4 ms·

The PIN is not a password. Two very different concepts in what they're actually used for. The password to decrypt your password database isn't your actual pass

The PIN is not a password. Two very different concepts in what they're actually used for. The password to decrypt your password database isn't your actual password to the logins contained within, its just a part of the process to get it. The PIN to unlock a passkey isn't the credential itself. Its a part of the process to be able to use the credential. Meanwhile, an account password is the credential.

recursive 2y ago
They're secret sequences of characters that grant access. The rest is implementation details.
- vel0city 2y ago
  A bicycle and a semi-truck are both machines with rubber tires to move people and things a faster speed than walking. The rest is implementation details. X and Y are both Z. The rest is implementation details. Except sometimes "implementation details" makes the two pretty radically different in usage.
  - dambi0 2y ago
    And sometimes they don’t :)
  - recursive 2y ago
    A semi truck can carry dozens of tons of cargo. A bicycle can carry dozens of pounds of cargo. A PIN grants you access to the service. A credential grants you access to the service.
    - vel0city 2y ago
      > A PIN grants you access to the service Incorrect. The PIN does not grant access to the service. If all you have is the PIN, you don't get access to the service. Therefore, its not the PIN that grants the access. If you know my keepass database passphrase, but don't have the actual database file, do you have access to the services contained within? And as acdha mentioned, the entire login workflow is radically different with security keys / passkeys. Its a radically different implementation of authentication with different guarantees. Do you leave SSH open on port 22 with only password authentication? It's just the same as using SSH keys, just a difference in implementation.
      - recursive 2y ago
        > If all you have is the PIN, you don't get access to the service. That depends what the service is. If the "service" is a session on my desktop PC, then it absolutely does grant access. You'll have to take my word that if I type my PIN into it, it will start an interactive session. My kid wants to play minecraft, but he can't because he doesn't have the PIN. If he did have the PIN, he could play minecraft. I am willing to believe that the implementation of the PIN is totally different from passwords, but in this use case, the user experience is identical. The "attacker" does NOT need the password.
        vel0city 2y ago
        It is still not the PIN in the same way the password to the password vault isn't the password to an account. If you had a physical TPM that got removed, your pin wouldn't do anything. If the TPM got reset in the BIOS, the PIN wouldn't work. It's a step in the authentication workflow, but the PIN itself is not the credential. If a person tried to RDP to that computer with the PIN, they wouldn't be able to access it. If your kid fails the PIN too many times, the PIN gets disabled. No more PIN retries until the real password gets used. If they tried the password a bunch of times, they'd get a timeout but could come back in a few minutes and try again.
        recursive 2y ago
        I think maybe I get it now.
        vel0city 2y ago
        I mean, I get what you're saying about from the user perspective the pin is the login, but the under the hood nuance makes things pretty different in the end when thinking more about what's happening. Same thing with a fingerprint with a passkey to some service. The fingerprint itself isn't the login; you can't just go to any phone and press your finger and log in to the service. So the fingerprint isn't the login, its a part of the process on that particular device to unlock that particular saved credential that logs you in.
- acdha 2y ago
  Except in this case it’s really important to learn how the implementation works because it has meaningful differences: If you login to Google.com with a password, the remote server knows your password and if you are phished the attacker can use your password to access Google. If you login to Google.com using a passkey secured by Windows Hello, your PIN or biometric check is between you and your computer, and the passkey is used for a public key exchange with Google’s servers. They do not know your PIN and you cannot be phished. That’s a transformative change.
dambi0 2y ago
In some scenarios that’s really a difference without distinction though. If I have a key to my house attached to a chain so it can be used to open the door but not leave the property and then secure it in a lockbox. If someone steals the key to the lockbox they technically don’t have access to the house key but they can still rob my house
- vel0city 2y ago
  Your scenario makes it so the house key doesn't matter in the end though; if they're able to get to the lockbox to use the lockbox key they're already in the house and thus already able to rob it regardless of whether they got the lockbox key. In the end your door lock did nothing for you at all. I don't get how that relates to using a PIN stored in the TPM to protect your actual password, other than suggesting "well your account can be hacked without even touching your device" which I mean yeah sure. But in the end that PIN is still different from that Windows/Microsoft password. The PIN only works on that one device and gets totally invalidated after only a few failures. This is untrue of passwords which usually never get fully invalidated and are then used across multiple devices. If you manage to find out my PIN to log into device A with my Microsoft account is 1234, you don't have access to my Microsoft Account in general or on device B. If you see I log in to my device A with hunter42 (my Microsoft account password), you can now log in to my Microsoft account and every other device I'm using my Microsoft account. Is that a difference without distinction? I'd say that's quite a bit of distinction! And that's only one of the many differences!
  - dambi0 2y ago
    Which is why I was careful to say that it was a difference without distinction only in some scenarios. Namely offline attack to a physical device. In this scenario, even with the attempt restrictions the attacker has a couple of chances of relatively easy guesses, before falling back to the password protection. If we consider shoulder surfing, it’s a lot easier to distinguish a four or six digit PIN than a password. I aware the PIN doesn’t give actual access to credential and so doesn’t impact online attacks. But that isn’t the only scenario. Incidentally how much work is “in general” doing when you talk about the access Io Microsoft services granted by the PIN + TPM? It isnt zero access is it.

