4 ms·
A PIN is a de-facto very weak password. Of course it can be brute forced!
by LorenPechtel 4y ago
A PIN is a de-facto very weak password. Of course it can be brute forced!
- d-z-m 4y agoIndeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.
- poisonborz 4y agoIt's the user's choice.
- mynameisvlad 4y agoI mean, sure, but if the user isn’t appropriately informed of the risks (such as this attack) how would you expect them to make a good choice?
- d-z-m 4y agoCurrently it is, yes. In this case, I'm arguing that it should not be.
- poisonborz 4y agoThat would go against the nature of such software. Let's treat users as adults. There should be warnings. But this is a feature. Users shouldn't be able to eg. select weak crypto algos, there is no additional functionality in that. But setting whatever pin is a convenience, and users should be able to decide what threat vectors they accept.
- nicoburns 4y agoIf it’s n or convenient then users won’t use a password manager at all:
- jeron 4y agoIf you limit number of attempts, can it still be brute forced?
- KMnO4 4y agoHow can you enforce a limit when the decryption is done client side?
- ericpauley 4y agoUsing a TPM: https://en.wikipedia.org/wiki/Trusted_Platform_Module https://en.wikipedia.org/wiki/Trusted_Platform_Module
- intelVISA 4y agoTPM interdiction is readily possible.
- sudosysgen 4y agoRequire a backup password when the TPM is offline.
- lucb1e 4y agoI web searched it and found a dedicated wikipedia page https://en.wikipedia.org/wiki/Interdiction https://en.wikipedia.org/wiki/Interdiction but I still can't figure out what TPM interdiction is supposed to mean Anyway if a TPM was trivially bypassable then there would be no point to having them so I'm doubtful of whatever this off-hand comment is supposed to mean
- bkettle 4y agoI think they are talking about the definition under the Espionage section, i.e. a hardware supply chain attack: > The term interdiction is also used by the NSA when an electronics shipment is secretly intercepted by an intelligence agency (domestic or foreign) for the purpose of implanting bugs before they reach their destination.
- NoZebra120vClip 4y agoIn the case of Windows Hello, a PIN is very different from a password (such as your live.com password). PINs are encrypted per-device, and are never transmitted from the device. They are resilient against rainbow table brute-forcing, and they generate asymmetric cryptographic key-pairs by using the device TPM. So forget what you know about ATM PINs; this is a markedly different concept.
- duxup 4y agoTIL Thanks, when windows moved to the PIN I was wondering how that worked/ they kept it secure but still easy to login.
- jvdvegt 4y agoIndeed! They should have explained this much better when it was introduced. But of course, Windows PIN was only needed when they made a local login a login to your Microsoft account, so your local password was suddenly transmitted to the internet.
- generalizations 4y agoDoes the TPM limit retries or something? If it's a 4-6 digit number, you can just count upwards and try them all in a trivial amount of time.
- mynameisvlad 4y agoYes. https://www.dell.com/support/kbdoc/en-us/000142311/tpm-failure-tries-recovery-time-and-lockout-recovery https://www.dell.com/support/kbdoc/en-us/000142311/tpm-failu...
- kadoban 4y ago> Does the TPM limit retries or something? Yes. TPMs have weaknesses, so this probably isn't a 100% guarantee depending on the attacker and the exact hardware, but it's pretty reliable (and very reliable if your attacker is reasonably small).
- 4y ago