4 ms·

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparis

Using the PIN is outdated anyways when it comes to convenience, all reasonable user OS now support biometrics and those offer better risk mitigation in comparison. It is something they should remove entirely in an upcoming version after giving users enough warning.

NoZebra120vClip 4y ago
PINs can be changed. How many fingers ya got?
- renewiltord 4y ago
  Ten. I don't get why this is a constraint. If they're rubberhosing me, I'll just give them the master pass. They won't have to take my finger. If they get my fingerprint some other way, I can just switch to my next finger. And when I'm done, I can use PINs. I don't think it's mutability that matters. It's just that I leave fingerprints everywhere.
- waboremo 4y ago
  I'm pretty sure you can register the same finger over and over again for new "keys". Assuming you go through the tedious process of disabling, restarting, etc whatever each one of the underlying OS demands. It's an additional layer that Bitwarden (and other apps) do not get direct access to. So no excuse if you value convenience, PINs are not good. Short easy to remember and enter PINs are also the reason Apple is under fire due to how easily you can avoid biometrics and just use the 6 digit PIN.
mt360 4y ago
I wouldn't put too much faith in biometrics either, a real shame considering their convenience. https://blog.kraken.com/post/11905/your-fingerprint-can-be-hacked-for-5-heres-how/ https://blog.kraken.com/post/11905/your-fingerprint-can-be-h... Personally I advocate using BitWarden for commonly used logins that, if they were compromised, would not be catastrophic; perhaps in some cases because 2FA provides another, tautologically, factor, and KeePass secured with a FIDO2 device in challenge response mode, a passphrase, and possibly setting a higher key stretching work factor to further blunt any brute force attempt, in which more important data is held.
- waboremo 4y ago
  That's an absurd amount of effort to bypass fingerprint biometrics, nice. However, it's important to note here that biometrics isn't just about fingerprints and every OS handles their available biometrics options differently. For example, I would recommend face authentication on apple devices, however I would avoid using face for windows, and instead recommend a windows hello PIN (yes, it's handled differently than the PIN in the above article). Ultimately, you're just trying to create a balance between the layers of protection and reasonable attacks. There's only so much you can protect against, nobody can withstand someone who is cloning fingerprints, stealing devices, has access to your separate device 2FA, etc. without severely affecting their lifestyle.

NoZebra120vClip 4y ago

PINs can be changed. How many fingers ya got?

renewiltord 4y ago
Ten. I don't get why this is a constraint. If they're rubberhosing me, I'll just give them the master pass. They won't have to take my finger. If they get my fingerprint some other way, I can just switch to my next finger. And when I'm done, I can use PINs. I don't think it's mutability that matters. It's just that I leave fingerprints everywhere.
waboremo 4y ago
I'm pretty sure you can register the same finger over and over again for new "keys". Assuming you go through the tedious process of disabling, restarting, etc whatever each one of the underlying OS demands. It's an additional layer that Bitwarden (and other apps) do not get direct access to. So no excuse if you value convenience, PINs are not good. Short easy to remember and enter PINs are also the reason Apple is under fire due to how easily you can avoid biometrics and just use the 6 digit PIN.

mt360 4y ago

I wouldn't put too much faith in biometrics either, a real shame considering their convenience. https://blog.kraken.com/post/11905/your-fingerprint-can-be-hacked-for-5-heres-how/ https://blog.kraken.com/post/11905/your-fingerprint-can-be-h... Personally I advocate using BitWarden for commonly used logins that, if they were compromised, would not be catastrophic; perhaps in some cases because 2FA provides another, tautologically, factor, and KeePass secured with a FIDO2 device in challenge response mode, a passphrase, and possibly setting a higher key stretching work factor to further blunt any brute force attempt, in which more important data is held.

waboremo 4y ago
That's an absurd amount of effort to bypass fingerprint biometrics, nice. However, it's important to note here that biometrics isn't just about fingerprints and every OS handles their available biometrics options differently. For example, I would recommend face authentication on apple devices, however I would avoid using face for windows, and instead recommend a windows hello PIN (yes, it's handled differently than the PIN in the above article). Ultimately, you're just trying to create a balance between the layers of protection and reasonable attacks. There's only so much you can protect against, nobody can withstand someone who is cloning fingerprints, stealing devices, has access to your separate device 2FA, etc. without severely affecting their lifestyle.