Re:Bitwarden PINs can be brute-forced
by candiddevmike on Sunday March 19, 2023 @03:30PM
(#35222619)
While that may seem like a lot of iterations, in reality it doesn't take that much time at all, at least in my experience.
You could argue a security product shouldn't let folks set a PIN due to footguns like this and instead require something like WebAuthn for an "easier" login method.
> This brute-force will very likely be successful, since PINs are usually very low-entropy. Now, granted, the key derivation function is PBKDF2 with 100000 iterations (+ HKDF), but that won't help with a 4 digit pin.
It would be better to not have that feature at all, that convenience feature goes a bit too far. But nice to see that's the only thing they found, I'm sure they looked for more severe issues but found none.