1
00:00:00,020 --> 00:00:03,020
Your password for your computer, you just have to remember.

2
00:00:03,300 --> 00:00:07,440
But your password for your bank, if it's something you can remember, probably isn't good enough.

3
00:00:09,000 --> 00:00:16,560
If you've been hanging around the digital rights space long enough, you probably have heard about password managers and that they are a commonly suggested tool to keep you safer online.

4
00:00:16,960 --> 00:00:22,040
But which one should you use? Why does the underlying format matter? And how does it impact your safety?

5
00:00:22,220 --> 00:00:27,700
Today, I'm sitting down with Alex, the VP of Engineering at Strongbox, which is one of my favorite KeePass clients out there,

6
00:00:27,830 --> 00:00:33,680
to dig into what makes KeePass-based password management different, how Strongbox thinks about the tension between security and convenience.

7
00:00:34,000 --> 00:00:37,740
We talk about also the acquisition of Strongbox and what that looks like.

8
00:00:37,800 --> 00:00:43,840
Whether you're already a KeePass nerd or just trying to make a smarter choice about where your credentials live, this one's worth your time.

9
00:00:44,140 --> 00:00:44,800
Let's get into it.

10
00:00:45,060 --> 00:00:49,080
I'm Alex, the VP of Engineering over at Applause, who look after Strongbox.

11
00:00:49,460 --> 00:00:53,860
And if you're anything to do with Strongbox or you've been in our community, you'll probably

12
00:00:54,080 --> 00:00:57,780
seen Alex at Strongbox signing off most public facing things.

13
00:00:57,990 --> 00:01:03,680
I tend to look after the design of things, not just technically, but also the actual way

14
00:01:03,690 --> 00:01:04,420
it looks and feels.

15
00:01:04,739 --> 00:01:08,020
So all things Strongbox generally go via me.

16
00:01:08,500 --> 00:01:09,620
So I look after that.

17
00:01:09,920 --> 00:01:14,800
But also beyond that, I'm a massive fitness guy.

18
00:01:15,020 --> 00:01:18,360
I'm constantly trying to cram in runs and rowing whenever I can.

19
00:01:18,720 --> 00:01:20,980
And then I have a lot of my own apps.

20
00:01:21,400 --> 00:01:26,540
I make an app where you can just make your coffee experience better.

21
00:01:26,600 --> 00:01:30,120
So you can have like the absolute best coffee experience at home and a couple of others.

22
00:01:30,540 --> 00:01:35,100
And I speak at conferences too sometimes about usually things that aren't super technical.

23
00:01:35,380 --> 00:01:38,900
There's the odd technical thing about, you know, I spoke about foundational models last year.

24
00:01:39,500 --> 00:01:45,840
But I also prefer to talk about things like how can you actually get started doing iOS stuff?

25
00:01:46,040 --> 00:01:50,220
the name of the talk was something I probably shouldn't say without a sensor button but

26
00:01:50,710 --> 00:01:55,520
the whole concept was you know you can just build things and I did that before AI so I feel like I

27
00:01:55,580 --> 00:02:00,780
should probably do that one again now and try and say you can really build whatever you want now

28
00:02:01,100 --> 00:02:07,100
so I built a whole bunch of stuff and you know my main thing is just I really love making things

29
00:02:07,400 --> 00:02:11,980
for Apple platforms there's a little bit of Android here and there but generally all I want

30
00:02:12,000 --> 00:02:17,160
to do is make the best possible thing for Apple devices, whether that's a Vision Pro or a Mac.

31
00:02:18,920 --> 00:02:21,720
Yeah, it's funny. I've been recently getting more into coffee.

32
00:02:22,880 --> 00:02:29,380
And my starting point entryway has been the AeroPress. And so I've been doing some very,

33
00:02:30,300 --> 00:02:35,160
as more the advanced side of things of trying to do espresso, I know it's not really real espresso

34
00:02:35,340 --> 00:02:39,579
because it doesn't get anywhere near nine bars of pressure, but it's been something I've been

35
00:02:39,580 --> 00:02:43,320
doing a lot of things with, and it's been fun. And now I'm getting into more of the Espresso

36
00:02:43,500 --> 00:02:46,860
machines. Now, to get more into the password management side of things, which is why we're

37
00:02:46,940 --> 00:02:52,120
really here, I want to start by just kind of, you know, for somebody who has never heard of

38
00:02:52,260 --> 00:02:56,420
KeePass, which is kind of what enables Strongbox to exist. And I'm sure you're going to touch on

39
00:02:56,540 --> 00:03:01,720
that. What is a password manager to start off with? Why do you recommend it? Do you recommend

40
00:03:01,770 --> 00:03:06,299
it to everybody? And what are kind of the nuances and how you view password managers as a whole

41
00:03:06,320 --> 00:03:13,020
before we dive into your approach? Yeah. So I think the one-liner or probably a few more than

42
00:03:13,040 --> 00:03:19,620
that on what a password manager is, it's just the place where you store the important things that let

43
00:03:19,740 --> 00:03:26,200
you into other important things. So your password for your computer is something that you kind of

44
00:03:26,340 --> 00:03:30,760
just have to remember. But your password for your bank, if it's something you can remember,

45
00:03:31,180 --> 00:03:35,340
probably isn't good enough. So you probably want to keep that somewhere safe.

46
00:03:36,160 --> 00:03:41,200
And apps like Strongbox, OnePassword, there's dozens of these things.

47
00:03:42,060 --> 00:03:43,060
They help you do that.

48
00:03:43,190 --> 00:03:47,000
They make sure that your passwords are not only kept safe and you won't forget them,

49
00:03:47,190 --> 00:03:52,380
but that they're also good enough so that you don't have to worry about someone breaking in really quickly.

50
00:03:52,680 --> 00:03:58,220
There's plenty of password managers that will tell you don't use the same password across every different app that you have.

51
00:03:58,720 --> 00:04:03,779
But then you can go further and simple things like, you know, don't put your name in the password

52
00:04:04,160 --> 00:04:06,400
or don't make sure it's super short.

53
00:04:06,920 --> 00:04:09,120
Just put the work in to keep things safe

54
00:04:09,740 --> 00:04:14,360
because it's pretty common now to see a password get leaked

55
00:04:14,880 --> 00:04:18,019
or even just a whole company have a massive data breach.

56
00:04:18,070 --> 00:04:19,680
So it's more important than ever

57
00:04:20,180 --> 00:04:22,000
that you actually look after your passwords.

58
00:04:22,500 --> 00:04:25,740
It's happened to me multiple times in the past month

59
00:04:25,980 --> 00:04:28,100
where it's been some random old account I forgot about.

60
00:04:28,500 --> 00:04:29,880
And if I didn't have a password manager

61
00:04:30,700 --> 00:04:32,159
with unique passwords for everything

62
00:04:32,580 --> 00:04:34,820
that I can effectively not have to remember,

63
00:04:35,880 --> 00:04:38,420
I'd be in a lot of trouble and changing a lot of passwords.

64
00:04:38,740 --> 00:04:42,120
So it's a very useful tool that keeps you safe.

65
00:04:42,540 --> 00:04:45,500
And also nowadays probably saves you a lot more time

66
00:04:45,530 --> 00:04:47,740
than you'd think with changing passwords all the time.

67
00:04:48,680 --> 00:04:51,460
Yeah, and then I think maybe the three ways

68
00:04:51,560 --> 00:04:53,540
that people maybe see password management right now,

69
00:04:53,600 --> 00:04:55,380
we have kind of a browser-based password manager,

70
00:04:55,580 --> 00:04:57,440
which is maybe one of the most common,

71
00:04:57,530 --> 00:04:59,980
if not the most common way for still a lot of people to do it.

72
00:04:59,990 --> 00:05:01,440
So maybe we can speak to that.

73
00:05:02,060 --> 00:05:08,700
Also, maybe a more typical password manager, not to single anyone out, but something like LastPass, Dashlane, 1Password, etc.

74
00:05:09,480 --> 00:05:10,640
And then Strongbox.

75
00:05:11,040 --> 00:05:12,660
How do those three kind of all compare?

76
00:05:12,820 --> 00:05:16,020
Because they all take pretty fundamental approaches that are quite different from one another.

77
00:05:17,220 --> 00:05:23,280
Yeah, so I think the main thing people think about with a password manager is the surface they use to interact with it.

78
00:05:23,580 --> 00:05:28,480
So for me, generally, I'm auto-filling in Safari all day, every day.

79
00:05:29,000 --> 00:05:30,080
That's where I see it.

80
00:05:30,320 --> 00:05:34,300
It's very, very rare. I actually have to open my password manager.

81
00:05:34,980 --> 00:05:38,080
But I know for a lot of other people, that's absolutely not true.

82
00:05:38,460 --> 00:05:45,660
Their general way of working is that they open the password manager, grab the password of a two-factor code and copy and paste it in.

83
00:05:45,660 --> 00:05:47,220
And that's the way they prefer to do things.

84
00:05:48,080 --> 00:05:54,360
And most apps now, at least I guess the ones that most people can name, have covered all those surfaces.

85
00:05:54,980 --> 00:06:00,000
So they've gone out of their way to make sure there's browser extensions for Safari, Chrome, whatever it is.

86
00:06:00,520 --> 00:06:05,320
and then there's actual password managers that you can run on your phone or your Mac and everything

87
00:06:05,540 --> 00:06:10,200
syncs up really nicely. There's another branch of password managers which is a little bit more

88
00:06:10,340 --> 00:06:15,700
locked down in a way which is your browser generally will have one built in. For people on

89
00:06:15,790 --> 00:06:22,780
the Apple ecosystem if you're someone like me who refuses to use anything but Safari then you'll

90
00:06:22,900 --> 00:06:28,179
probably be using the same password manager that's also built into macOS and your phone and everything

91
00:06:28,200 --> 00:06:30,880
and it will feel really easy and intuitive.

92
00:06:31,300 --> 00:06:33,380
Whenever people use Chrome, Firefox,

93
00:06:33,860 --> 00:06:36,460
or any number of forks that kind of appear these days,

94
00:06:36,720 --> 00:06:38,740
they also have their own built-in thing.

95
00:06:39,140 --> 00:06:40,520
A lot of people don't actually realize

96
00:06:40,800 --> 00:06:42,400
they're using the one built into Chrome.

97
00:06:42,780 --> 00:06:44,960
They just see, you know, last used password,

98
00:06:45,560 --> 00:06:46,720
click it, and it goes in

99
00:06:47,260 --> 00:06:50,040
without realizing Chrome has a password manager built in.

100
00:06:50,360 --> 00:06:53,580
So there's our kind of branch of password manager,

101
00:06:53,800 --> 00:06:56,940
which is you own an app, you have all your passwords in it,

102
00:06:57,120 --> 00:06:58,620
and you can see them in multiple places.

103
00:06:59,380 --> 00:07:00,460
And then there are the other branches,

104
00:07:00,640 --> 00:07:03,440
like the ones built into Chrome and other browsers.

105
00:07:03,860 --> 00:07:08,380
And Strongbox is one of the ones that lives on your Mac or your phone

106
00:07:08,700 --> 00:07:11,000
or Vision Pro, if you fancy it.

107
00:07:11,540 --> 00:07:16,520
And you can still get to those passwords through Safari, Chrome, Firefox.

108
00:07:17,020 --> 00:07:18,360
The reason I like that approach,

109
00:07:18,600 --> 00:07:21,680
and why I generally recommend people pick a password manager like that,

110
00:07:21,800 --> 00:07:23,900
is it's something you can move all over the place.

111
00:07:24,080 --> 00:07:26,660
You're not locked down to a given browser.

