6 ms·

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections

The silly thing is that Windows already has Windows Hello and its accompanying APIs which can be used to guard something like it with anti-hammering protections. Ditto for macOS and the Secure Enclave. I know it's not 100% of its market but using those two features could drastically improve security for the vast majority of people who pay no mind to things deep down in the weeds such as this.

jeroenhd 4y ago
Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking. I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices, where access to the underlying key store is near impossible so brute-forcing is much less of a risk. Biometrics are usually available there as well, but if you don't trust them with your most secure passwords (you probably shouldn't) or if you want a backup, a PIN would be an excellent defence mechanism for when you've left your phone unlocked and a stranger is trying to steal your passwords.
- Wowfunhappy 4y ago
  > I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices. Note that on desktop Bitwarden allows PINs to be alphanumeric, and any length. I use a PIN because my master password is more than 20 characters and I don't want to type it every time I restart my browser. My PIN is a decently strong password in its own right, but shorter than my actual master password.
- Veliladon 4y ago
  >Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.
  - _cenw 4y ago
    Intel only added PTT - their soft TPM - with Coffee Lake.
  - jeroenhd 4y ago
    I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.
    - waboremo 4y ago
      Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
      - Veliladon 4y ago
        You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
      - jeroenhd 4y ago
        My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.
  - Macha 4y ago
- capitainenemo 4y ago
  I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.
  - jeroenhd 4y ago
    Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.
    - capitainenemo 4y ago
      I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
- kayson 4y ago
  Bummer that its not usable on the browser extension though. I used to have the desktop app but it ended up being mostly useless. 99% of my passwords go into the browser where I want autofill, and for the rest I almost always have a browser open anyways so I can just as easily copy/paste from the extension as the app.
  - jeroenhd 4y ago
    You can use biometrics in the browser app, but you have to run the application and unlock that with biometrics after enabling browser integration in the settings. You also can't use the Windows Store version of the Bitwarden app. https://bitwarden.com/help/biometrics/ https://bitwarden.com/help/biometrics/
    - kayson 4y ago
      Clunky, but hey I'll take it. Thanks!
fortran77 4y ago
I think that’s why the POC was on Linux.
cma 4y ago
Weirdly chrome seems to prompt for windows hello pin to view passwords but not to auto fill them. Is it using the TPM to store them securely in any way?
waselighis 4y ago
Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's servers. Every. Single. Time. There's no way to use another device either. I recall, back in the day, you could activate Windows XP without internet by calling a number which would give you a long code to type in and would activate Windows. But nothing like that exists for Windows Hello. No internet? Tough luck. In the end, I had to reinstall Windows and I'm never touching Windows Hello again.
- vel0city 4y ago
  I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.
  - GordonS 4y ago
    I've never had the problem the GP had, but I have had Windows Hello "forget" biometrics were even configured - it's happened at least 3 times now, I guess after a Windows Update. Each time I go to login with a fingerprint, but it gives an error message and insists on the password instead, and then I have to setup Windows Hello from scratch. It's mind-boggling how shit Windows Hello is :-/
- Dalewyn 4y ago
  Security enthusiasts will scream bloody murder, but fact of the matter is nothing beats a simple password for balancing security and practicality.
- SparkyMcUnicorn 4y ago
  I remember some of the piracy tools activated windows by generating these phone codes.
- 4y ago
willis936 4y ago
KeepassXC does this on Windows (and is free). Strongbox uses secure enclave for master password storage on iOS.

jeroenhd 4y ago

Windows Hello and TouchID are supported according to this blog post: https://bitwarden.com/blog/introducing-desktop-biometrics/ https://bitwarden.com/blog/introducing-desktop-biometrics/ Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. Furthermore, the demonstration video is clearly running on some kind of Linux/BSD system, where support for trust hardware is distinctly lacking. I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices, where access to the underlying key store is near impossible so brute-forcing is much less of a risk. Biometrics are usually available there as well, but if you don't trust them with your most secure passwords (you probably shouldn't) or if you want a backup, a PIN would be an excellent defence mechanism for when you've left your phone unlocked and a stranger is trying to steal your passwords.

Wowfunhappy 4y ago
> I don't know why you would bother with a PIN on your password manager. My guess is that it's a feature designed for mobile devices. Note that on desktop Bitwarden allows PINs to be alphanumeric, and any length. I use a PIN because my master password is more than 20 characters and I don't want to type it every time I restart my browser. My PIN is a decently strong password in its own right, but shorter than my actual master password.
Veliladon 4y ago
>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.
- _cenw 4y ago
  Intel only added PTT - their soft TPM - with Coffee Lake.
- jeroenhd 4y ago
  I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.
  - waboremo 4y ago
    Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
    - Veliladon 4y ago
      You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
    - jeroenhd 4y ago
      My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.
- Macha 4y ago
capitainenemo 4y ago
I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.
- jeroenhd 4y ago
  Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.
  - capitainenemo 4y ago
    I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
kayson 4y ago
Bummer that its not usable on the browser extension though. I used to have the desktop app but it ended up being mostly useless. 99% of my passwords go into the browser where I want autofill, and for the rest I almost always have a browser open anyways so I can just as easily copy/paste from the extension as the app.
- jeroenhd 4y ago
  You can use biometrics in the browser app, but you have to run the application and unlock that with biometrics after enabling browser integration in the settings. You also can't use the Windows Store version of the Bitwarden app. https://bitwarden.com/help/biometrics/ https://bitwarden.com/help/biometrics/
  - kayson 4y ago
    Clunky, but hey I'll take it. Thanks!

fortran77 4y ago

I think that’s why the POC was on Linux.

cma 4y ago

Weirdly chrome seems to prompt for windows hello pin to view passwords but not to auto fill them. Is it using the TPM to store them securely in any way?

waselighis 4y ago

Maybe unrelated to the original article, but I tried Windows Hello once. Upon reboot, my PC couldn't connect to the internet for some reason, so I wasn't able to login. I got locked out of my own PC because it couldn't connect to Microsoft's servers to verify my password, and there's absolutely no workaround to this problem. It won't use a locally cached password to login, it verifies your password with Microsoft's servers. Every. Single. Time. There's no way to use another device either. I recall, back in the day, you could activate Windows XP without internet by calling a number which would give you a long code to type in and would activate Windows. But nothing like that exists for Windows Hello. No internet? Tough luck. In the end, I had to reinstall Windows and I'm never touching Windows Hello again.

vel0city 4y ago
I've been using Windows Hello and Microsoft accounts for login on devices for a few years. Its worked for offline for me literally many thousands of times across several devices.
- GordonS 4y ago
  I've never had the problem the GP had, but I have had Windows Hello "forget" biometrics were even configured - it's happened at least 3 times now, I guess after a Windows Update. Each time I go to login with a fingerprint, but it gives an error message and insists on the password instead, and then I have to setup Windows Hello from scratch. It's mind-boggling how shit Windows Hello is :-/
Dalewyn 4y ago
Security enthusiasts will scream bloody murder, but fact of the matter is nothing beats a simple password for balancing security and practicality.
SparkyMcUnicorn 4y ago
I remember some of the piracy tools activated windows by generating these phone codes.
4y ago

willis936 4y ago

KeepassXC does this on Windows (and is free). Strongbox uses secure enclave for master password storage on iOS.