The file is encrypted before it gets sent to the cloud.
There's nothing that gets sent that's not encrypted in your vault.
Hello, everybody, and welcome to Techlore Talks.
Today, I'm really excited to have on Bitwarden.
We're going to talk about the origins of Bitwarden,
how they're able to fund this open source password manager,
community involvement, the security posture of Bitwarden,
as well as the privacy posture,
comparing Bitwarden to other password managers,
why you should even use a password manager,
best practices with your password manager, and so much more.
If you've been looking for a deep dive on password managers and or Bitwarden, this is it.
And now to the interview.
All right.
I would like to introduce Ryan from Bitwarden, if you want to say what you do.
Hi, I'm Ryan.
I work at Bitwarden as a senior PMM, that's product marketing manager.
Nice.
How did you get involved with a security company?
Did you start with security and then, you know, get into the marketing for security?
or did you start with marketing and then stumble on a security company?
No, it's actually a really funny story how I started.
I actually have a background in film and multimedia.
I was a part of that industry for quite a few years.
I didn't like where it was going.
And after seeing a couple of bad business decisions be made
by some of the studios I was working at,
I decided to go get a business degree so I could do it better.
And I found my passion really in marketing over there,
just telling stories, connecting with audiences,
which is basically what I did before when I was doing film editing and such.
And right out of business school, I got hired by Dell.
And I was at Dell Technologies for six years, selling laptops, Alienware products, monitors,
other things like working on product messaging for all that, working with the engineers,
seeing all the prototypes.
It was a really, really fun type of gig.
And then I found my way over to Bitwarden.
I was really intrigued by the open source and security nature of it all.
It's funny because at the time, I didn't actually use a password manager.
So Bitwarden was my first exposure to password management.
And, you know, I was interested to learn more.
I had started trying a couple of different solutions out.
And I ended up joining Bitwarden in two ways, personally and professionally.
Very nice.
And what's kind of the origin for Bitwarden?
I mean, it's pretty prolific in our community.
Everyone knows who Bitwarden is for the most part in our community.
But I don't personally know the origins there.
You can read all the stories online.
Our founder, Kyle Spearin, he decided to develop Bitwarden on his own after being disenfranchised by another password management solution that he was working on.
He realized, like, man, this password manager is really not great for business.
What can I do to make a password manager that works for everyone?
And that was basically the genesis of it.
He started off as an open source project.
You can go back and find the original post he made in 2017 on Reddit and on Hacker News announcing his project and, you know, built up a community support from there, just working with open source.
He has plenty of interviews.
I highly recommend you go listen.
It's pretty enlightening.
And have you guys been open source from day one?
Yeah, absolutely.
All right.
So what's your overall team size as well?
So we have, we've come a long way. We're up to about 250 employees now, employees and contractors. So, you know, really, really working hard to, you know, make Bitwarden the best product possible.
Wow. And I guess the one thing before I get into the open source side of things, funding. So of course, you guys have free, you have paid for individuals, and then you have enterprise. And then I do know that there are like funding models as well with some VCs. So how does that all interplay? And what's kind of the relationship there for the company if people are curious about that?
Yeah, so Bitwarden has a free plan, always has a free plan, always will have a free plan.
We've made that promise many, many, many times.
And Bitwarden, most of the income that we see, funded income, comes from the people who pay for premium plans on the individual side, but most importantly, business plans.
So the business plans do make a large portion of the funding for Bitwarden.
And it's actually thanks to the community that we even get those business plans in the first place.
One of the things that we find is that most businesses started off looking at password managers and somebody who's using Bitwarden says, hey, Bitwarden's great.
I'd love to bring Bitwarden into the office.
And we always have some sort of champion who's helping us out and really touting the benefits of open source and bringing people along.
So to us, it really comes all from the community who goes out and brings Bitwarden to work.
We actually once ran a campaign called Bring It, Bring Bitwarden to Work.
It just comes back to us through there.
And then we also want to continue that engine.
