informed decision
quickthrower2 4y ago
This is logical right? 1. You can access the passwords if you know the PIN. 2. All state is local. All you need to do is guess the PIN and restore state, and repeat. Any code in Bitwarden to prevent (obscure) you from doing this is just a cat and mouse game. Perhaps a way around this is to not have all state local. Have the PIN + separate authenticating private key go to their server. You get 3 attempts before you need the full password.
RyeCombinator 4y ago
Everything can be brutce-forced https://xkcd.com/538/ https://xkcd.com/538/
Operative0198 4y ago
Glad I transitioned my passwords from Bitwarden to an offline password manager that doesn't have a similar "easy PIN password mode" feature. I used to use Bitwarden with this feature though, just that I recently came to the conclusion that the product probably isn't the most secure offering and it has some issues on Android with native autofill when you aren't using Google Services.
- stockhorn 4y ago
  What issues are you talking about on android? Using e/os/ here with native autofill and yes this seems to have some issues :/ (mainly keyboard not auto-closing I think)
  - Operative0198 4y ago
    Maybe I was a bit too harsh on Bitwarden for a moment there, it's chiefly an issue with chromium. https://github.com/bromite/bromite/issues/547 https://github.com/bromite/bromite/issues/547
t-writescode 4y ago
The attacks went from LastPass and over to BitWarden. After the attacks and smear campaigns, shall the people unwilling to use KeyPass and other high-lift/high-risk pieces of software move on to using tiered password strategies for their hundreds of sites again?
- LelouBil 4y ago
  It's not really an attack. Pin is obviously less secure (however this could be mitigated by using a TPM as other commenters said) but it's not the default. Their help page on pin even warns about the security risk, they should have the warning in the application. I'll still use bitwarden (without pin).
surfsvammel 4y ago
If I am not using a PIN code, need I be worried?
- LelouBil 4y ago
  No
hedora 4y ago
The article and comments don’t really answer the most important question here: Most modern hardware supports access to secure key storage via biometrics or pins that lock after a few attempts. Is the issue that bitwarden fails to use these properly (e.g., by storing a short pin in the touch id enclave), or that the person reporting the bug is using a machine without such an enclave, and enabled pins anyway?
- rstuart4133 4y ago
  > Is the issue that bitwarden fails to use these properly It's not so easy. Bitwarden runs in a browser on PC's. As far as I know, browsers don't provide a javascript API to the TPM. They probably supply a javascript API to their password store which may even be backed by a TPM (Firefox on Windows is I think), but they also allow you to browse their passwords while the browser is running so I wouldn't be keen on that. Bitwarden also runs on Android. I haven't seen an Android TPM API. Instead Android supplies a "Keystore". It stores secrets that can be unlocked using phone managed secrets - like a PIN, fingerprint and so on. Yes, they have limited retries - but they come with the limitation that if you can unlock the phone, you can unlock Bitwarden. Not ideal - in fact pretty much the same situation as a browser, now I think about it. So I suspect that while it's true "most modern hardware supports secure storage", the issue is Bitwarden doesn't run directly on the hardware. Instead it runs on platforms like Anroid or a browser that don't expose the hardware's secure storage directly.
  - olabyne 4y ago
    Bitwarden has now a native app on PC. I still use the browser extension but I might switch to the native app, as I reckon from other comments they do support OS security APIs
xxkylexx 4y ago
Criticisms from this article: >Bitwarden does not warn about this risk…… Bitwarden takes little effort in communicating the risks of choosing a short low-entropy PIN. Currently there is very little information to be found about the PIN in Bitwarden documentation Bitwarden's help docs on using PINs: https://bitwarden.com/help/unlock-with-pin/ https://bitwarden.com/help/unlock-with-pin/. >Warning: Using a PIN can weaken the level of encryption that protects your application's local vault database. If you are worried about attack vectors that involve your device's local data being compromised, you may want to reconsider the convenience of using a PIN.
- LelouBil 4y ago
  They just need to put that notice in the software, when you try to enable a pin.
1letterunixname 4y ago
Much ado about the obvious. I don't use BW's PIN. Using a loong passphrase. If others want convenience with 12345, it's all them.
donutshop 4y ago
Cars come with seatbelts, one can put them on, or put them on improperly. Not to say that the seatbelts are perfect, but the carmakers have done what they can to provide that safety net.
- pnt12 4y ago
  Not sure if the best analogy... At least in my country you can get a fine if you don't wear a seat belt in a car. So it's not really up to you.
  - donutshop 4y ago
    But you can still choose to not wear it. Am in a country where seatbelts are required by law, but many ignore it because of convenience, bad habits..etc. It's a law, but one that can't be enforced realistically.
hartator 4y ago
> If accessing device-local data is outside of the threat model, why are we encrypting these data at all? We might as well store them in plain text. Yes, exactly. I feel a lot of these tools are doing this. And it’s okay if it explicits that the data is plain text. However why annoying users with a PIN in the first place? I am sorry bitwarden didn’t fake this seriously. Let me know if you are looking for a job. We have several positions open. Feel free to shoot me an email julien -at—serpapi.com
webprofusion 4y ago
If your machine has something running on it that's brute forcing your PIN, what's to stop it already having something doing keylogging and clipboard monitoring? Aren't you already hopelessly compromised?
ziml77 4y ago
I see many comments in here saying it's obvious that a PIN can be brute forced. But it is absolutely NOT obvious that's the case because for a long time now we've had hardware like TPM and Secure Enclave. With that hardware, you can have the database's key securely stored with the PIN being what lets the hardware release that key. And even if the attacker has physical access to the device, it can be protected from brute force by having the hardware forget the key after a number of failed attempts.