112
00:07:27,360 --> 00:07:32,700
so if you're someone who uses the Chrome password manager a lot that's great but if you're using that

113
00:07:33,100 --> 00:07:38,040
and then you switch to an iPhone that experience gets really clunky really quickly whereas something

114
00:07:38,220 --> 00:07:43,080
like 1Password or Strongbox you just download the app and you're good to go you can get all your

115
00:07:43,190 --> 00:07:48,220
passwords everywhere. I'm a firm believer that your password shouldn't be tied to one thing that you

116
00:07:48,420 --> 00:07:54,899
use which is kind of where the key pass format comes in for us. If you use Strongbox your best

117
00:07:54,920 --> 00:07:59,880
experience, I believe, on Apple platforms is to stick with Strongbox and have your database in

118
00:07:59,980 --> 00:08:06,320
there. But say if you ditch Apple and you say, I want that pixel fold, I'm going to go grab myself

119
00:08:06,440 --> 00:08:12,380
a new Snapdragon laptop, then you can also move that database somewhere else. You can use a

120
00:08:12,640 --> 00:08:18,740
different KeePass compatible app, which means you're not stuck anywhere. And your passwords are,

121
00:08:19,200 --> 00:08:23,399
you know, they're your passwords. You own them. They live in a vault that is yours. And you're

122
00:08:23,420 --> 00:08:28,720
not stuck with clunky export processes or anything. You just open the vault somewhere else and you're

123
00:08:28,720 --> 00:08:33,820
good to go. I guess to kind of summarize a little bit of what you said there, the KeePass format is

124
00:08:33,940 --> 00:08:41,900
open source. It's meant to give you ownership of your passwords via a KDBX file format, kind of like

125
00:08:42,060 --> 00:08:47,400
a.zip on your computer, a.whatever. It's just a file. You can take it wherever. And then Strongbox

126
00:08:47,640 --> 00:08:52,279
would be the client in this case for Apple devices. Let's start with syncing. Contact Strongbox

127
00:08:52,580 --> 00:08:54,640
to this day is my favorite password manager.

128
00:08:55,310 --> 00:08:57,780
You guys hands down have the best UX UI

129
00:08:58,120 --> 00:08:59,360
that I've used for any password manager,

130
00:08:59,980 --> 00:09:00,800
especially on Apple devices.

131
00:09:01,530 --> 00:09:02,700
But I'm not using you anymore

132
00:09:02,870 --> 00:09:03,900
because I moved away from KeePass.

133
00:09:04,230 --> 00:09:06,140
So I still have that respect for you all,

134
00:09:06,240 --> 00:09:07,460
but I'm using ProtonPass recently

135
00:09:07,580 --> 00:09:08,600
just because I prefer the way that

136
00:09:08,890 --> 00:09:10,700
it just instantly syncs across all my devices.

137
00:09:11,340 --> 00:09:13,360
So can you speak to what syncing looks like

138
00:09:13,580 --> 00:09:14,800
and how you guys handle sync

139
00:09:15,360 --> 00:09:18,260
compared to what a traditional password manager might do,

140
00:09:18,420 --> 00:09:19,220
which is quite a bit different?

141
00:09:20,640 --> 00:09:25,200
Yeah, so sort of the key advantage of the key pass format can also be a bit of a drawback in a way,

142
00:09:25,420 --> 00:09:26,640
especially when it comes to syncing.

143
00:09:27,020 --> 00:09:31,120
With something like 1Password or ProtonPass, the way they work is,

144
00:09:31,440 --> 00:09:36,460
this is a best guess, but I built a lot of stuff, so I think I'm kind of on the right track.

145
00:09:36,820 --> 00:09:42,000
You have an account with them and they store your passwords in the cloud.

146
00:09:42,840 --> 00:09:47,460
So you're a user and you add in a password for apple.com

147
00:09:47,920 --> 00:09:50,160
and they have a record of your password for apple.com.

148
00:09:50,380 --> 00:09:55,580
If you change that password, if you edit the two factor, if you delete it, whatever you do,

149
00:09:55,890 --> 00:09:59,300
all they have to do is sync that one single password up and down.

150
00:09:59,600 --> 00:10:03,020
There's probably a local copy somewhere just to make sure it feels fast,

151
00:10:03,160 --> 00:10:07,540
but generally everything lives up here in the cloud and they just sync one thing at a time.

152
00:10:07,900 --> 00:10:13,460
Whereas something like Strongbox or other KeePass clients, generally the format is one file.

153
00:10:14,240 --> 00:10:16,820
And if you change one password, then we sync the file.

154
00:10:17,120 --> 00:10:22,380
You can do some clever stuff to make that a bit faster, but the difference is we have to sync the database.

155
00:10:22,770 --> 00:10:31,200
So the way we handle that in Strongbox to try and make it as easy as possible is we built our own system that uses iCloud in the background.

156
00:10:31,980 --> 00:10:33,820
And we handle all of that for you.

157
00:10:34,460 --> 00:10:40,980
And we get an experience in the end that is as close as we can get to the services where everything lives in the cloud.

158
00:10:41,560 --> 00:10:46,340
because we just handle the push and pull for you when you make a change or an edit or a delete or

159
00:10:46,620 --> 00:10:51,180
whatever you do. So it gets as close as we can to that. But it's one of the differences with,

160
00:10:51,480 --> 00:10:56,220
you know, a fully cloud-based option and something like this. Whilst we can let you export your

161
00:10:56,420 --> 00:11:00,420
entire database in one go or let you store it wherever you want with the other ones,

162
00:11:00,740 --> 00:11:05,840
they might have slightly faster syncing, but, you know, exporting a key pass file afterwards might be

163
00:11:06,160 --> 00:11:10,559
a bit of a pain. So there's definitely upsides and downsides to both. I quite like having an open

164
00:11:10,560 --> 00:11:14,960
format, but we think we've got pretty close on syncing to the other ones. And I'm sure there's

165
00:11:14,960 --> 00:11:19,660
a little bit more we can do, but Strongbox Sync is super reliable and we're super proud of it.

166
00:11:20,399 --> 00:11:24,620
Yeah. So I guess just to clarify what you're saying, because for those who aren't in the

167
00:11:24,660 --> 00:11:29,580
Apple ecosystem, Apple has its iCloud behind the scenes, which I think is something very underrated.

168
00:11:30,320 --> 00:11:33,600
Regardless if you're using advanced data protection, you're using end-to-end encryption.

169
00:11:33,820 --> 00:11:36,920
On any other ecosystem out there, I think Apple deserves more praise for this.

170
00:11:37,380 --> 00:11:39,780
If you're a developer, you have to spin up your own infrastructure.

171
00:11:39,880 --> 00:11:41,540
You have to have a server to handle syncing.

172
00:11:41,800 --> 00:11:44,360
There's no back end that you can easily hook into

173
00:11:44,880 --> 00:11:47,020
unless you build in third-party integrations through Google Drive

174
00:11:47,080 --> 00:11:47,860
or something like this.

175
00:11:47,880 --> 00:11:51,620
But with Apple, there's this world and ecosystem of applications

176
00:11:51,840 --> 00:11:53,060
that are completely serverless.

177
00:11:53,300 --> 00:11:57,420
We have really top-tier apps like Flighty that don't have a server.

178
00:11:58,520 --> 00:11:59,920
Really, they don't hold your data.

179
00:12:00,380 --> 00:12:01,460
It's just synced through iCloud.

180
00:12:01,700 --> 00:12:05,140
And so it's this really nice funnel to get away from maybe,

181
00:12:05,500 --> 00:12:07,340
it's kind of like a lot of things I guess Apple does

182
00:12:07,360 --> 00:12:11,100
of raises the baseline, but it's never maybe going to be the best thing ever. Like it's not going to

183
00:12:11,100 --> 00:12:15,240
be better than like an end to end encrypted proton drive maybe from like a privacy security angle,

184
00:12:15,400 --> 00:12:20,420
but it's nice. So that's a bit of a side tangent. Where I'm headed with this is...

185
00:12:20,420 --> 00:12:24,060
No, I was just going to quickly say, I actually think it's not necessarily a side thing. It's

186
00:12:24,080 --> 00:12:30,660
actually quite important that the way we use it and the way basically every app uses it means we

187
00:12:30,680 --> 00:12:39,300
We can't see your stuff. We can see how many records are in our like global database, but we can't see anything about them.

188
00:12:39,560 --> 00:12:43,460
We can't like download the file. We don't have access to that. That's still your private database.

189
00:12:43,920 --> 00:12:49,320
So even though iCloud is linked to you and using your usage, we can't do anything with it.

190
00:12:49,840 --> 00:12:53,420
It's all yours and you're locked in. Whereas with another cloud solution.

191
00:12:53,420 --> 00:12:56,820
I assume you guys are serverless when it comes to user data.

192
00:12:57,900 --> 00:13:06,000
Yeah, we have one tiny serverless function, which is open source, which we use to send requests to the have I been pwned API.

193
00:13:06,600 --> 00:13:09,940
Otherwise, nothing is on a back end tied to us whatsoever.

194
00:13:10,500 --> 00:13:12,180
It's all just straight through iCloud.

195
00:13:12,640 --> 00:13:12,820
Yeah.

196
00:13:13,090 --> 00:13:14,220
So can you expand on syncing?

197
00:13:14,360 --> 00:13:18,260
So this actually gets to the core of why I eventually stopped using Strunkbox.

198
00:13:18,260 --> 00:13:19,680
And it's nothing that you guys are doing wrong.

199
00:13:20,140 --> 00:13:24,980
It's actually the standard you set for key pass clients is higher than any other key pass client.

200
00:13:25,640 --> 00:13:27,520
And I'm not only in the Apple ecosystem.

201
00:13:28,160 --> 00:13:30,560
I'm using Android devices, I do review devices,

202
00:13:30,880 --> 00:13:31,560
sometimes I'm on Linux.

203
00:13:32,280 --> 00:13:34,260
And so for me, what I started to find was,

204
00:13:34,440 --> 00:13:36,500
okay, I love Strongbox when I'm on an Apple device.

205
00:13:36,920 --> 00:13:38,380
It's actually my favorite password manager.

206
00:13:38,520 --> 00:13:39,840
But then I move over to something else

207
00:13:39,920 --> 00:13:42,200
and I have to deal with a really crappy KeyPass client

208
00:13:42,380 --> 00:13:42,980
that doesn't work well.

209
00:13:43,280 --> 00:13:45,460
Is that a gap that you guys are trying to close?

210
00:13:45,780 --> 00:13:48,560
And also, there is still syncing that you can do.

211
00:13:48,600 --> 00:13:50,620
So do you mind speaking about syncing away

212
00:13:50,920 --> 00:13:52,860
from an Apple ecosystem with Strongbox?

213
00:13:53,240 --> 00:13:58,620
And also, how do people juggle with that inconsistency between keypass clients?

214
00:14:00,100 --> 00:14:01,980
So there's kind of two parts to it.

215
00:14:01,980 --> 00:14:09,260
The first thing is syncing when we do it on Apple is we have our own custom system to sync to iCloud.

216
00:14:09,650 --> 00:14:15,720
And we do that because the old way of doing it was you would just store your keypass file in iCloud Drive.

217
00:14:16,180 --> 00:14:22,560
And if you've ever used iCloud Drive and tried to sync stuff between devices and wanted that kind of instant update,

218
00:14:22,900 --> 00:14:25,080
you very quickly realize that doesn't always happen.

219
00:14:25,580 --> 00:14:26,920
There's a lot more going on there.

220
00:14:27,220 --> 00:14:29,260
It's not like, you know, I save a file

221
00:14:29,290 --> 00:14:31,080
and it's instantly available on another computer.

