6 ms·
The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are lis
by d-z-m 4y ago
The author mentions this finding was marked as out-of-scope when they reported it to Bitwarden. A couple of categories that are considered out-of-scope are listed, namely: attacks requiring physical access to a user's device, and "other side of airtight hatchway"[0] type issues.
The latter seems reasonable, if the assumption is that the device is fully compromised, and ongoing surreptitious monitoring of user activity by an attacker is occurring.
However, users probably have the reasonable expectation that if their laptop is stolen, their device-local vault data(supposedly encrypted on disk) is not compromised as a result. Bitwarden should either disallow weak pins/pin-access altogether, or they should caveat more clearly the weaknesses of pin-only access to device-local vault data.
[0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- LorenPechtel 4y agoA PIN is a de-facto very weak password. Of course it can be brute forced!
- d-z-m 4y agoIndeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.
- poisonborz 4y agoIt's the user's choice.
- mynameisvlad 4y agoI mean, sure, but if the user isn’t appropriately informed of the risks (such as this attack) how would you expect them to make a good choice?
- d-z-m 4y agoCurrently it is, yes. In this case, I'm arguing that it should not be.
- poisonborz 4y agoThat would go against the nature of such software. Let's treat users as adults. There should be warnings. But this is a feature. Users shouldn't be able to eg. select weak crypto algos, there is no additional functionality in that. But setting whatever pin is a convenience, and users should be able to decide what threat vectors they accept.
- nicoburns 4y agoIf it’s n or convenient then users won’t use a password manager at all:
- jeron 4y agoIf you limit number of attempts, can it still be brute forced?
- KMnO4 4y agoHow can you enforce a limit when the decryption is done client side?
- ericpauley 4y agoUsing a TPM: https://en.wikipedia.org/wiki/Trusted_Platform_Module https://en.wikipedia.org/wiki/Trusted_Platform_Module
- intelVISA 4y agoTPM interdiction is readily possible.
- sudosysgen 4y agoRequire a backup password when the TPM is offline.
- lucb1e 4y agoI web searched it and found a dedicated wikipedia page https://en.wikipedia.org/wiki/Interdiction https://en.wikipedia.org/wiki/Interdiction but I still can't figure out what TPM interdiction is supposed to mean Anyway if a TPM was trivially bypassable then there would be no point to having them so I'm doubtful of whatever this off-hand comment is supposed to mean
- bkettle 4y agoI think they are talking about the definition under the Espionage section, i.e. a hardware supply chain attack: > The term interdiction is also used by the NSA when an electronics shipment is secretly intercepted by an intelligence agency (domestic or foreign) for the purpose of implanting bugs before they reach their destination.
- NoZebra120vClip 4y agoIn the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.
- duxup 4y agoTIL Thanks, when windows moved to the PIN I was wondering how that worked/ they kept it secure but still easy to login.
- jvdvegt 4y agoIndeed! They should have explained this much better when it was introduced. But of course, Windows PIN was only needed when they made a local login a login to your Microsoft account, so your local password was suddenly transmitted to the internet.
- generalizations 4y agoDoes the TPM limit retries or something? If it's a 4-6 digit number, you can just count upwards and try them all in a trivial amount of time.
- mynameisvlad 4y agoYes. https://www.dell.com/support/kbdoc/en-us/000142311/tpm-failure-tries-recovery-time-and-lockout-recovery https://www.dell.com/support/kbdoc/en-us/000142311/tpm-failu...
- kadoban 4y ago> Does the TPM limit retries or something? Yes. TPMs have weaknesses, so this probably isn't a 100% guarantee depending on the attacker and the exact hardware, but it's pretty reliable (and very reliable if your attacker is reasonably small).
- 4y ago
- Kwpolska 4y agoIf you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.
- Semaphor 4y ago> including copying the Bitwarden file and using a GPU farm to crack the master password. That should still take essentially forever, or did I miss some advances in brute forcing?
- hn_throwaway_99 4y agoLots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 128) value, which does make cracking impossible. The user has to print out this value so that if they need to sign in on a new device that they can enter the value, so it adds a little friction, but 1P has the right idea that humans just can't be relied upon to generate and memorize high entropy strings, in general.
- Semaphor 4y agoI’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.
- bastawhiz 4y agoYet, people stole LastPass vaults. Why bother stealing them if you don't plan to actually crack them? At least someone saw the potential for some ROI.
- grapesurgeon 4y ago[dead]
- hnarn 4y ago> However, users probably have the reasonable expectation that if their laptop is stolen, their device-local vault data(supposedly encrypted on disk) is not compromised as a result. If you’re using a four-number pin to encrypt your data with no additional “padding” around that PIN, that is not a reasonable expectation. However, I also don’t think that it’s reasonable that Bitwarden allows weak passphrases to begin with.
- tomxor 4y ago> users probably have the reasonable expectation that if their laptop is stolen Yes, there is a significant difference between compromising a device with physical access and stealing the device. Disk encryption for example is very effective against the latter, but useless against the former. Having devices stolen is also far more common than targeted physical attacks.
- nabakin 4y agoExactly. So many people in this comments section are saying 'well obviously a pin can be cracked' but the point is, the average user does not know this. Once they give their information to Bitwarden, they expect it to be safe. They shouldn't have to understand the nuances of security in order to keep their data safe. If the pin can be cracked, Bitwarden should not offer it as an option or at least explain to users how vulnerable they will be before they enable it.