441 points by aborsy 4y ago

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

jeroenhd 4y ago
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking. I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices, where access to the underlying key store is near impossible so brute-forcing is much less of a risk. Biometrics are usually available there as well, but if you don't trust them with your most secure passwords (you probably shouldn't) or if you want a backup, a PIN would be an excellent defence mechanism for when you've left your phone unlocked and a stranger is trying to steal your passwords.
- Wowfunhappy 4y ago
  > I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices. Note that on desktop Bitwarden allows PINs to be alphanumeric, and any length. I use a PIN because my master password is more than 20 characters and I don't want to type it every time I restart my browser. My PIN is a decently strong password in its own right, but shorter than my actual master password.
- Veliladon 4y ago
  >Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.
  - _cenw 4y ago
    Intel only added PTT - their soft TPM - with Coffee Lake.
  - jeroenhd 4y ago
    I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.
    - waboremo 4y ago
      Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
      - Veliladon 4y ago
        You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
      - jeroenhd 4y ago
        My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.
- capitainenemo 4y ago
  I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.
  - jeroenhd 4y ago
    Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.
    - capitainenemo 4y ago
      I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
- kayson 4y ago
  Bummer that its not usable on the browser extension though. I used to have the desktop app but it ended up being mostly useless. 99% of my passwords go into the browser where I want autofill, and for the rest I almost always have a browser open anyways so I can just as easily copy/paste from the extension as the app.
  - jeroenhd 4y ago
    You can use biometrics in the browser app, but you have to run the application and unlock that with biometrics after enabling browser integration in the settings. You also can't use the Windows Store version of the Bitwarden app. https://bitwarden.com/help/biometrics/ https://bitwarden.com/help/biometrics/
    - kayson 4y ago
      Clunky, but hey I'll take it. Thanks!
fortran77 4y ago
I think that’s why the POC was on Linux.
cma 4y ago
Weirdly chrome seems to prompt for windows hello pin to view passwords but not to auto fill them. Is it using the TPM to store them securely in any way?
waselighis 4y ago
Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's servers. Every. Single. Time. There's no way to use another device either. I recall, back in the day, you could activate Windows XP without internet by calling a number which would give you a long code to type in and would activate Windows. But nothing like that exists for Windows Hello. No internet? Tough luck. In the end, I had to reinstall Windows and I'm never touching Windows Hello again.
- vel0city 4y ago
  I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.
  - GordonS 4y ago
    I've never had the problem the GP had, but I have had Windows Hello "forget" biometrics were even configured - it's happened at least 3 times now, I guess after a Windows Update. Each time I go to login with a fingerprint, but it gives an error message and insists on the password instead, and then I have to setup Windows Hello from scratch. It's mind-boggling how shit Windows Hello is :-/
- Dalewyn 4y ago
  Security enthusiasts will scream bloody murder, but fact of the matter is nothing beats a simple password for balancing security and practicality.
- SparkyMcUnicorn 4y ago
  I remember some of the piracy tools activated windows by generating these phone codes.
- 4y ago
willis936 4y ago
KeepassXC does this on Windows (and is free). Strongbox uses secure enclave for master password storage on iOS.