222
00:14:31,720 --> 00:14:33,500
There's like more of a delay than you'd like.

223
00:14:33,840 --> 00:14:35,400
Or sometimes my battery's low

224
00:14:35,410 --> 00:14:37,260
and it doesn't sync properly and things like that.

225
00:14:37,260 --> 00:14:39,360
So we built our own wrapper to use iCloud

226
00:14:39,510 --> 00:14:41,820
and CloudKit directly so that we don't have to

227
00:14:42,260 --> 00:14:43,280
handle those issues.

228
00:14:43,410 --> 00:14:44,560
We fix them all for people.

229
00:14:44,790 --> 00:14:45,360
So it's seamless.

230
00:14:45,700 --> 00:14:47,240
Now we've recreated that same experience

231
00:14:47,680 --> 00:14:50,040
for Dropbox and Google Drive.

232
00:14:50,760 --> 00:14:55,560
And there's other third-party options, like you can use WebDAV if you have your own server somewhere.

233
00:14:55,690 --> 00:14:58,400
And a lot of cloud places are WebDAV compatible.

234
00:14:58,630 --> 00:14:59,720
So you can use other solutions.

235
00:15:00,230 --> 00:15:03,280
And we've made that as seamless as we can with other places.

236
00:15:03,780 --> 00:15:14,740
The sort of downside is we can do all the work we want to make sure that Strongbox always keeps up to date, pushes and pulls the latest version as fast as possible.

237
00:15:15,300 --> 00:15:19,240
But we're also then dependent on third-party people.

238
00:15:19,800 --> 00:15:26,480
You know, if we ask, say, Dropbox to sync, we're not as in control on making sure that actually happens as we expect.

239
00:15:26,880 --> 00:15:28,940
So we've tested it a heck of a lot.

240
00:15:29,210 --> 00:15:32,400
We know it works really well, but there's an extra party involved there.

241
00:15:32,610 --> 00:15:35,080
And we don't see any issues with iCloud sync.

242
00:15:35,150 --> 00:15:39,160
But every now and again, there'll be someone who says that the Dropbox is a little slow or something.

243
00:15:39,640 --> 00:15:47,240
And the sort of the next part in that pipeline where things can change is we have, whilst KeePass is a common open format,

244
00:15:47,600 --> 00:15:52,360
it defines how you open a database and how stuff looks inside it.

245
00:15:52,540 --> 00:15:54,820
It's not really a standard for how the app has to be.

246
00:15:55,080 --> 00:16:00,660
Once you've opened that file, you can kind of just do what you want and still be, you know, KeePass compatible.

247
00:16:01,080 --> 00:16:08,720
So people write in, I'd say I'm up to like a dozen times a day asking if I'm going to do Android or Windows

248
00:16:09,180 --> 00:16:10,460
because they say like they love it.

249
00:16:10,660 --> 00:16:13,460
They have cross-platform sync working and they think it's great.

250
00:16:13,760 --> 00:16:18,640
But then the experience falls apart when they use another app that, say, doesn't save the

251
00:16:18,740 --> 00:16:19,640
databases frequently.

252
00:16:20,060 --> 00:16:24,200
So the database gets out of sync or it doesn't handle syncing conflicts, which, you know,

253
00:16:24,300 --> 00:16:26,460
in the real world, syncing conflicts are going to happen.

254
00:16:26,880 --> 00:16:28,840
One of your databases will be offline for a bit.

255
00:16:28,930 --> 00:16:30,260
You might be on a train or something.

256
00:16:30,580 --> 00:16:31,300
It just happens.

257
00:16:31,880 --> 00:16:34,900
So that's where things can sometimes fall apart a bit.

258
00:16:35,380 --> 00:16:37,720
And it's something that we want to improve.

259
00:16:38,120 --> 00:16:43,840
The challenge there is trying to make sure we give people the best possible experience on our side

260
00:16:44,220 --> 00:16:48,740
and try to work around issues with other password managers that we might be able to see coming.

261
00:16:49,060 --> 00:16:52,200
So if we find out there's a bug in a really popular Android client,

262
00:16:52,490 --> 00:16:56,280
we can try and work around that and build some UX for, you know, maybe we need to improve syncing

263
00:16:57,040 --> 00:17:01,700
or just give people a warning that it was last updated and it doesn't look like anything changed.

264
00:17:02,020 --> 00:17:04,079
There's a couple of things we can do to improve that.

265
00:17:04,280 --> 00:17:08,079
But the end game thing would be to run on Windows and Android.

266
00:17:08,480 --> 00:17:11,079
But it's a really big task.

267
00:17:11,400 --> 00:17:13,260
One I'd love to do, but it's...

268
00:17:13,260 --> 00:17:15,500
Strongbox was a labor of love for many years.

269
00:17:15,990 --> 00:17:18,240
A Windows and Android client would be exactly the same.

270
00:17:18,920 --> 00:17:20,240
Especially because it's a native app.

271
00:17:20,270 --> 00:17:24,260
So you'd probably have to build other native apps for every other platform and then maintain those.

272
00:17:25,360 --> 00:17:26,819
I assume you couldn't move over to a framework.

273
00:17:27,520 --> 00:17:31,700
I think that's the main thing that stops it being something where I can just say,

274
00:17:31,860 --> 00:17:35,460
yeah, we'll kick this off next week is because we're fully native,

275
00:17:35,820 --> 00:17:39,260
which is part of why Strongbox feels so great on your phone and on your Mac.

276
00:17:39,460 --> 00:17:41,820
We stay true to how Apple does things.

277
00:17:41,930 --> 00:17:43,860
We use their components as much as we can.

278
00:17:44,260 --> 00:17:45,380
Some things we have to do custom,

279
00:17:45,490 --> 00:17:48,120
but we try and make sure it feels at home on your device.

280
00:17:49,180 --> 00:17:52,160
And that then means not too much is reusable

281
00:17:52,980 --> 00:17:54,560
if we port it over to a different platform.

282
00:17:54,870 --> 00:17:56,420
We have a little bit here and there,

283
00:17:56,600 --> 00:17:58,760
and the format itself is transformable,

284
00:17:59,060 --> 00:18:05,600
But all the things we have around it that make Strongbox feel great is something that would have to be fully redone for another app.

285
00:18:05,960 --> 00:18:11,700
And I think getting to the level of craft we want with a cross-platform tool would be quite a challenge.

286
00:18:12,000 --> 00:18:14,280
So, yeah, definitely the old school way, I think.

287
00:18:14,480 --> 00:18:15,520
And also never say never.

288
00:18:15,940 --> 00:18:17,240
It's something that comes up a lot.

289
00:18:17,420 --> 00:18:21,920
And I'm noticing it's starting to ramp up a lot since recent changes to other password managers.

290
00:18:22,220 --> 00:18:24,180
So I'm sure that space will improve.

291
00:18:24,540 --> 00:18:33,880
I'd like to hope we might be the ones who kind of push it forward a little bit or, you know, even people see what we've done on iOS and take that as a direction to be like, OK, this is the standard.

292
00:18:33,990 --> 00:18:35,160
We have to at least be this.

293
00:18:35,440 --> 00:18:39,020
But I'm hopeful something springs up, whether it's us or someone else.

294
00:18:39,210 --> 00:18:41,880
I want the ecosystem to thrive as best as possible.

295
00:18:41,990 --> 00:18:46,860
And a Windows Android client that looks great and feels great is kind of the next step, I think.

296
00:18:47,200 --> 00:18:47,820
Yeah, I agree.

297
00:18:48,040 --> 00:18:50,160
And, you know, I'm a big fan of KeePassXC.

298
00:18:50,270 --> 00:18:51,540
Like, they're on our resources.

299
00:18:51,740 --> 00:18:53,380
So it's not to say I don't appreciate these projects,

300
00:18:53,540 --> 00:18:56,540
but I do think just the UI, UX between the different services

301
00:18:56,660 --> 00:18:57,200
is just different.

302
00:18:57,600 --> 00:18:59,220
I think some people that are listening to this

303
00:18:59,220 --> 00:19:00,580
might actually prefer KeePassXC.

304
00:19:00,880 --> 00:19:03,320
But the fact that there aren't options to pick

305
00:19:03,760 --> 00:19:07,540
a Strongbox-esque UI, even if it's not from you guys,

306
00:19:07,700 --> 00:19:09,600
I think that's what needs to happen,

307
00:19:09,760 --> 00:19:11,760
is filling in those gaps to those different styles of users.

308
00:19:12,000 --> 00:19:14,860
A couple of more technical things on the syncing,

309
00:19:14,960 --> 00:19:16,320
and then I have more technical questions

310
00:19:16,520 --> 00:19:17,620
that are not syncing-related.

311
00:19:17,860 --> 00:19:20,820
I assume because you allow any kind of third-party cloud provider,

312
00:19:21,060 --> 00:19:24,920
you could sync like Nextcloud so you can use Strongbox and then use it with Nextcloud with

313
00:19:24,940 --> 00:19:29,500
any other keypass? Yep, Nextcloud is super common. It's one of the things I get asked about quite

314
00:19:29,700 --> 00:19:34,480
often. It seems like people are using it for syncing cross-platform, especially when they don't want to

315
00:19:34,880 --> 00:19:39,480
offload to other services. You know, a really common thing that comes up recently is people,

316
00:19:39,860 --> 00:19:44,700
they love Google Drive and Dropbox, but they're trying to move away from those providers. So they

317
00:19:44,860 --> 00:19:49,899
then ask, you know, how can I use like WebDAB, SFTP, and so on. And Nextcloud seems to be sort of

318
00:19:49,920 --> 00:19:51,100
the most popular option right now.

319
00:19:51,480 --> 00:19:53,060
Shortly followed by people requesting

320
00:19:53,180 --> 00:19:54,340
that we support ProtonDrive,

321
00:19:54,800 --> 00:19:56,620
which we are looking at right now,

322
00:19:56,940 --> 00:19:57,900
which I think will be super cool.

323
00:19:58,240 --> 00:19:59,520
Wow, that'd be really awesome.

324
00:19:59,840 --> 00:20:00,960
And then another question,

325
00:20:01,100 --> 00:20:01,960
you guys released a phone,

326
00:20:02,040 --> 00:20:03,440
like this was on the tail end

327
00:20:03,480 --> 00:20:04,880
of when I was still using Strongbox,

328
00:20:05,080 --> 00:20:06,960
you guys released a Wi-Fi sync feature.

329
00:20:07,180 --> 00:20:09,880
Do you mind expanding on why and how that works?

330
00:20:10,280 --> 00:20:13,840
So I think Wi-Fi sync is the sort of useful solution

331
00:20:13,880 --> 00:20:16,400
for people who want to keep things in sync

332
00:20:17,200 --> 00:20:19,880
between their Mac and their iPhone and their iPad

333
00:20:19,880 --> 00:20:23,100
but they don't really want any of this stuff to live on the cloud.

334
00:20:23,560 --> 00:20:26,820
So the way Wi-Fi sync works is you pick a host device,

335
00:20:27,240 --> 00:20:29,580
which is usually your Mac that stays on,

336
00:20:29,900 --> 00:20:33,400
and then everything else pushes and pulls to that central computer.

337
00:20:33,900 --> 00:20:36,980
So it gives you a cloud-feeling experience

338
00:20:37,360 --> 00:20:39,120
without having to put anything on the cloud.

339
00:20:39,500 --> 00:20:41,660
So if you're worried about that, you don't have to think about it.

340
00:20:41,780 --> 00:20:45,480
You just have it all locally, and then it's completely up to you what you do.

341
00:20:46,020 --> 00:20:46,260
Very nice.

342
00:20:46,500 --> 00:20:49,960
Is there a way to somehow integrate a NAS into this workflow at any point?