And so Bitwarden also gives free families plans to any enterprise user so they can take Bitwarden back home to more people and maybe, you know, get their brothers, get their sisters, anybody, their children using Bitwarden and used to it.
So then when they go out into the workplace, they are also interested in bringing Bitwarden to work.
It's a really great engine.
And you had mentioned some VC funding as well.
The growth announcement for that was made in 2022.
You can find all the disclosures and stuff online.
It really was a growth investment.
You can read all the specific details about it.
I would just recommend going and looking at that.
Yeah, I mean, do you mind covering what a growth investment is?
Because some people hear VC and they go, well, so are they still going to be open source?
Do they still have decision-making authority, et cetera?
So what does that mean for a regular person?
Yeah, so a growth investing.
So again, like I'm not on the board.
I don't understand like all the inner workings about this.
But a growth investment doesn't preclude any additional or any sort of control.
It really is like, hey, here's money, make it better type of thing.
So again, those details are posted online and is the right language to make sure I don't say anything that's not correct.
Is the general idea that it's an investor that goes, hey, here's money.
they're just expecting a return on investment
while you just build the company the way you want it.
That's probably a more accurate way to say it, yeah.
So with the open source side of things,
I want to start by just, you know,
if someone's new and they're learning about Bitwarden,
I know our community is very much into the open source world,
so I don't need to really tout too much of the benefits there for them.
But if someone's new and they're listening to this,
especially in the password manager,
what is the benefit of being open source
compared to maybe not being open source?
There's a plethora of non-open source password managers out there that are typically recommended.
But what do you think that really provides?
Yeah, let's talk about a closed source, proprietary source, whatever you want to call it.
People who prefer or decide to go with a closed source model, they like the idea of security through obscurity.
That is, there's like a veil.
Nobody knows how things are working in the background.
And so because of that, they believe that it's going to be more difficult for hackers to find any vulnerabilities to get in and break the product.
We'd like to say like hope is not a strategy, but that's really what it comes down to.
They're just hoping that somebody doesn't find a vulnerability and take advantage of it.
With open source, we have the transparency of having all of the Bitwarden source code posted on GitHub.
Any of your users right now can go to github.com slash Bitwarden and see the code that's currently in development.
For one, if anyone wants to kind of scoop us on some of our product announcements.
And two, like there's an entire huge security community that loves to go around and poke around the code and see stuff.
And with 50,000 people or more, like with eyes on Bitwarden code, there is no obscurity.
Any vulnerability is found and rapidly solved and fixed.
People can submit PRs for it.
We also do a third-party audits and everything.
So what would you trust more?
Somebody who's like, oh, trust us, we're good.
Or another company that says, you don't have to trust us.
Here's how everything works.
And that's really like the gist of open source trust and open source security.
Nice.
And then I guess a typical follow-up question I have when people are open source is, you know,
I'm not going through and personally diving into the code myself for all the open source software that I use back here.
So do you guys do maybe audits, consistent audits that will audit the code and make sure there's no obvious issues?
Yeah, absolutely.
Like not only do we do our internal audits, we have the community audits.
We also have third party audits as well.
Cure 53.
We also have bug bounties as well through Hacker 1 too.
So we always have those reports coming in.
You can actually see everything disclosed on our website.
Bitwarren.com slash compliance has a bunch.
Then if you do a search for audits or secure reports,
you'll see every year's report that comes through.
All the testing, all the work that's been done to solve
anything that's been flagged as a potential issue.
And are those your, you said there's internal audits,
there's community audits, and external audits.
So I think the most familiar one to a lot of people
might be the external ones like Cure53.
Mulvad VPN does those.
A lot of other security and privacy organizations do these audits.
But can you explain the community and the internal ones that you guys do?
And if people can kind of see those?
Yeah, so the community audits, again, those are just people going through on the GitHub and looking at code.
And just hobbyists, security enthusiasts who are trying to make sure that they can trust the solution that they're using.
And then we also have our bug bounty program through HackerOne.
We actually recently wrote a blog post about that program.
And you can see more details there, including links to the HackerOne program.
And these are people who will try to attempt to find bugs inside of Bitward and inside the code.