Wowfunhappy 4y ago

It's a tricky problem, because on devices without biometric authentication I really don't want to type in my long master password every time! I think I'd appreciate an option such that: 1. If I'm online, I can unlock with a pin. Some critical piece of information would be kept server-side, and the server would limit unlock attempts. 2. If I'm offline and need access to my vault—which happens but not too often—I need to use my full master password. I think this should be doable? Could you retain enough end-to-end encryption such that if Bitwarden itself is hacked, my vault couldn't be decrypted via only my pin?

_cenw 4y ago
You don't actually need biometrics, you just need a TPM to handle your pin-to-password function with an attempt limit.
- Wowfunhappy 4y ago
  Okay, but my laptop doesn't have that either.
  - cryptonector 4y ago
    How old is your laptop?
    - benatkin 4y ago
      Wowfunhappy's laptop has a keyboard which can be used to enter a long enough password. Pity that the only reasonable option is rejected.
    - Wowfunhappy 4y ago
      Coming up on a decade old now, actually.
  - noname120 4y ago
    Buy a U2F USB key.

billconan 4y ago

the more I see hacked password vaults (lastpass for example), the more I want to build a p2p password vault that only lives on my own devices.

krab 4y ago
KeePass plus Dropbox. Or Syncthing for really using only your devices.
neandrake 4y ago
Codebook might be suitable. You can sync to Dropbox or google drive, or instead only sync between devices on the lan. https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/
IceWreck 4y ago
It already exists: keepass and sync your DB on all your devices with syncthing (which is p2p). Or host vaultwarden on your homeserver and access it only through wireguard/nebula self hosted VPN.
- Macha 4y ago
  Note the KeePass's resistance to the attack mentioned depends on the security of .NET's secure string, which, here's what Microsoft has to say about it (https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...) As for KeePassXC, last I checked it didn't even bother.
tete 4y ago
Wouldn't it be enough to use something like Keepassxc and sync with whatever you use for syncing?
- lucb1e 4y ago
  It would, so long as you're aware that the password has to be strong. Let's quantify that. The default KDF that keepassx uses is iirc ~50ms seconds of computation on modern hardware. It might dynamically determine the KDF rounds based on your system, but it never updates it (hmm, is that a vuln as well?) so it'll be old either way. A GPU gets a ~thousand-fold speed-up compared to CPU for pbkdf2, so let's say 20k guesses per second per GPU (note: this is just a ballpark number). An attacker might have a dozen GPUs available and care to spend a month on your vault (does that sound like a fair upper bound? Tweak it for your personal threat model), which means they run through some log(20e3 guesses_per_second × 12 gpus × (3600×24×31) seconds)/log(2) ≃ 40 bits of entropy. If you pick random words from a diceware-sized dictionary (7776 words), you need 4 random words to be secure (because log(7776⁴)/log(2)>40). If you pick random characters from a-z,A-Z,0-9, you need a 7-character randomly generated password (because log(62⁷)/log(2)>40). Edit: it looks like KeepassX has stopped development and says to use KeepassXC now. Their source code has some mentions of Argon2id so this may be outdated advice! Your password/-phrase may be able to be shorter than this, but it'll be hard to quantify because all Argon2 crackers suck ("For Argon2, the fastest cracking software that I can find is a CPU implementation." I wrote two years ago in https://security.stackexchange.com/a/249384/10863 https://security.stackexchange.com/a/249384/10863).