343
00:20:50,240 --> 00:20:54,660
So usually the way people use NAS is they just set up WebDAB or SFTP.

344
00:20:55,020 --> 00:20:58,880
So part of the reason we have those is most NASs will support that.

345
00:20:59,180 --> 00:21:02,260
So you can just hook that up and point it to the file and go from there.

346
00:21:02,460 --> 00:21:07,160
I help a lot of people who grab some random NAS from Amazon get up and running.

347
00:21:07,340 --> 00:21:13,100
And it can be quite a cool way to do it where you don't have to rely on having a Mac or an iPad or something that's on all the time.

348
00:21:13,200 --> 00:21:16,760
you can still have that really nice sync experience at home.

349
00:21:17,180 --> 00:21:17,600
Very nice.

350
00:21:18,040 --> 00:21:19,200
This is a more technical question,

351
00:21:19,240 --> 00:21:21,920
and I'm actually still not clear on the details here.

352
00:21:22,380 --> 00:21:24,680
So Apple released Advanced Data Protection ADP.

353
00:21:24,980 --> 00:21:28,280
It's opt-in and encryption in the iCloud ecosystem

354
00:21:28,380 --> 00:21:31,160
for everything except calendar, email, and contacts.

355
00:21:31,560 --> 00:21:33,600
But apparently there's this nuance

356
00:21:34,060 --> 00:21:37,420
that third-party developers have to actually opt into

357
00:21:37,760 --> 00:21:40,480
somehow using ADP for users who have it enabled.

358
00:21:40,500 --> 00:21:43,180
So theoretically, even if you have ADP enabled

359
00:21:43,200 --> 00:21:47,320
iCloud account. It doesn't mean that every app developer who's publishing data to iCloud Drive

360
00:21:47,400 --> 00:21:52,060
is going to be utilizing ADP. A, I don't know if you know anything about this, if it's true,

361
00:21:52,500 --> 00:21:58,960
and then how you guys handle that. So there is some nuance to it, especially more so because

362
00:21:59,260 --> 00:22:03,720
it's not a feature that necessarily came on and then stayed on. Some countries said no to it,

363
00:22:03,880 --> 00:22:10,520
and then some apps supported it. I think I would quite like end-to-end encryption in my iCloud,

364
00:22:10,760 --> 00:22:11,900
but I'm not allowed it, sadly.

365
00:22:12,240 --> 00:22:17,000
So we do have file protection enabled locally.

366
00:22:17,580 --> 00:22:24,600
And my understanding is that we don't have to do anything different on the cloud to enable that.

367
00:22:24,820 --> 00:22:28,700
But I'm sure there is some nuance with this.

368
00:22:29,020 --> 00:22:34,580
The part that might be a bit different with apps you've looked at is we're using CloudKit for everything,

369
00:22:35,000 --> 00:22:36,040
for Strongbox Sync anyway.

370
00:22:36,300 --> 00:22:40,160
So it might not have the same, I guess, nuance to it.

371
00:22:40,380 --> 00:22:41,060
it's probably okay.

372
00:22:41,210 --> 00:22:41,380
I see.

373
00:22:41,710 --> 00:22:44,200
And either way, I think the database file itself is encrypted.

374
00:22:44,440 --> 00:22:47,160
So this is more of a very nitpicky nuance

375
00:22:47,310 --> 00:22:48,180
that I was just curious about.

376
00:22:48,820 --> 00:22:50,800
It's definitely, you know, it's a question people,

377
00:22:51,320 --> 00:22:53,180
people come to us with these things quite often.

378
00:22:53,250 --> 00:22:54,620
Like I think it's important to check.

379
00:22:55,040 --> 00:22:55,140
Yeah.

380
00:22:55,490 --> 00:22:57,680
Now I want to get a little bit more technical now

381
00:22:57,710 --> 00:23:00,460
in this section on features itself inside of Strongbox.

382
00:23:00,600 --> 00:23:01,540
So moving away from the syncing.

383
00:23:01,670 --> 00:23:02,860
You mentioned people are moving away

384
00:23:03,260 --> 00:23:04,160
from other password managers,

385
00:23:04,860 --> 00:23:07,740
or even you have requests for Nextcloud, ProtonDrive.

386
00:23:08,360 --> 00:23:11,300
So I want to ask, what's kind of the target demographic that you see?

387
00:23:11,340 --> 00:23:13,020
I know it's probably more than one person,

388
00:23:13,160 --> 00:23:17,240
but do you have a general list of people that you feel like are drawn to what you're doing?

389
00:23:17,760 --> 00:23:22,260
I think we're trying to change that at the moment.

390
00:23:22,820 --> 00:23:27,880
So Strongbox is super well known within the KeePass community

391
00:23:28,180 --> 00:23:30,940
and people who even just know what KeePass is.

392
00:23:31,260 --> 00:23:33,280
And that's kind of been our user base.

393
00:23:33,620 --> 00:23:37,039
We get a lot of people who come to us from the app store

394
00:23:37,040 --> 00:23:42,280
who just search password manager and find us and they don't know what KeePass is and they're just

395
00:23:42,380 --> 00:23:47,200
like this looks great I'll give it a go but I'd say our primary audience generally has been just

396
00:23:47,560 --> 00:23:53,240
people who care about KeePass or they just want a great password manager. Now the thing that I'm

397
00:23:53,400 --> 00:24:02,259
trying to kind of change right now is how do I get the experience to be fantastic for people who don't

398
00:24:02,280 --> 00:24:07,160
care about keypests. And that doesn't mean I don't care about keypests, but I mean that some people

399
00:24:07,720 --> 00:24:14,600
probably don't want to see vault file names and where it's stored. There's a good amount of people

400
00:24:14,740 --> 00:24:19,620
who just open an app like this and they want to just start putting passwords in, which is the

401
00:24:19,800 --> 00:24:24,240
experience you get with cloud-based password managers a lot of the time. You make an account,

402
00:24:24,510 --> 00:24:29,820
you download some sort of secret PDF to break you back in if you need to, and then you just get going.

403
00:24:30,160 --> 00:24:32,600
and there's not really any complexity to it.

404
00:24:32,800 --> 00:24:34,380
So I'm trying to broaden our horizons

405
00:24:34,580 --> 00:24:37,160
and get more people involved in Strongbox

406
00:24:37,320 --> 00:24:39,960
by improving that experience of people who want it,

407
00:24:40,200 --> 00:24:42,620
which kind of gets me to the audience

408
00:24:42,760 --> 00:24:44,620
or just anyone in the Apple ecosystem

409
00:24:44,820 --> 00:24:46,140
who wants a good password manager,

410
00:24:46,500 --> 00:24:48,740
which sounds crazy broad, but that's the ambition,

411
00:24:49,120 --> 00:24:50,560
is we think we are up there

412
00:24:50,720 --> 00:24:52,800
with the best password managers in the Apple space.

413
00:24:53,240 --> 00:24:55,080
And I just want more people to find us

414
00:24:55,360 --> 00:24:56,880
and have a great experience when they get here,

415
00:24:57,000 --> 00:24:57,760
even if you're not technical.

416
00:24:58,260 --> 00:24:59,280
Yeah, again, I'm biased,

417
00:24:59,560 --> 00:25:01,340
but I really meant what I said earlier.

418
00:25:01,730 --> 00:25:03,220
Of all the password managers I've used,

419
00:25:03,820 --> 00:25:05,560
it's my favorite UI UX experience.

420
00:25:06,080 --> 00:25:07,980
Everything, it was just really well designed.

421
00:25:08,060 --> 00:25:09,680
Very simple, but you can still find

422
00:25:09,730 --> 00:25:11,220
all the complexity and advanced features.

423
00:25:11,560 --> 00:25:13,260
The only thing I didn't like, actually,

424
00:25:13,690 --> 00:25:14,680
also, now thinking about it,

425
00:25:14,710 --> 00:25:16,460
which is an important thing, Autofill.

426
00:25:17,060 --> 00:25:19,900
So on iOS, Autofill is just phenomenal.

427
00:25:20,140 --> 00:25:21,740
Something else Apple doesn't get enough credit for,

428
00:25:21,820 --> 00:25:24,260
because on Android, Autofill is just a complete mess.

429
00:25:24,720 --> 00:25:26,680
To get a password manager going on Android,

430
00:25:26,730 --> 00:25:29,520
you have to give three really critical permissions

431
00:25:29,520 --> 00:25:32,580
like accessibility that lets the password manager do literally anything on your phone.

432
00:25:32,670 --> 00:25:35,240
On iOS, it's all the same access that Apple has.

433
00:25:35,250 --> 00:25:39,280
It's one of the rare scenarios where Apple chose not to use their crazy ecosystem leverage.

434
00:25:39,510 --> 00:25:43,220
And so you're going to work through the same ecosystem that Apple uses for their own password

435
00:25:43,320 --> 00:25:44,920
manager keychain, and I guess now passwords.

436
00:25:45,210 --> 00:25:47,820
But on macOS, it's a little bit different, especially if you're not using Safari.

437
00:25:48,190 --> 00:25:51,920
I struggled a little bit using Strongbox with something like Brave, Firefox, etc.

438
00:25:52,310 --> 00:25:56,680
So do you mind speaking a little bit to Autofill, how you guys handle this, and how this looks

439
00:25:56,780 --> 00:25:57,700
like on third-party browsers?

440
00:25:57,860 --> 00:26:03,760
There's some notice in the settings about like bug Apple to allow this in third party browsers or something.

441
00:26:03,980 --> 00:26:06,800
But I don't remember if I'm remembering that right.

442
00:26:08,660 --> 00:26:11,420
If we did have a warning, it's definitely not in there now.

443
00:26:11,740 --> 00:26:13,680
Now we have a Chrome extension.

444
00:26:14,940 --> 00:26:27,540
But to give a bit of context, I guess the thing that makes Autofill so great on iPhone and Mac is they both use the same system where we can just tell Apple locally.

445
00:26:27,640 --> 00:26:34,080
hey we have a password for this website. So you go to apple.com and that little box comes up and

446
00:26:34,440 --> 00:26:38,460
this is the reason you see if you have multiple password managers installed or the Apple one set

447
00:26:38,460 --> 00:26:42,960
up you'll see a bunch of stuff in there and it's not just Apple's password manager. Any app that

448
00:26:43,140 --> 00:26:50,220
can write to this can say hey I have a password for this. Now that is really great if you stick to

449
00:26:50,240 --> 00:26:58,320
Apple. The downside is that's not something Chrome gets exposed to. I'm honestly not super sure whose

450
00:26:58,380 --> 00:27:04,200
fault that is because I'm pretty sure if certain browsers tagged fields a certain way it would

451
00:27:04,460 --> 00:27:10,700
actually work but I don't think they want to do that. But there's a way around it which is to build

452
00:27:11,080 --> 00:27:17,260
your own equivalent to what Apple has. So Apple's system where we tell it hey we have a password for

453
00:27:17,280 --> 00:27:23,940
this. We can do the same thing ourselves. There's a lot more work involved but that's why we are

454
00:27:24,100 --> 00:27:29,840
usable on Chrome, Firefox and so on is that we built our own version of that system and a custom

455
00:27:30,140 --> 00:27:35,900
extension. There's a little bit more nuance to how it works in that Safari's is very light touch. We

456
00:27:36,080 --> 00:27:42,180
don't say anything like present a little pop-up on this text field. What we do in Safari is just

457
00:27:42,200 --> 00:27:47,520
tell it we have passwords whereas in Chrome it's a little bit more complex we have to check is there

458
00:27:47,520 --> 00:27:52,920
a password field on the page where is it do we have a password for this domain and it's a bit more

459
00:27:53,360 --> 00:27:58,800
of us proactively doing something than the system just taking over so a little bit more complicated

460
00:27:59,220 --> 00:28:05,720
and also then results in interesting things like certain websites might decide to tweak their UI

461
00:28:06,030 --> 00:28:11,220
and potentially break autofill for like every password manager which I've seen reasonably often

462
00:28:11,240 --> 00:28:13,660
where I've been told that a website doesn't work.

