I couldn't find any deep dive info about PIN management in Bitwarden. And I'm not able to read their code, not qualified enough.
Are there people around here who can explain how PIN protection works with Bitwarden browsers extensions?
When the vault is locked and you use your master key to unlock, I am confident no key is stored anywhere on your computer. So I'm fine with this but as my master password is strong it's very inconvenient to type it every time I open my web browser. This is when PIN code enters the scene.
I would like to understand how PIN works since I assume it is used to encrypt the master key stored on your computer. And this could be an issue for some. If it lowers the security level I would appreciate a warning from Bitwarden. So,
is the PIN mechanism used to encrypt the masterkey stored on your hard drive?
if so, do you know its encryption mechanism? Let's say someone steals the data at rest while my vault is locked, what does that thief need to find the password? Since PIN are way more simple than passwords to make them more convenient, I expect that mechanism to be bruteforce proof. And I'm not talking about the 5 attempts restriction directly in the browser extension, I mean real bruteforce on the stolen raw data.