chiefalchemist 4y ago

The moral of the story here seems to be: if you want convenience you'll compromise your security. This is not exclusive to BW. Or if you want a moral of the story specific to the article: Don't use the PIN feature in BW. And perhaps, instead of a PIN use a physical key (e.g., YubiKey).

juve1996 4y ago
Most people have been told that even though you're centralizing passwords (meaning if hacked you're in big trouble), the benefits gained from being able to generate strong passwords overcome this. Is this no longer true, for most people?
- Dalewyn 4y ago
  I can count on one hand the number of services that are important/crucial enough to warrant unique, strong passwords. All the rest I just reuse simple passwords because they simply aren't important and aren't worth the time to care. Someone wants my Discord? Go for it, I don't care. My Reddit goes with it? Sure, I don't care. My HN account too? Daring today, aren't we. So no, personally I haven't felt a need nor desire for a password manager. Arguably it will cause me more grief than convenience.
- chiefalchemist 4y ago
  The idea is...centralize your PWs but "harden" them behind a single longer and less brute-forceable master pw. And since the PW manager is doing the fill in, those can be longer and more random as well. Perfect? No. 100x better than what most people do? Yes!!! Moi? For the important stuff? I add in a YubiKey. Perfect? Again, no. But closer than no YK at all. As a side note: I do contract web dev work for various agencies. Generally, talk about a lazy approach to clients' PWs. They think 1PW makes things secure. Meanwhile I generally have access to all vaults, even projects I'm not working on. Good sec is bases on less trust, not too much blind trust.
- lucb1e 4y ago
  I would say this is definitely true for the common Joe, but of course it helps to not run much arbitrary software from the web and keep your browser up-to-date to avoid drive-by malware. If you've got a habit of pirating games, you may want to keep your princess in another castle. My mom doesn't have any reason to download and run untrusted software ever, and she'd call me if she needs something, so for her it's definitely better to have secure passwords with the risk of having all eggs in one basket. The risk of her being tricked into running software that steals the vault is lower than the guessable and reused passwords that she used before. If you are more like me and regularly download software to try it out, pull random github repos to toy with them, etc., then it might be wise to keep the password database on an Android/iOS device which have app isolation. You can download all the malware you want, but if you don't grant it root, it won't be able to access the database stored in /data/data/com.example.keepass/database/.

markstos 4y ago

It’s practically game over if an attacker has access to your laptop. They can for example install a keylogger and capture your master password for any password manager.

ris58h 4y ago
Don't confuse access to working laptop with access to encrypted data [upd: that was] stored inside it.
- prophesi 4y ago
  To clarify for those that jumped straight to the comments; the threat model this article is talking about is extracting the encrypted database stored locally on your machine to brute-force the PIN. Personally, I'd agree with Bitwarden on this that it's an attack that requires physical access to a user's device, or worse, remote admin privileges. > Using a PIN can weaken the level of encryption that protects your application's local vault database. > If you are worried about attack vectors that involve your device's local data being compromised, > you may want to reconsider the convenience of using a PIN. https://bitwarden.com/help/unlock-with-pin/#enable-unlock-with-pin https://bitwarden.com/help/unlock-with-pin/#enable-unlock-wi...
  - yazzku 4y ago
    Then why encrypt it in the first place? That's the point the author makes (text in bold).
    - prophesi 4y ago
      It's a choice on the user to weaken the encryption. I don't use Bitwarden, but if they communicate that properly to the user, it's a valid compromise for convenience-versus-security.
      - yazzku 4y ago
        This doesn't answer the question. Why is there a choice to encrypt something when it's completely unnecessary (according to their threat model)? No point in building unnecessary complexity into software, especially software meant for security.