recursive 2y ago

They're secret sequences of characters that grant access. The rest is implementation details.

vel0city 2y ago
A bicycle and a semi-truck are both machines with rubber tires to move people and things a faster speed than walking. The rest is implementation details. X and Y are both Z. The rest is implementation details. Except sometimes "implementation details" makes the two pretty radically different in usage.
- dambi0 2y ago
  And sometimes they don’t :)
- recursive 2y ago
  A semi truck can carry dozens of tons of cargo. A bicycle can carry dozens of pounds of cargo. A PIN grants you access to the service. A credential grants you access to the service.
  - vel0city 2y ago
    > A PIN grants you access to the service Incorrect. The PIN does not grant access to the service. If all you have is the PIN, you don't get access to the service. Therefore, its not the PIN that grants the access. If you know my keepass database passphrase, but don't have the actual database file, do you have access to the services contained within? And as acdha mentioned, the entire login workflow is radically different with security keys / passkeys. Its a radically different implementation of authentication with different guarantees. Do you leave SSH open on port 22 with only password authentication? It's just the same as using SSH keys, just a difference in implementation.
    - recursive 2y ago
      > If all you have is the PIN, you don't get access to the service. That depends what the service is. If the "service" is a session on my desktop PC, then it absolutely does grant access. You'll have to take my word that if I type my PIN into it, it will start an interactive session. My kid wants to play minecraft, but he can't because he doesn't have the PIN. If he did have the PIN, he could play minecraft. I am willing to believe that the implementation of the PIN is totally different from passwords, but in this use case, the user experience is identical. The "attacker" does NOT need the password.
      - vel0city 2y ago
        It is still not the PIN in the same way the password to the password vault isn't the password to an account. If you had a physical TPM that got removed, your pin wouldn't do anything. If the TPM got reset in the BIOS, the PIN wouldn't work. It's a step in the authentication workflow, but the PIN itself is not the credential. If a person tried to RDP to that computer with the PIN, they wouldn't be able to access it. If your kid fails the PIN too many times, the PIN gets disabled. No more PIN retries until the real password gets used. If they tried the password a bunch of times, they'd get a timeout but could come back in a few minutes and try again.
        recursive 2y ago
        I think maybe I get it now.
        vel0city 2y ago
        I mean, I get what you're saying about from the user perspective the pin is the login, but the under the hood nuance makes things pretty different in the end when thinking more about what's happening. Same thing with a fingerprint with a passkey to some service. The fingerprint itself isn't the login; you can't just go to any phone and press your finger and log in to the service. So the fingerprint isn't the login, its a part of the process on that particular device to unlock that particular saved credential that logs you in.
acdha 2y ago
Except in this case it’s really important to learn how the implementation works because it has meaningful differences: If you login to Google.com with a password, the remote server knows your password and if you are phished the attacker can use your password to access Google. If you login to Google.com using a passkey secured by Windows Hello, your PIN or biometric check is between you and your computer, and the passkey is used for a public key exchange with Google’s servers. They do not know your PIN and you cannot be phished. That’s a transformative change.

dambi0 2y ago

In some scenarios that’s really a difference without distinction though. If I have a key to my house attached to a chain so it can be used to open the door but not leave the property and then secure it in a lockbox. If someone steals the key to the lockbox they technically don’t have access to the house key but they can still rob my house

vel0city 2y ago
Your scenario makes it so the house key doesn't matter in the end though; if they're able to get to the lockbox to use the lockbox key they're already in the house and thus already able to rob it regardless of whether they got the lockbox key. In the end your door lock did nothing for you at all. I don't get how that relates to using a PIN stored in the TPM to protect your actual password, other than suggesting "well your account can be hacked without even touching your device" which I mean yeah sure. But in the end that PIN is still different from that Windows/Microsoft password. The PIN only works on that one device and gets totally invalidated after only a few failures. This is untrue of passwords which usually never get fully invalidated and are then used across multiple devices. If you manage to find out my PIN to log into device A with my Microsoft account is 1234, you don't have access to my Microsoft Account in general or on device B. If you see I log in to my device A with hunter42 (my Microsoft account password), you can now log in to my Microsoft account and every other device I'm using my Microsoft account. Is that a difference without distinction? I'd say that's quite a bit of distinction! And that's only one of the many differences!
- dambi0 2y ago
  Which is why I was careful to say that it was a difference without distinction only in some scenarios. Namely offline attack to a physical device. In this scenario, even with the attempt restrictions the attacker has a couple of chances of relatively easy guesses, before falling back to the password protection. If we consider shoulder surfing, it’s a lot easier to distinguish a four or six digit PIN than a password. I aware the PIN doesn’t give actual access to credential and so doesn’t impact online attacks. But that isn’t the only scenario. Incidentally how much work is “in general” doing when you talk about the access Io Microsoft services granted by the PIN + TPM? It isnt zero access is it.