463
00:28:13,840 --> 00:28:15,960
And then I check a bunch of different providers

464
00:28:16,140 --> 00:28:18,520
and realize that a website has broken it for everyone.

465
00:28:19,100 --> 00:28:20,040
And then I'll open it in Safari

466
00:28:20,420 --> 00:28:21,460
and it'll work perfectly fine.

467
00:28:21,800 --> 00:28:23,280
So it's a little bit more complex

468
00:28:23,540 --> 00:28:25,120
and all very, very custom,

469
00:28:25,500 --> 00:28:26,960
but it's a part of the experience

470
00:28:27,340 --> 00:28:31,280
that we're right now trying to improve quite dramatically.

471
00:28:32,100 --> 00:28:34,700
So our Chrome extension works pretty well,

472
00:28:35,320 --> 00:28:38,200
but I think it can also look a lot better

473
00:28:38,500 --> 00:28:40,360
and more importantly, feel a lot better.

474
00:28:40,520 --> 00:28:46,680
I think it can be way slicker. And at the same time as that, we can also make it a little bit

475
00:28:46,780 --> 00:28:51,900
more reliable on websites that do things a bit differently. So places where the password field

476
00:28:52,360 --> 00:28:57,020
doesn't get exposed as a password field, we can work around that. A good example would be there's

477
00:28:57,060 --> 00:29:02,120
a couple of login forms on Reddit where the password field doesn't show up as a password

478
00:29:02,280 --> 00:29:07,480
field. It's just not tagged correctly at all. And some very strange things happen all across the web

479
00:29:07,500 --> 00:29:10,000
with how people embed signup forms

480
00:29:10,220 --> 00:29:12,260
or whatever crazy tech they're using.

481
00:29:12,600 --> 00:29:14,260
And we can work around all of that.

482
00:29:14,540 --> 00:29:16,420
And it's something that we're working on now

483
00:29:16,660 --> 00:29:20,480
because we're quite aware that the Chrome extension is good,

484
00:29:21,120 --> 00:29:23,860
but it's a part where the experience can fall down.

485
00:29:24,040 --> 00:29:26,180
If that's your only touch point of Strongbox,

486
00:29:26,380 --> 00:29:28,600
it's not quite as good as the rest of the app.

487
00:29:29,020 --> 00:29:31,040
So definitely some work to do there, I think.

488
00:29:31,620 --> 00:29:33,360
But it is something we're aware of.

489
00:29:33,520 --> 00:29:33,920
Got it.

490
00:29:34,100 --> 00:29:35,040
So I'm going to ask,

491
00:29:35,140 --> 00:29:37,160
because I know a lot of people listening probably are not.

492
00:29:37,340 --> 00:29:44,060
Safari exclusive, nor like Chrome. So when you say Chrome, I assume it'll work in Brave and other

493
00:29:44,320 --> 00:29:49,740
Chromium based browsers. And then also what about Firefox based browsers? Yeah. So for Chrome and

494
00:29:49,740 --> 00:29:55,740
Firefox based browsers, we will work in most of them. We do have to add periodically support for

495
00:29:55,740 --> 00:30:00,960
a new one. It's just a really simple thing on our side where we put a file in a certain spot so that

496
00:30:00,960 --> 00:30:05,760
the browser knows that Strongbox is open because we don't just want any arbitrary thing to be able

497
00:30:05,780 --> 00:30:07,060
to start talking to Strongbox.

498
00:30:07,480 --> 00:30:10,620
So we effectively have an approved list, if you will.

499
00:30:10,800 --> 00:30:11,880
So we have to add to that sometimes.

500
00:30:12,280 --> 00:30:13,520
I think the most recent one I added,

501
00:30:14,080 --> 00:30:15,220
which should be going live pretty soon,

502
00:30:15,240 --> 00:30:17,640
is Zen, which has become crazy popular recently.

503
00:30:18,060 --> 00:30:18,900
But other than that,

504
00:30:19,240 --> 00:30:21,780
as long as the browser is compatible

505
00:30:22,080 --> 00:30:23,780
with Chromium and its extensions

506
00:30:24,360 --> 00:30:25,720
or Firefox and its extensions,

507
00:30:26,180 --> 00:30:27,680
then it should be good to go.

508
00:30:27,760 --> 00:30:28,940
And the experience should be

509
00:30:29,200 --> 00:30:31,020
just about identical across the board.

510
00:30:31,480 --> 00:30:31,740
Very nice.

511
00:30:31,840 --> 00:30:33,440
Yeah, I'm a big fan of Zen browser.

512
00:30:33,720 --> 00:30:34,560
It's a good browser.

513
00:30:35,000 --> 00:30:38,920
If somebody's wondering, maybe someone has a higher security posture

514
00:30:39,250 --> 00:30:41,420
and they just care a little bit more about this,

515
00:30:41,960 --> 00:30:44,600
does using the extension open them up to any other threats?

516
00:30:45,140 --> 00:30:48,760
Is it safer to only use the desktop client and manually copy and paste?

517
00:30:48,910 --> 00:30:51,020
Or do you think that something like the autofill

518
00:30:51,580 --> 00:30:53,540
is actually good phishing protection in the extension?

519
00:30:53,860 --> 00:30:56,520
How do you view this nuance between using the tools?

520
00:30:57,700 --> 00:31:04,300
Yeah, so generally we think the extension is just as secure as the app.

521
00:31:04,640 --> 00:31:13,200
However, the main difference is you're adding an extra touchpoint with an ecosystem that changes wildly every day.

522
00:31:13,680 --> 00:31:23,180
And not too long ago, there was a reasonably serious exploit that affected almost every password manager that has an extension.

523
00:31:23,640 --> 00:31:29,000
And that was something that would only affect you if you use a browser extension.

524
00:31:29,360 --> 00:31:33,520
Because of how Strongbox locks and unlocks your database, it didn't actually affect us.

525
00:31:33,880 --> 00:31:39,500
But for any password manager that just left your database open, that was a problem.

526
00:31:39,880 --> 00:31:41,320
And it could take passwords away.

527
00:31:41,680 --> 00:31:44,880
We added a fix in to make sure we protected against that anyway.

528
00:31:45,460 --> 00:31:48,460
But browsers are a bit of a wild west.

529
00:31:48,580 --> 00:31:49,480
And so is the web.

530
00:31:50,100 --> 00:31:51,760
There's always more coming out.

531
00:31:51,860 --> 00:31:54,300
And it's a very popular attack vector.

532
00:31:54,680 --> 00:31:58,020
If you get into someone's password manager, then you have everything.

533
00:31:58,340 --> 00:31:59,380
You have the keys to the kingdom.

534
00:31:59,740 --> 00:32:03,020
So it's always something to think about.

535
00:32:03,660 --> 00:32:08,720
And the ultimate security would be don't use any kind of extension whatsoever.

536
00:32:09,520 --> 00:32:15,920
But the actual answer that I'd normally tell people is you can just make your database in Strongbox.

537
00:32:16,460 --> 00:32:18,180
I'm sure you can do this in other password managers.

538
00:32:18,710 --> 00:32:20,920
Only unlock for like 10 seconds.

539
00:32:21,460 --> 00:32:29,860
So if you open your browser and you want to autofill something, you unlock your database with touch ID or a password or whatever you choose.

540
00:32:30,030 --> 00:32:33,140
You autofill that one password and then the database locks again.

541
00:32:33,580 --> 00:32:35,480
which means it's a little slower to use.

542
00:32:35,800 --> 00:32:36,740
It's not quite as graceful,

543
00:32:37,340 --> 00:32:40,380
but it means that the database remains locked the entire time,

544
00:32:40,760 --> 00:32:42,400
which keeps things just as secure

545
00:32:42,580 --> 00:32:44,860
as if you were using it inside the app,

546
00:32:45,060 --> 00:32:47,620
which is probably the main lesson in general

547
00:32:47,820 --> 00:32:50,300
with any extension, whoever provides it,

548
00:32:50,640 --> 00:32:54,080
is try and keep your database locked as often as possible

549
00:32:54,480 --> 00:32:55,580
rather than just leaving it unlocked.

550
00:32:56,400 --> 00:32:57,300
Got it. Yeah, thank you.

551
00:32:57,560 --> 00:32:59,360
And earlier you mentioned Have I Been Pwned.

552
00:32:59,600 --> 00:33:00,160
It's a great database.

553
00:33:00,360 --> 00:33:01,660
You can see if you're caught in data breaches,

554
00:33:01,960 --> 00:33:03,200
so you guys integrate with that.

555
00:33:03,440 --> 00:33:04,720
And that's the only server connection?

556
00:33:04,820 --> 00:33:08,400
Is there any telemetry or anything else in the app that people should be aware of?

557
00:33:09,480 --> 00:33:13,480
So the app has two external providers.

558
00:33:13,720 --> 00:33:20,820
So we use RevenueCat to process purchases, which is in substantial amount of the apps in the App Store, if not most at this point, I'd imagine.

559
00:33:21,520 --> 00:33:25,580
And then the paywalls we have in the app are powered by Superwall.

560
00:33:25,940 --> 00:33:31,680
Both of those are effectively in the most limited state they possibly can be.

561
00:33:31,840 --> 00:33:37,640
So to give you a bit more information on that, we don't have any identifiers that we track.

562
00:33:38,140 --> 00:33:43,380
So if you wrote me an email and you said, why is my subscription not working?

563
00:33:43,820 --> 00:33:47,480
I couldn't go into anywhere and find you.

564
00:33:47,640 --> 00:33:49,140
I have no way to know who you are.

565
00:33:49,480 --> 00:33:56,660
All I know on tools like RevenueCat is I know what our revenue is and it updates effectively in real time.

566
00:33:57,220 --> 00:34:01,780
And it lets me do things like I can change offers remotely.

567
00:34:02,150 --> 00:34:07,200
So when we run our sales, I can just set that going remotely and we can tweak the prices here and there.

568
00:34:07,980 --> 00:34:13,780
And then with Superwall, Superwall lets us do paywalls without having to change the app all the time.

569
00:34:14,179 --> 00:34:16,500
And that doesn't mean we're adding new paywalls.

570
00:34:16,500 --> 00:34:23,280
But what it does is it lets us change how our paywall looks and feels to try and get more people to use Strongbox.

571
00:34:23,560 --> 00:34:34,340
It's a huge lever that we have, which means we don't have to invade someone's privacy and start tracking what they're doing in the app to work out how can we get them to pay.

572
00:34:34,710 --> 00:34:42,379
We can just test, you know, if I show you something different on the paywall, are you more likely to pay for it or not?

573
00:34:42,700 --> 00:34:48,060
You know, a really good example would be what if I had a paywall where all it talked about was autofill?

574
00:34:48,340 --> 00:34:51,060
And that's what you saw when you got through onboarding in the app.

575
00:34:51,080 --> 00:34:55,419
As I was just like, hey, auto feels incredible, but you need pro to use it.

576
00:34:55,659 --> 00:34:58,500
I can just test that and see if that works better or worse.

577
00:34:58,780 --> 00:35:02,800
And the only information I get is how many people paid and how many didn't.

578
00:35:03,000 --> 00:35:07,860
I don't get like telemetry on who did it, who they are, anything like that.