neilv 4y ago

> However this 5 guesses limit is enforced completely within the client's logic: it relies on the attacker using the official Bitwarden client. I'd guess a software engineer working on that part of a security system would probably consider that, while the implementation approach for that part was being decided. If so, why did it happen anyway? Did they communicate the weakness to users?

waselighis 4y ago

The problem is these password managers are lucrative targets, especially being able to gain access to a person's financial accounts. Simply disregarding the issue and categorizing it as "Attacks requiring physical access to a user's device" isn't good enough. Yes, there's only so much Bitwarden can do from the software side of things, without hardware support to back it up. But Bitwarden should still do what it can to mitigate such attacks, such as significantly increasing the number of PBKDF2 iterations for PINs (at least stored on disk; a key could be cached in RAM with fewer iterations because RAM is far less likely to be compromised than files on disk), and discouraging (or even preventing) users from using short PINs that could be quickly brute forced.

SV_BubbleTime 4y ago
BW is/has switched to Argon2 over PBKDF2, fwiw. Although Argon2 trades the iterations field for an allocated amount of memory, so time will tell if there isn’t a “BW accounts with 16MB of argon2 allocation are no longer considered secure”.

d-z-m 4y ago

The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues. The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activity by an attacker is occurring. However, users probably have the reasonable expectation that if their laptop is stolen, their device-local vault data(supposedly encrypted on disk) is not compromised as a result. Bitwarden should either disallow weak pins/pin-access altogether, or they should caveat more clearly the weaknesses of pin-only access to device-local vault data. [0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

LorenPechtel 4y ago
A PIN is a de-facto very weak password. Of course it can be brute forced!
- d-z-m 4y ago
  Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.
  - poisonborz 4y ago
    It's the user's choice.
    - mynameisvlad 4y ago
      I mean, sure, but if the user isn’t appropriately informed of the risks (such as this attack) how would you expect them to make a good choice?
    - d-z-m 4y ago

dathinab 4y ago

A rule of thump: Nearly everything which is called PIN can be reasonably brute-forced as long as it doesn't get locked after a few attempts (and only unlocked through another factor e.g. a PUCK).

throwaway742 4y ago
What is a PUCK?
- dathinab 4y ago
  PIN unlock Key (PUK) if you mistyped the PIN to often the thing is locked until the PUK is entered, often followed by resetting the PIN to a new potentially different value. most often know from SIM cards
  - throwaway742 4y ago
    thank you

Waterluvian 4y ago

On the spectrum of security, I think a PIN is closer to a privacy lock than a security lock.

ddtaylor 4y ago

> Now, granted, the key derivation function is PBKDF2 with 100000 iterations FWIW on a GPU using SHA1 or SHA256 this is not very much time-protection.

sneak 4y ago
Someone should tell them! https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52

upofadown 4y ago

>If accessing device-local data is outside of the threat model, why are we encrypting these data at all? We might as well store them in plain text. The PIN is still potentially useful in that it prevents anyone with access to the device from getting access to the secret information without having to perform an overt act. The difference between leaving a piece of paper with the passwords laying about and locking it in a drawer.

gowings97 4y ago

Suddenly getting Error Code 7 (unusual network detected - https://bitwarden.com/help/unusual-traffic-error/ https://bitwarden.com/help/unusual-traffic-error/) when attempting to login. Googling and looking on Twitter - people have been complaining about this happening to them as well. - https://www.reddit.com/r/Bitwarden/comments/110gpkt/traffic_from_your_network_looks_unusual_connect/ https://www.reddit.com/r/Bitwarden/comments/110gpkt/traffic_... -https://www.reddit.com/r/Bitwarden/comments/11vplwv/network_error_on_web_login/ https://www.reddit.com/r/Bitwarden/comments/11vplwv/network_... - https://twitter.com/lazminutes/status/1624946344564781056 https://twitter.com/lazminutes/status/1624946344564781056 Locking me out of 2FA because of you don't like my network traffic? Yeah, I will be immediately leaving your service, bye. That's Google like bro, lol. Clown stuff. Insane that they would even think of doing this.

