Question about security settings and consequence

[grb]

@paulsiu

Note that whether something is FUD or not should be a decision made by the reader.

Sure. I was just summarizing the community’s reaction when Ambiso’s claims first made the rounds of the online (in)security publications, back in March. To help you in your assessment of Brinkmann’s article for gHacks, I would point out that nowhere does he disclose that unlocking by PIN only becomes a vulnerability if the user deliberately disables the “Lock with master password on restart” safeguard (which is enabled by default), nor do his “Recommendations” at the end of the article include the obvious solution of re-enabling the option to “Lock with master password on restart” (or to not touch the default setting when enabling a PIN).

 

@paulsiu

when you chose not use master password on browser startup, the local vault gets encrypted with a key based on the email and pin,

This is inaccurate. It is the symmetric encryption key that gets encrypted using a stretched key derived (using the account’s KDF settings) from the PIN; the vault itself remains encrypted using the original symmetric key.

 

@paulsiu

I have some follow up question then, some were not answered by Ambiso’s post.

As I responded originally, I have limited knowledge of the biometrics implementation, as I do not use this option myself.

There was some relevant discussion about biometrics security in a recent update to one of your other threads:

Does bitwarden save master password in TPM

I only had a brief look at the biometrics update, and never really looked closely at the Windows code besides what was required to reimplement it for Linux. Still, how I understand it: Before the biometrics update the biometrics were just an access control.The symmetric master key was stored in the Windows keystore api. Now, a symmetric encryption key is derived from a signature created by the Windows hello API (which might internally use the TPM, but that would be windows internal, if it did)…

 
To your final question:

@paulsiu

My question is how does this mechanism works. If using a pin encrypt the vault using email address and pin, does never login means the vault sits on the drive unencrypted?

No, the local vault cache is always encrypted. However, when you select the option to Never lock, the symmetric encryption key itself is saved (unencrypted) in persistent storage on your device. As explained in @Quexten’s comment linked above, the symmetric encryption key is stored in the Windows keystore API, and available to anyone or any process logged in to your device as you.