579
00:35:08,260 --> 00:35:10,180
I just know that someone paid or someone didn't.

580
00:35:10,420 --> 00:35:17,160
So someone who hears this, I mean, you know, like how do you distinguish the safety of someone's passwords to what you just described here?

581
00:35:18,100 --> 00:35:19,720
if someone's concerned about that?

582
00:35:20,540 --> 00:35:23,260
Yeah, the general rule that we followed

583
00:35:23,740 --> 00:35:24,720
throughout all of this

584
00:35:24,920 --> 00:35:27,060
is that we haven't added analytics.

585
00:35:27,440 --> 00:35:28,660
I know there's been some debate around

586
00:35:28,860 --> 00:35:30,280
whether or not they think RevenueCat

587
00:35:30,780 --> 00:35:31,940
serves as analytics.

588
00:35:32,280 --> 00:35:34,340
And I understand that there's a discussion there,

589
00:35:34,600 --> 00:35:37,340
but RevenueCat also weighed in to help out there

590
00:35:37,480 --> 00:35:40,780
and let people know that the data in RevenueCat

591
00:35:41,160 --> 00:35:43,180
is the same data that the App Store gives us.

592
00:35:43,740 --> 00:35:45,060
So nothing has changed.

593
00:35:45,400 --> 00:35:48,060
The kind of second line of defense

594
00:35:48,080 --> 00:35:55,880
I have a very firm policy that nothing like this is allowed to be after the database is opened.

595
00:35:56,280 --> 00:36:03,460
So Strongbox's paywalls and, you know, syncing purchases and so on happens when you open the app.

596
00:36:03,700 --> 00:36:07,100
It's not when you open a database, it's when you open the app.

597
00:36:07,280 --> 00:36:11,100
I'm sure we can get background updates that say, hey, the subscription's expired,

598
00:36:11,600 --> 00:36:13,980
but we're not sending anything to anyone.

599
00:36:14,060 --> 00:36:20,780
We just might realize that your subscription's expired and tell you, you know, you can't use Touch ID to unlock your database anymore.

600
00:36:21,200 --> 00:36:28,580
That was a kind of a long answer, but the short answer is nothing goes to anyone and we don't really have a plan to change that.

601
00:36:29,040 --> 00:36:36,340
It would be really useful if I had analytics about how people use the app just to drive forward where to put our time.

602
00:36:36,680 --> 00:36:41,240
The usual answer to analytics is scary data collection and so on, which I completely understand.

603
00:36:41,560 --> 00:36:43,600
but it would also be not for that purpose.

604
00:36:44,040 --> 00:36:46,220
But we've stayed true and we will do.

605
00:36:46,400 --> 00:36:48,640
I'll just ask people with a survey every now and again

606
00:36:48,890 --> 00:36:49,800
how they use Strongbox.

607
00:36:50,540 --> 00:36:52,920
Just to clarify, if Touch ID isn't allowed,

608
00:36:52,950 --> 00:36:54,040
you can still get in with a password.

609
00:36:55,520 --> 00:36:57,720
It's not just keeping you away from your passwords.

610
00:36:59,140 --> 00:37:02,880
Yeah, that would be a terrible strategy for user attention

611
00:37:03,220 --> 00:37:05,580
to take their database away if they don't pay us.

612
00:37:05,750 --> 00:37:07,360
But yeah, all of our...

613
00:37:07,380 --> 00:37:08,460
That's very LastPass, though.

614
00:37:09,800 --> 00:37:13,220
I've definitely seen places say you haven't paid, you can't get in.

615
00:37:13,520 --> 00:37:17,420
And thanks to them not using KeyPass, that database is just gone.

616
00:37:18,860 --> 00:37:23,020
But with us, all we do is we take away convenience features.

617
00:37:23,390 --> 00:37:27,040
We don't actually stop you getting into a database or anything.

618
00:37:27,340 --> 00:37:31,280
You will just lose autofill and you'd lose Touch ID, Face ID.

619
00:37:31,790 --> 00:37:34,120
So you can still do everything just about.

620
00:37:34,260 --> 00:37:35,180
It's just not quite as cool.

621
00:37:36,100 --> 00:37:40,440
Right. And then I'll touch a little bit more on the business model in a second as we zoom out.

622
00:37:40,760 --> 00:37:45,880
But the last question, I feel like telemetry analytics, very charged, very controversial subject,

623
00:37:46,200 --> 00:37:51,640
because the way I see it is that it is so prolific and so bad in all these services.

624
00:37:52,100 --> 00:37:57,500
People have this association with analytics and telemetry coming from these really invasive and bad big tech companies

625
00:37:58,140 --> 00:38:01,580
that it's just easier to say, I don't want any of this.

626
00:38:02,080 --> 00:38:03,600
And I think that is not a wrong answer.

627
00:38:03,980 --> 00:38:07,900
But having spoken to so many privacy-first projects,

628
00:38:08,370 --> 00:38:09,020
even on this podcast,

629
00:38:10,460 --> 00:38:12,420
one of the most common themes is

630
00:38:12,580 --> 00:38:15,140
we don't know what our users actually use our service for

631
00:38:15,890 --> 00:38:16,800
because they don't have any insight.

632
00:38:17,070 --> 00:38:19,340
And so they all say, we wish there was a way,

633
00:38:19,390 --> 00:38:21,480
but if we did this, then there would be too much pushback.

634
00:38:22,160 --> 00:38:26,300
And so it's a really hard line to walk around.

635
00:38:27,300 --> 00:38:29,080
So I understand the difficulties there.

636
00:38:29,140 --> 00:38:30,380
I'm sure it impacts you guys as well.

637
00:38:31,460 --> 00:38:41,120
Yeah, I think it's a really, it's an interesting subject because I think people are very right to be scared of invasive telemetry.

638
00:38:41,640 --> 00:38:44,100
I think it's something that you should always be careful with.

639
00:38:44,720 --> 00:38:48,640
You know, I use tools like Little Snitch on my computer to check where's data going.

640
00:38:48,850 --> 00:38:50,840
Like I've downloaded this cool app off the internet.

641
00:38:51,120 --> 00:38:51,580
What's it doing?

642
00:38:51,930 --> 00:38:55,180
Especially if I've had to have given it like a sensitive permission or something.

643
00:38:55,500 --> 00:38:57,060
So I entirely agree.

644
00:38:57,420 --> 00:39:04,880
I mean, the flip side of it is I think something that's happened over time is analytics are absolutely everything everywhere now.

645
00:39:05,460 --> 00:39:07,320
You'll be tracked in like basically everything.

646
00:39:07,700 --> 00:39:11,260
Even a lot of privacy first projects still have analytics somewhere.

647
00:39:11,900 --> 00:39:13,680
They just try and say it's not in there.

648
00:39:14,160 --> 00:39:26,540
And I generally think the analytics from bad actors are looped in with analytics from people who, like us, would just really benefit from knowing how do people use this thing?

649
00:39:26,800 --> 00:39:29,180
We obviously get the cynical answer of,

650
00:39:29,410 --> 00:39:30,520
will they use it to store passwords?

651
00:39:31,719 --> 00:39:33,220
But the nuance is,

652
00:39:33,840 --> 00:39:35,800
if we knew a little bit more about,

653
00:39:36,400 --> 00:39:38,940
for example, how many passwords do people have in here?

654
00:39:39,080 --> 00:39:41,940
Do people use Strongbox as their only password manager,

655
00:39:42,160 --> 00:39:43,620
which we could kind of insinuate by,

656
00:39:44,540 --> 00:39:46,320
do they have a huge list of vaults and passwords?

657
00:39:46,760 --> 00:39:48,820
Do people share things with each other a lot?

658
00:39:49,240 --> 00:39:50,940
Do businesses use this a lot?

659
00:39:51,180 --> 00:39:53,000
All of these things can help drive

660
00:39:53,490 --> 00:39:54,640
our direction on the product.

661
00:39:55,380 --> 00:40:03,060
Like, do we find that people download the app and then start onboarding and then get to the sync screen that tells them all the different options and just close the app?

662
00:40:03,300 --> 00:40:05,520
That's probably happening, but we have no idea.

663
00:40:06,300 --> 00:40:13,380
So we kind of just have to trust what people tell us and ask people and try our best to get information that way.

664
00:40:13,640 --> 00:40:18,120
Whereas in other apps, I can tell the users are dropping off at a certain point.

665
00:40:18,120 --> 00:40:21,480
We need to make that better. And that's a really useful thing to be able to do.

666
00:40:21,880 --> 00:40:27,620
And I sort of, as a thing I think about quite often is, is there any way that privacy apps

667
00:40:27,690 --> 00:40:32,740
could do some kind of opt-in super light information dump somehow?

668
00:40:33,160 --> 00:40:34,700
I've never come up with an answer for it.

669
00:40:34,940 --> 00:40:36,760
So I've never, never come back to it.

670
00:40:36,880 --> 00:40:40,860
But I'm sure, yeah, you've had a similar discussion many times where people just say,

671
00:40:41,320 --> 00:40:46,380
we could have a much bigger business and much happier users if we had that information,

672
00:40:46,660 --> 00:40:48,980
but we can't have it for a very good reason.

673
00:40:49,380 --> 00:40:56,560
So for now, we don't have it, but I can kind of get a good feel for things from, you know, public communities, the emails that come in and so on.

674
00:40:56,920 --> 00:41:03,740
Yeah, I guess on the topic of community, a really difficult thing originally when I found you guys, it was difficult to know if it was or wasn't.

675
00:41:03,830 --> 00:41:08,620
But how do you feel about open source? Are you open source? If not, what's kind of your rationale behind that?

676
00:41:09,020 --> 00:41:14,080
Yeah, so the short answer is yes, the co-based of Strongbox is open source.

677
00:41:14,540 --> 00:41:21,120
The kind of longer answer is we do have some parts of it that aren't shared in the repository.

678
00:41:21,390 --> 00:41:23,760
And that doesn't mean we've hidden something.

679
00:41:24,260 --> 00:41:30,620
It's literally the Xcode project that you would download and run to be able to run Strongbox on your own phone.

680
00:41:30,810 --> 00:41:31,760
You can't do that.

681
00:41:32,650 --> 00:41:35,460
And that's not, again, it's not us trying to sneak something in.

682
00:41:35,900 --> 00:41:37,660
It's a decision that was made a while ago.

683
00:41:38,200 --> 00:41:41,620
And it's effectively just protection.

684
00:41:41,940 --> 00:41:46,340
Because if we didn't have that very thin layer of protection,

685
00:41:46,740 --> 00:41:51,100
you could just grab our repo and push your own password manager to the App Store tomorrow.

686
00:41:51,440 --> 00:41:53,720
We have a license in there that says you can't do that,

687
00:41:53,920 --> 00:41:57,580
but licenses don't necessarily prevent bad actors.

688
00:41:58,500 --> 00:41:59,300
I've seen it happen.

689
00:41:59,780 --> 00:42:00,700
This happens a lot.

690
00:42:00,940 --> 00:42:05,220
There was some news earlier today where cal.com took their code base offline.

691
00:42:05,500 --> 00:42:06,720
I just saw that before recording.

692
00:42:07,680 --> 00:42:08,660
I got the email for it.

693
00:42:08,820 --> 00:42:09,980
That's happening all the time.