1attice 4y ago

Well, there goes my trust in another old friend. That's a downgrade attack for sure.

lucb1e 4y ago
> That's a downgrade attack for sure. "... is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. an encrypted connection) in favor of an older, lower-quality mode of operation (e.g. cleartext) that is typically provided for backward compatibility with older systems." from https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack Guessing a 4-digit number with unlimited attempts available is not a downgrade attack but a brute-force attack https://en.wikipedia.org/wiki/Brute-force_attack https://en.wikipedia.org/wiki/Brute-force_attack
- 1attice 4y ago
  Allowing people to choose an insecure means of securing their work just is a stochastic downgrade attack. Think it through.
  - ThatPlayer 4y ago
    Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack?
    - 1attice 4y ago
      I have no opinion other than it is obviously a downgrade attack. As a fair to middling organic language model, I cannot tell you how to keep your keys safe; I myself am blessed with a good memory and 160wpm typing speed so I use that.
      - ThatPlayer 4y ago
        As you say yourself, that is a blessing, and not everyone has it. Only allowing those with such blessings to use Bitwarden doesn't help anyone.

qainsights 4y ago

I disabled it for purpose :)

FfejL 4y ago

"Let's now assume that the user enables the PIN unlock and configures Bitwarden so that it doesn't require the master password on restart." If the user has setup Bitwarden so the master password is not required, then the user gets what they asked for, namely a password database secured by a 4 digit PIN. Not clear to me why this is a problem Bitwarden needs to fix.

SV_BubbleTime 4y ago
They could make the pin process intentionally slow… maybe with some number of iterations… and as computers get faster they can just update the number of iterations required…
- morpheuskafka 4y ago
  If the PIN is local, only a secure element type of chip could meaningfully enforce this restriction. Otherwise, whatever memory or disk stores the secret encrypted only by the 4-digit PIN could still be brute forced. Just disabling entering a PIN in the UI would not be enough for security.
  - 0xdeafbeef 4y ago
    You can use pbdkf2 with 200k iterations or argon2 to derive key from pin
    - barsonme 4y ago
      This has very limited benefit for weak passcodes, like PINs.
    - gengkev 4y ago
      Suppose it takes 2 seconds of 100% cpu usage to compute the password hash (you probably wouldn't want to wait much longer). Then brute forcing a 4 digit PIN will take 20000 seconds ≈ 6 hours maximum. There's no way around that, no matter what hash function you use.

forty 4y ago

Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hopeless (as someone mentioned, they probably can install some key logger and steal the master password and everything else later). It never hurts to be clear on the threat model (And they should probably go with the option 1. suggested by the author), but I feel in that case the behavior matches reasonable expectations and the author is a bit of bad faith. For solution 2. if you want to check a pin server side without trivial access to the PIN from the server you can do it à la signal using secure enclaves https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/

_8j50 4y ago
Ugh..no it does not work that way. You are thinking in hypotheticals like many developers do. Most infostealer malware just exfiltratr your data and disappear before being detected do they can hit a lot of targets before commom av starts detecting them. People also accidentally disclose data, back it up on a usb drive and lose that drive, have their pc stolen,etc... If you have keepass2 with a memory argon2 and a password/passphrase none of that is a concern. Yes, the malware could also be a keylogger/RAT and you'd be screwed then. One the most important security mindsets to have is "perfection is the enemy of good", specific security controls exist to address specific threats/risk not to address arbitrary and and an unbounded number of possible threats.
- forty 4y ago
  I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext. Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.
  - 4y ago

subeadia 4y ago

"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png https://i.imgur.com/BzXJmos.png

