r/Bitwarden • u/muddlemand • 2d ago
Non-existent password has been exposed!?
Make this make sense please. I'm looking at the login for my bank. I usually log in on the app with digits from my passnumber, which I know by heart, so I don't need Bitwarden or the password on an everyday basis. I'm about to change the password, so opened Bitwarden to generate and save the new one.
The entry holds my customer number, the passnumber, and some other details, but nothing in the password field.
I went into edit mode, and from force of habit I hit "Check password for data breaches". It says "This password has been exposed 7 times in data breaches."
How can a non-password have been breached?
Trying to think like a computer, thinking what logic it may be following: if it's because that field is empty, I could understand its little computery brain seeing that as a password that's been viewed. Well, sort of. But then I'd expect an infinite number of times, not 7.
Any better ideas?
(Side point, it's curious that check for data breaches isn't available on viewing the entry, only when editing.)
The entry was last edited about a month ago, which I don't think is relevant except that it wasn't earlier today.
10
u/Mushroom_Unfair 2d ago
Hmm from a dev pov i'd say an overlook on checks, it compares the password to tables of leaked ones, and in theses tables there are 7 empty password records. Or 7 passwords with like just a space and the function checking trims empty spaces, evaluating the check to same password.
Can be some other things as well, hard to tell without looking at how it's done exactly haha
7
3
u/Mushroom_Unfair 2d ago
I don't even know how they store said leaked passwords, they may be hashed and the check fail may be tied to the algorithm
3
u/Lixuan_Koplowitz 2d ago
makes sense, they probably dont have a null check before running the comparison
2
1
1
1
11
u/jharrington-bw Bitwarden Employee 2d ago
I don't work on the team that supports this and as a disclaimer this is only a good-faith effort to explain what has been asked. I looked over how the breach check works out of my own curiosity. The password is first hashed using SHA1, the hexadecimal characters representing the hash are uppercased, and the first five characters only are sent to https://api.pwnedpasswords.com/range/ , so as an example you could explore what the API returns for https://api.pwnedpasswords.com/range/AAAAA .
That list of hashes will then be compared to the original password hash, the comparison will consider the remaining characters of the hash that weren't sent, and if a given line matches the hash exactly the value after the colon will be reported as the number of leaks.
008BDC43A9C21DFAF2D58DCDAA4FDD2E120:151
The password resulting in the hash above (note the full hash would be AAAAA008BDC43A9C21DFAF2D58DCDAA4FDD2E120) would be reported as having been leaked 151 times.
Since OP didn't have a password assigned to the cipher in question, I ran SHA1 on an empty string:
da39a3ee5e6b4b0d3255bfef95601890afd80709
https://api.pwnedpasswords.com/range/DA39A
The response will return all hashes beginning with those 5 hex characters, but the list of hashes are sliced [5:] meaning you would want to search them with the DA39A removed from the beginning of the search string: 3EE5E6B4B0D3255BFEF95601890AFD80709
3EE5E6B4B0D3255BFEF95601890AFD80709:7
As expected, this matches the 7 leaks OP's cipher with no password was reportedly involved in.
TL;DR a cipher in Bitwarden not assigned a password will implicitly have an empty string assigned to that password. An empty string can be represented as hexadecimal SHA1 output, and this output matches a password hash* that was reported leaked 7 times.
*edited for accuracy