694
00:42:10,180 --> 00:42:15,280
we see it a lot where someone will make a really cool app and I'll be like this is great and then

695
00:42:15,380 --> 00:42:20,680
I'll notice 10 kind of similar versions appear the next week and they're very very slightly different

696
00:42:21,180 --> 00:42:25,560
and they're all paid products and you can tell it's the same app because you'll spot the same

697
00:42:25,720 --> 00:42:31,900
bug in all of them like oh okay that's a bit more of a coincidence so the point is we want to be

698
00:42:32,040 --> 00:42:38,960
transparent and that's important to us that you know there's nothing crazy going on just look at

699
00:42:38,980 --> 00:42:43,460
a code you can have it and that's why we open source like the serverless function we have where

700
00:42:43,820 --> 00:42:49,120
like we told people the main reason we have that is we don't want to put paid service keys inside

701
00:42:49,230 --> 00:42:54,320
the app because someone could just grab them and start using our have I been pwned service but we

702
00:42:54,500 --> 00:42:59,360
still want to make sure everything we do is transparent so that code is up there so yeah

703
00:42:59,500 --> 00:43:04,480
there's some discussion around the strict definition of open source source available open source and

704
00:43:04,500 --> 00:43:12,100
so on. But we do push everything to the cloud. And we also have like our Chrome extension is fully

705
00:43:12,270 --> 00:43:18,080
open and so on. So it's all there to look at. It's just you can't quite build it very quickly.

706
00:43:19,260 --> 00:43:23,220
Got it. You mentioned earlier that you're trying to broaden your horizons. You don't even want

707
00:43:23,350 --> 00:43:27,660
someone to know they're using KeePass, which I respect. I think the best privacy security tools

708
00:43:27,960 --> 00:43:31,119
don't need to tell users what's going on. I feel like something that can happen when you broaden

709
00:43:31,120 --> 00:43:33,460
is it's easy to lose sight of the OG audience.

710
00:43:34,200 --> 00:43:36,560
So do you still want to be committed

711
00:43:36,630 --> 00:43:38,640
to those hardcore keypass people?

712
00:43:38,770 --> 00:43:39,960
Will they still see those features?

713
00:43:40,440 --> 00:43:43,340
Are you trying to balance that mainstream audience

714
00:43:43,760 --> 00:43:46,520
and still secretly be serving that hidden audience

715
00:43:46,720 --> 00:43:48,380
that they don't even know maybe is being served?

716
00:43:49,120 --> 00:43:51,860
I think the easy way to put it would be,

717
00:43:52,260 --> 00:43:54,500
I see broadening our horizons

718
00:43:54,900 --> 00:43:56,700
and making a simpler experience

719
00:43:57,180 --> 00:43:59,560
something that someone would opt into at the start.

720
00:44:00,180 --> 00:44:02,840
So there's plenty of UX improvements we can make.

721
00:44:03,020 --> 00:44:07,180
They're sort of the real key pass wizards that we will continue to do.

722
00:44:07,410 --> 00:44:08,180
That will never change.

723
00:44:08,450 --> 00:44:14,080
But I think for, say, if I wanted to give my parents Strongbox, they don't know what key pass is.

724
00:44:14,540 --> 00:44:16,040
And I sort of don't need them to.

725
00:44:16,330 --> 00:44:18,800
I want them to just use a password manager that I think is great.

726
00:44:19,140 --> 00:44:20,340
And I can also give them for free.

727
00:44:20,700 --> 00:44:21,420
That's quite nice as well.

728
00:44:21,780 --> 00:44:23,240
But I can just give them that.

729
00:44:23,430 --> 00:44:26,400
And they don't need to know technical details about anything.

730
00:44:26,920 --> 00:44:30,040
I just want to give them it and say, hey, hit new database and go.

731
00:44:30,080 --> 00:44:36,460
and the vision for it which is something I repeated a few times but effectively what if

732
00:44:36,920 --> 00:44:41,240
really early on in the app you basically got asked the question do you know what keypass is

733
00:44:41,440 --> 00:44:45,960
I wouldn't actually ask someone that but in a way like what if I could just let you pick

734
00:44:46,220 --> 00:44:52,620
if you want a really simple way of using it or the complex way and that would most likely not change

735
00:44:53,020 --> 00:44:58,020
anything at all about the in database experience I think we've done a really good job there and

736
00:44:58,040 --> 00:45:02,840
we're continuing to improve it but I think that's really good but I think outside of that with you

737
00:45:02,840 --> 00:45:08,580
know picking vaults customizing syncing things and setting up a bunch of I guess the more strict

738
00:45:08,780 --> 00:45:13,580
privacy features and so on it's not necessarily something people will find a really common

739
00:45:13,860 --> 00:45:17,960
complaint I get is people think autofill doesn't work but it's just because they haven't turned it

740
00:45:17,960 --> 00:45:23,360
on and I think most people downloading our app and paying for it because they want to use autofill

741
00:45:23,380 --> 00:45:29,620
probably expect it to just be on. So I think that kind of the answer is let people have an easy setup

742
00:45:29,810 --> 00:45:34,900
button somewhere where we're like you just have one database and we turn on all the cool stuff

743
00:45:35,680 --> 00:45:41,380
and we make sure you've got convenience unlocks turned on and it would then feel to you like

744
00:45:41,480 --> 00:45:47,520
you're using one of these cloud-based solutions that doesn't have key pass details in there. It

745
00:45:47,520 --> 00:45:52,320
would just feel a little bit smoother to you but I think it's incredibly important that that is

746
00:45:52,340 --> 00:45:58,220
something that we do in addition to what we already do. I would never want to take anything away from

747
00:45:58,380 --> 00:46:01,180
anyone. If anything, I actually have quite a lot more stuff I want to add, to be honest.

748
00:46:01,860 --> 00:46:04,940
But I also think a simple kind of option would be really good.

749
00:46:05,660 --> 00:46:09,500
Nice. And then kind of behind the scenes, what does your organization look like? You know,

750
00:46:09,670 --> 00:46:12,440
how many people are working there? What are the different roles?

751
00:46:14,520 --> 00:46:21,240
So there's a reasonable amount of us these days on the specific Strongbox team. There's me and

752
00:46:21,260 --> 00:46:27,180
another product person so whilst I work a lot on product I also mostly look after everything to do

753
00:46:27,260 --> 00:46:33,260
with engineering and then I try and look after social media and customer support too mostly

754
00:46:33,380 --> 00:46:38,260
because I think it's quite important that this app transitioned from a face that people knew

755
00:46:38,780 --> 00:46:44,520
they knew they could say like hey mark or address him directly in comments and so on so I think it's

756
00:46:44,540 --> 00:46:49,360
really important we keep that so I'm maintaining that with me but I also think it's good to have

757
00:46:49,380 --> 00:46:56,180
other people involved in terms of direction, design, where we go from here. So we have a head

758
00:46:56,180 --> 00:47:02,160
of product who helps me with that direction and also gives me a little bit of a kick sometimes if

759
00:47:02,240 --> 00:47:06,860
I'm dragging my feet thinking something has to be tweaked with for two months instead of just letting

760
00:47:07,180 --> 00:47:10,120
people play with it and see what they think. And then I also have a team of three engineers

761
00:47:10,780 --> 00:47:17,680
who work with me. So we have a big mixture of skill sets within that, people who are better at

762
00:47:17,700 --> 00:47:24,860
design people who are better at web stuff or ios ipad there's a big mixture of skill sets but it

763
00:47:24,960 --> 00:47:30,840
means that we have effectively triple the ability to work on the app that we used to have because it

764
00:47:30,940 --> 00:47:35,080
used to be one person working on it before we took over so quite a lot more people involved

765
00:47:35,300 --> 00:47:40,700
technically and then also just above that we have you know two people sort of looking out for where

766
00:47:40,750 --> 00:47:44,760
it goes from here there's a you know a bunch more people who work in the company looking after

767
00:47:44,760 --> 00:47:46,500
things like finance and so on.

768
00:47:46,540 --> 00:47:49,000
But just in terms of Strongbox, there's give or take

769
00:47:49,300 --> 00:47:52,940
five of us on a weekly basis that are looking after it.

770
00:47:53,340 --> 00:47:56,280
Right, and I guess this is definitely the elephant in the room.

771
00:47:57,180 --> 00:48:00,480
The acquisition, and so I think Mark is the original developer?

772
00:48:01,140 --> 00:48:02,180
Is that correct?

773
00:48:02,700 --> 00:48:06,800
Okay, so that happened, and then on the community side of things

774
00:48:06,860 --> 00:48:08,520
there was the Strongbox acquisition.

775
00:48:09,000 --> 00:48:11,680
So do you mind speaking to what that looks like,

776
00:48:12,060 --> 00:48:13,000
how that changes things?

777
00:48:13,620 --> 00:48:15,080
What are some of the concerns that you've seen?

778
00:48:15,130 --> 00:48:17,860
I know that our audience is very wary of acquisitions.

779
00:48:18,060 --> 00:48:21,980
We've seen open source projects go very downhill after acquisitions.

780
00:48:22,070 --> 00:48:26,780
And so we kind of want it like there's that natural reluctance to be in support of them.

781
00:48:26,890 --> 00:48:31,420
So maybe you can kind of speak to this and where you feel, how you feel about it.

782
00:48:32,860 --> 00:48:37,460
I mean, look, I think that the initial thing is no matter what happens with an acquisition,

783
00:48:37,770 --> 00:48:42,700
I think people are generally a little skeptical because there's been so many terrible ones.

784
00:48:43,080 --> 00:48:50,900
I've seen plenty of acquisitions where apps have been bought and the price has doubled the next day or they've not had a subscription and then they've added one.

785
00:48:51,380 --> 00:48:53,580
There's a lot of reasons that people are wary of these.

786
00:48:54,040 --> 00:49:04,060
And I think what happened with Strongbox is we announced it and I think maybe didn't give people enough reassurance of what was coming.

787
00:49:04,140 --> 00:49:08,080
people were sort of a bit worried about all the things that usually go wrong with acquisitions

788
00:49:08,540 --> 00:49:14,040
where people just abandon it and jack prices up and close the source and so on so i think there

789
00:49:14,040 --> 00:49:20,640
was a justifiable apprehension to us owning it the flip side of us owning it is that there's way more

790
00:49:20,740 --> 00:49:25,200
people that work on it we can work faster and we can make bigger changes to the app than one person

791
00:49:25,400 --> 00:49:31,320
could but i understand why people are apprehensive and i think we did post uh on the strongwatch blog

792
00:49:31,340 --> 00:49:37,560
announcing it and Mark posted a letter to to sort of hand the reins off to us but we just sort of

793
00:49:37,880 --> 00:49:42,360
rightfully had to help gain the trust of the community a bit. I think we had to put the work

794
00:49:42,420 --> 00:49:46,540
in to share that we weren't going to do anything crazy and that we weren't going to drop analytics

795
00:49:46,800 --> 00:49:52,120
in instantly which I think is what people mostly thought was going to happen. I think they presumed

796
00:49:52,200 --> 00:49:57,320
we'd throw in loads of analytics on the first day and then jack up prices or add subscriptions.

797
00:49:57,780 --> 00:50:03,220
Adding subscriptions was probably the most common thing I saw within telemetry, but Strongbox already had a subscription.

798
00:50:03,510 --> 00:50:06,220
We didn't add that, but it was a thing that came up a lot.

799
00:50:06,430 --> 00:50:12,820
And things like people thought we were going to kill Strongbox Zero, which we are not doing and I won't let happen.

800
00:50:13,160 --> 00:50:24,680
So something that I've definitely learned from this and is something that we will take going forward into future acquisitions is to make sure we get the point home in our announcement.

801
00:50:25,540 --> 00:50:29,000
And really try and start getting that trust straight away.

802
00:50:29,460 --> 00:50:36,180
And that means, you know, whilst I did introduce myself really early and was talking to the community quite often,

803
00:50:36,320 --> 00:50:40,740
like it took quite a while to get around to doing like a proper sort of Q&A and things.