shiftingleft 4y ago
It looks like this is a popup for a different setting. Did you watch the video outlined in the post? The author is arguing that such a popup should also exist when locking a vault with a PIN only.
IshKebab 4y ago
That's about as unclear as I could imagine. "If you use this option please ensure you take the appropriate precautions."
- Wowfunhappy 4y ago
  That's not what it says though. How would you phrase it? I don't think they do a great job but this is pretty hard to explain in two sentences if you're targeting a non-technical person.
  - IshKebab 4y ago
    "If you use this option then your passwords will not be stored securely. Any program or person that can read your files can also read your passwords."
Wowfunhappy 4y ago
I'm pretty sure that comes up only if you disable vault timeout entirely, not if you enable a timeout but allow unlock with PIN.

iLoveOncall 4y ago

This posts reads like "Hey guess what, if you store your passwords in a file called passwords.txt on your desktop and install a virus, people can steal your passwords.". Water is wet.

bobleeswagger 4y ago

Convenience is the enemy of good security.

nabakin 4y ago

Yes, pins can be bruteforced when they are stored locally, on device. That should be pretty obvious to those of us who know anything about security. However, the average user doesn't know about security. They shouldn't be expected to understand the nuance of security. So many people in this comments section are saying 'well obviously a pin can be cracked' but it's not obvious for the average user! Stop blaming the user here when Bitwarden should only offer features which are secure or at the very least provide a warning when a feature is unsecure.

hedora 4y ago
Local pins can’t be brute-forced on the majority of my machines. The exception is a decade+ old intel desktop, and, even then, I think it has a wonky tpm slot (or I could buy a yubikey. They support locking pins after too many retries, right?)
xxkylexx 4y ago
The Bitwarden docs warn users about the exact risk this article talks about. https://bitwarden.com/help/unlock-with-pin/ https://bitwarden.com/help/unlock-with-pin/

eviks 4y ago

The name is part of the problem You can have shorter alphanumeric password per device for frequent unlocks, it doesn't have to be your typical 4 number PIN that jumps to mind It would not offer the same protection as your main much longer password, but then that longer password protects against a bigger threat than local access, and it's still much more convenient (and not much less inconvenient vs the 4 digit PIN, like on a full computer keyboard typing a longer word is faster than shifting your fingers to the top numbers row) And it would be nice if password managers explains the much much bigger risk of these very short numbers-only poorly named PINs so that users can make an informed decision

quickthrower2 4y ago

This is logical right? 1. You can access the passwords if you know the PIN. 2. All state is local. All you need to do is guess the PIN and restore state, and repeat. Any code in Bitwarden to prevent (obscure) you from doing this is just a cat and mouse game. Perhaps a way around this is to not have all state local. Have the PIN + separate authenticating private key go to their server. You get 3 attempts before you need the full password.

RyeCombinator 4y ago

Everything can be brutce-forced https://xkcd.com/538/ https://xkcd.com/538/

Operative0198 4y ago

Glad I transitioned my passwords from Bitwarden to an offline password manager that doesn't have a similar "easy PIN password mode" feature. I used to use Bitwarden with this feature though, just that I recently came to the conclusion that the product probably isn't the most secure offering and it has some issues on Android with native autofill when you aren't using Google Services.

stockhorn 4y ago
What issues are you talking about on android? Using e/os/ here with native autofill and yes this seems to have some issues :/ (mainly keyboard not auto-closing I think)
- Operative0198 4y ago
  Maybe I was a bit too harsh on Bitwarden for a moment there, it's chiefly an issue with chromium. https://github.com/bromite/bromite/issues/547 https://github.com/bromite/bromite/issues/547

t-writescode 4y ago

The attacks went from LastPass and over to BitWarden. After the attacks and smear campaigns, shall the people unwilling to use KeyPass and other high-lift/high-risk pieces of software move on to using tiered password strategies for their hundreds of sites again?

LelouBil 4y ago
It's not really an attack. Pin is obviously less secure (however this could be mitigated by using a TPM as other commenters said) but it's not the default. Their help page on pin even warns about the security risk, they should have the warning in the application. I'll still use bitwarden (without pin).

surfsvammel 4y ago

If I am not using a PIN code, need I be worried?

LelouBil 4y ago
No

hedora 4y ago

The article and comments don’t really answer the most important question here: Most modern hardware supports access to secure key storage via biometrics or pins that lock after a few attempts. Is the issue that bitwarden fails to use these properly (e.g., by storing a short pin in the touch id enclave), or that the person reporting the bug is using a machine without such an enclave, and enabled pins anyway?

rstuart4133 4y ago
> Is the issue that bitwarden fails to use these properly It's not so easy. Bitwarden runs in a browser on PC's. As far as I know, browsers don't provide a javascript API to the TPM. They probably supply a javascript API to their password store which may even be backed by a TPM (Firefox on Windows is I think), but they also allow you to browse their passwords while the browser is running so I wouldn't be keen on that. Bitwarden also runs on Android. I haven't seen an Android TPM API. Instead Android supplies a "Keystore". It stores secrets that can be unlocked using phone managed secrets - like a PIN, fingerprint and so on. Yes, they have limited retries - but they come with the limitation that if you can unlock the phone, you can unlock Bitwarden. Not ideal - in fact pretty much the same situation as a browser, now I think about it. So I suspect that while it's true "most modern hardware supports secure storage", the issue is Bitwarden doesn't run directly on the hardware. Instead it runs on platforms like Anroid or a browser that don't expose the hardware's secure storage directly.
- olabyne 4y ago
  Bitwarden has now a native app on PC. I still use the browser extension but I might switch to the native app, as I reckon from other comments they do support OS security APIs

xxkylexx 4y ago

Criticisms from this article: >Bitwarden does not warn about this risk…… Bitwarden takes little effort in communicating the risks of choosing a short low-entropy PIN. Currently there is very little information to be found about the PIN in Bitwarden documentation Bitwarden's help docs on using PINs: https://bitwarden.com/help/unlock-with-pin/ https://bitwarden.com/help/unlock-with-pin/. >Warning: Using a PIN can weaken the level of encryption that protects your application's local vault database. If you are worried about attack vectors that involve your device's local data being compromised, you may want to reconsider the convenience of using a PIN.

LelouBil 4y ago
They just need to put that notice in the software, when you try to enable a pin.

1letterunixname 4y ago

Much ado about the obvious. I don't use BW's PIN. Using a loong passphrase. If others want convenience with 12345, it's all them.

donutshop 4y ago

Cars come with seatbelts, one can put them on, or put them on improperly. Not to say that the seatbelts are perfect, but the carmakers have done what they can to provide that safety net.

pnt12 4y ago
Not sure if the best analogy... At least in my country you can get a fine if you don't wear a seat belt in a car. So it's not really up to you.
- donutshop 4y ago
  But you can still choose to not wear it. Am in a country where seatbelts are required by law, but many ignore it because of convenience, bad habits..etc. It's a law, but one that can't be enforced realistically.

hartator 4y ago

> If accessing device-local data is outside of the threat model, why are we encrypting these data at all? We might as well store them in plain text. Yes, exactly. I feel a lot of these tools are doing this. And it’s okay if it explicits that the data is plain text. However why annoying users with a PIN in the first place? I am sorry bitwarden didn’t fake this seriously. Let me know if you are looking for a job. We have several positions open. Feel free to shoot me an email julien -at—serpapi.com

webprofusion 4y ago

If your machine has something running on it that's brute forcing your PIN, what's to stop it already having something doing keylogging and clipboard monitoring? Aren't you already hopelessly compromised?

ziml77 4y ago

I see many comments in here saying it's obvious that a PIN can be brute forced. But it is absolutely NOT obvious that's the case because for a long time now we've had hardware like TPM and Secure Enclave. With that hardware, you can have the database's key securely stored with the PIN being what lets the hardware release that key. And even if the attacker has physical access to the device, it can be protected from brute force by having the hardware forget the key after a number of failed attempts.