804
00:50:40,980 --> 00:50:43,660
And I think that's something that we definitely learned from.

805
00:50:43,960 --> 00:50:47,020
But the way I've kept things going is everything's open.

806
00:50:47,520 --> 00:50:51,040
I try and post in our Reddit whenever I do something new in the app.

807
00:50:51,200 --> 00:50:54,800
I ask for feedback a lot. I ask for feature suggestions and comments.

808
00:50:55,160 --> 00:50:58,240
Even when people are a little bit grumpy with me, I'm still happy to hear it.

809
00:50:58,310 --> 00:51:02,680
Like I want to help people get their best experience and have them not hate us.

810
00:51:02,870 --> 00:51:03,480
That would be great.

811
00:51:03,800 --> 00:51:08,180
So I think we've done quite a lot to try and help prove that we're not going to do anything

812
00:51:08,720 --> 00:51:09,620
sketchy with Strongbox.

813
00:51:10,000 --> 00:51:11,740
Time is sort of the thing that proves that.

814
00:51:11,920 --> 00:51:14,400
But we learned from making announcements better.

815
00:51:14,760 --> 00:51:19,980
And then I'm hopeful that people have a slightly different opinion of us after the last year

816
00:51:20,140 --> 00:51:20,320
or so.

817
00:51:20,550 --> 00:51:23,120
I don't quite have a poll or anything to prove that.

818
00:51:23,280 --> 00:51:27,940
But I think the community of Strongbox generally feels better about it now

819
00:51:27,980 --> 00:51:29,300
than they did when it was announced.

820
00:51:29,600 --> 00:51:30,980
So pretty good, I think.

821
00:51:31,200 --> 00:51:31,760
We've added stuff.

822
00:51:32,180 --> 00:51:34,540
To kind of round us out, I have just a couple more questions.

823
00:51:34,920 --> 00:51:38,220
Subscriptions, and this is actually somewhat of a criticism I have,

824
00:51:38,460 --> 00:51:42,840
maybe with a lot of people who are free open source advocates.

825
00:51:43,340 --> 00:51:45,600
Free, people forget the meaning of free.

826
00:51:46,200 --> 00:51:48,520
That means freedom, not free as in beer.

827
00:51:48,900 --> 00:51:52,320
That is the very common metaphor that's used to help explain this.

828
00:51:52,640 --> 00:51:54,660
But that culture still exists, right?

829
00:51:54,940 --> 00:51:56,040
Where people really don't want to pay.

830
00:51:56,220 --> 00:51:58,100
In fact, I don't know of any other KeePass client

831
00:51:58,210 --> 00:51:59,480
off the top of my head that charges.

832
00:51:59,820 --> 00:52:02,180
Maybe KeePassium has a paid plan as well on iOS,

833
00:52:02,490 --> 00:52:02,980
if I remember.

834
00:52:03,360 --> 00:52:05,240
But other than the Apple ecosystem,

835
00:52:05,490 --> 00:52:07,540
I can't think of a paid KeePass client.

836
00:52:07,740 --> 00:52:10,860
So I might ask, why should someone pay for a KeePass client?

837
00:52:11,200 --> 00:52:12,240
Just as a question,

838
00:52:12,540 --> 00:52:14,400
and then what are your subscription models?

839
00:52:14,470 --> 00:52:16,560
Because I think I actually got Lifetime back in a day,

840
00:52:16,600 --> 00:52:17,600
and I still have Lifetime.

841
00:52:17,840 --> 00:52:21,760
So I think the reason for buying an app like ours

842
00:52:21,780 --> 00:52:27,880
kind of applies to the argument as like a whole in that we're in a world now where there's always

843
00:52:28,000 --> 00:52:33,420
been open source software but now there's probably been six new open source apps whilst we've had this

844
00:52:33,500 --> 00:52:38,840
conversation they're springing up all the time people can make what they want and it can be great

845
00:52:38,980 --> 00:52:44,280
it can be bad it can be whatever but there's new software all the time and a lot of the time people

846
00:52:44,440 --> 00:52:49,960
choose to make that free and push it out to the world that way and i think that's incredibly

847
00:52:49,980 --> 00:52:56,560
valuable and open source is the reason why keypass clients can even exist keypass itself is open and

848
00:52:56,680 --> 00:53:03,600
that's what powers all of these keypass apps i think the choice for the person generally is do

849
00:53:03,610 --> 00:53:10,660
you think the experience you get from an app like strongbox is worth some money a discussion i see

850
00:53:10,660 --> 00:53:15,720
a lot is people say oh you know keypass itself is open source so why isn't strongbox just free

851
00:53:15,740 --> 00:53:23,120
but strongbox the reasons it gets praised are years of love and affection and lots of hard work

852
00:53:23,660 --> 00:53:29,680
and developer time is definitely not free even when you're building it for yourself it's quite

853
00:53:30,000 --> 00:53:36,800
expensive to make apps and there's a lot to that you know you probably see reasonably often even

854
00:53:36,800 --> 00:53:43,180
on open source repos there's hundreds of issues and problems all the time and you see how much of

855
00:53:43,200 --> 00:53:49,380
that person's time gets eaten up with support, changes, fixes, and so on. And a lot of these

856
00:53:49,420 --> 00:53:53,980
open source things become a full-time job for someone. And as apps get more complex and they

857
00:53:54,180 --> 00:54:00,060
scale, more people have to be involved. And when more people get involved, the cost just starts

858
00:54:00,220 --> 00:54:07,320
going up and up and up. And supporting via open source is viable for a lot of projects. I pay for

859
00:54:07,720 --> 00:54:12,800
loads of support on GitHub these days. But for apps like ours, the craft we put into it,

860
00:54:13,020 --> 00:54:17,200
the team we put into it isn't something we could sustain with open source.

861
00:54:17,420 --> 00:54:23,800
And that was true when Mark ran it by himself and remains true now.

862
00:54:24,120 --> 00:54:29,260
Except now there's five people instead of one and we haven't changed the price

863
00:54:29,500 --> 00:54:31,660
because we're pretty happy with it as it is.

864
00:54:32,020 --> 00:54:37,540
But this sort of cost of subscriptions sustains people building great things.

865
00:54:37,940 --> 00:54:40,920
If no one paid for anything, then there wouldn't be great software.

866
00:54:41,380 --> 00:54:42,980
Most of the open source software...

867
00:54:43,680 --> 00:54:49,600
Yeah, most open source software you see probably at some point had some paid application involved,

868
00:54:49,900 --> 00:54:52,740
which had a lot of people involved in an office somewhere.

869
00:54:53,120 --> 00:54:56,660
So, you know, software can be free, it can be paid.

870
00:54:56,800 --> 00:55:01,180
And it's just up to you if you think if a free one is fine for you, then that's OK.

871
00:55:01,660 --> 00:55:02,860
There's no problem with that.

872
00:55:03,040 --> 00:55:05,380
But you think the paid one is right for you, then that's good too.

873
00:55:05,740 --> 00:55:09,720
You can support developing something and see it continue to improve over time.

874
00:55:10,020 --> 00:55:15,760
Where I think we strike a middle ground is you can use most of Strongbox fully for free.

875
00:55:16,030 --> 00:55:20,540
We limit very small things like convenience unlocks and autofill.

876
00:55:20,800 --> 00:55:25,940
So you can use us and what I think is a very good experience for absolutely no money.

877
00:55:26,320 --> 00:55:28,180
And if you want the other features, you can pay for them.

878
00:55:28,180 --> 00:55:30,640
But if you don't, then Strongbox is free for you.

879
00:55:31,220 --> 00:55:36,200
And we have a huge amount of free users and we don't get anything from that.

880
00:55:36,740 --> 00:55:39,160
But we're happy that people choose to use us.

881
00:55:39,300 --> 00:55:46,560
but we wouldn't be possible without the people who do pay for Strongbox. So it's an interesting

882
00:55:46,740 --> 00:55:51,940
choice people have to make. I think I always vote for supporting good software but I appreciate that

883
00:55:52,040 --> 00:55:57,160
I'm very biased in that I make a lot of software so I probably do want people to pay for it but

884
00:55:57,260 --> 00:56:03,320
we do have options for people who really don't like subscriptions. We do let you have a lifetime

885
00:56:04,100 --> 00:56:08,420
option for the app. If you really don't like in-app purchases you can grab it straight from the app

886
00:56:08,440 --> 00:56:13,520
store. You can grab Strongbox Pro or Xero. And if you're using the free app, you can also grab it

887
00:56:14,020 --> 00:56:19,080
in the app as an app purchase if you feel like it. So we do have an option for you for a lifetime sub,

888
00:56:19,740 --> 00:56:23,420
which is priced at the equivalent of like a few years of subscription.

889
00:56:24,060 --> 00:56:29,600
So what's next for you guys? And where can people connect with you or Strongbox? Just kind of

890
00:56:30,080 --> 00:56:32,600
leave it open ended for you to kind of round things out.

891
00:56:33,080 --> 00:56:40,860
So the place we're most active is there is a Strongbox subreddit where people post all the time, like requests, bugs and just thoughts.

892
00:56:41,220 --> 00:56:46,240
We're super active in there. We reply to basically everything and try and get involved in the conversation.

893
00:56:47,380 --> 00:56:56,620
We have a Strongbox Twitter account, which we don't necessarily post on super often, but we do reply to people who get in touch with us and tag us and so on.

894
00:56:56,740 --> 00:57:00,520
And finally, we do have just an open email inbox.

895
00:57:01,000 --> 00:57:03,660
So if people want to get in touch with us and speak to us,

896
00:57:03,670 --> 00:57:05,980
they can just fire us an email and say whatever they want.

897
00:57:07,059 --> 00:57:10,880
So we're pretty open to a whole bunch of different ways of getting in touch with us.

898
00:57:10,890 --> 00:57:13,100
You can kind of pick your poison on that one.

899
00:57:13,310 --> 00:57:16,860
You can open an issue on a GitHub repo if you'd like, if that's your preferred medium.

900
00:57:17,160 --> 00:57:19,300
So we're kind of all over the place with communication.

901
00:57:19,490 --> 00:57:21,620
We just want to meet people where they are.

902
00:57:21,940 --> 00:57:25,660
Just get in touch, give us your ideas, niggles, whatever it is.

903
00:57:25,920 --> 00:57:26,900
we're here for it.

904
00:57:29,100 --> 00:57:29,320
Very cool.

905
00:57:29,450 --> 00:57:30,920
Well, thank you for coming on the podcast, Alex.

906
00:57:31,360 --> 00:57:33,580
And maybe someday in the future, I'll be back.

907
00:57:33,680 --> 00:57:35,260
I think it's nothing you guys are doing.

908
00:57:35,500 --> 00:57:37,280
Maybe, you know, I hope the system evolves,

909
00:57:37,440 --> 00:57:38,280
the ecosystem evolves,

910
00:57:39,039 --> 00:57:41,600
and I can go back to my really clean KeePass experience

911
00:57:41,690 --> 00:57:42,700
because I used to really love that.

912
00:57:42,980 --> 00:57:45,880
But that's something I'm hoping for.

913
00:57:46,480 --> 00:57:47,620
I'm sure we'll get you one day.

914
00:57:48,100 --> 00:57:48,320
I'm excited.

915
00:57:49,280 --> 00:57:50,860
In the meantime, thank you for the work you do

916
00:57:50,890 --> 00:57:52,640
because, again, it's my favorite KeePass client.

917
00:57:52,770 --> 00:57:53,200
So thank you.

918
00:57:54,880 --> 00:57:55,820
Appreciate it. Thank you very much.

919
00:57:56,500 --> 00:57:57,120
great speaking with you.

920
00:58:25,880 --> 00:58:26,000
talks.