When somebody is putting together a group of people that put together, I don't know, some sort of community pen test or group like that, we're happy to oblige by providing subscriptions, test subscriptions, so they can try and see what they can find.
Cool.
And the other kind of layer to this is forking the code.
I think another foreign concept is, you know,
someone can just take your code and duplicate it
and then spin up a similar service.
Is this something that you guys are concerned about,
Bitwarden clones,
or something that could be a threat to a business or an individual?
Or do you see that as just kind of a natural part of the open source world?
Yeah, that's just something that comes with open source.
We support the open source community.
There is a community tool that a lot of folks use right now for self-hosting that is built in Rust from some forked Bitwarden code.
And it's compatible with the Bitwarden clients.
And we're friends with those folks.
We made a couple of requests that they change their branding and all that.
But we support the open source community in what they do.
And it's also a really good, you know, some people will say like, well, what happens if like a meteor strikes and Bitwarden is wiped off the face of the earth?
What's going to happen?
Well, hopefully it doesn't take off all the GitHub servers at the same time, too, because then people could just, you know, grab the code and like continue on the service as it goes on.
Yeah, nice.
And I guess another question, you guys have a pretty large team.
So my assumption here is that it's mostly internal.
But do you have a general idea or percentage of community driven versus internal development?
Like, do you get any massive work ever done by a community member on your source code?
Sometimes community members will put together something really amazing that will bring in that has a huge impact.
One of the ones that came in from a community that is off the top of my head that I know.
So I don't deal with the code every day.
But I remember one was a new KDF algorithm called Argon2ID or Argon2.
People might be familiar with that.
Until this community member created this PR, this code commit for Argon2, we didn't really have it on our roadmap.
And now it becomes like a big touted thing.
Like, hey, look at this.
Bitwarren supports Argon2, which is a memory-hardened version of the KDF algorithm that people can choose as an option if they like.
Great.
And then I'm going to talk a little bit more soon about the privacy and security architecture.
We can dive a little more into the weeds there.
But on the topic of self-hosting, before we get there, do you generally recommend people stick with the hosted version of Bitwarden?
Are there pros and cons to people who want to self-host?
Who do you typically recommend that option to?
Yeah, so mostly for self-hosting, we recommend it to enthusiasts who really want to self-host and have concerns about data sovereignty.
Maybe people who want to put some extra security on it that they control, such as a reverse proxy, firewalls,
VPN requirements for their servers.
This sort of thing is usually for people who have like advanced technical knowledge.
And in particular, they also understand what it takes to back up a server.
Because if you have everything on your own, say NAS or even some of the less complex folks
might have, you know, just like running on a Raspberry Pi or on their home computer,
you know, sometimes there's uptime is your responsibility at that point, right?
Backup is your responsibility.
So for the people who are really interested in self-hosting Bitwarden, especially for some of our business customers, one of the first questions we ask to qualify them is, have you ever self-hosted anything else?
That's usually a really good clue of whether or not somebody might actually have the technical know-how or capabilities to do such a thing.
I have some friends personally who's like, oh, I have my NAS server, my own photo upload system set up.
and the NAS is hooked up to a UPS
and got extra failover with another buddy's NAS.
Yeah, okay, self-hosting might be for you.
But we include the cloud hosting for free.
That's kind of the best way to think about it.
It's like Bitwarden self-host is free
and so is the cloud hosting, right?
So the cloud hosting is probably best for most people.
Got it.
And then the last question before we dive
a little more into the privacy and security here,
the UI UX.
So my understanding is that you guys used
some kind of cross-platform code base,
and you've been slowly migrating to more native apps.
If not, you already have migrated to some more native apps.
So what's kind of the thought process behind that,
and where are you in that journey?
It might be something that might be worth getting our architect on for.
I do know a couple of things about this.
So first, we did recently, and by recently,
I mean in the last year and a half or so,
migrate all of our mobile applications to native code.
That would be Swift for iOS, and that'd be Kotlin for Android.
And that was a big adjustment that we had to do internally
because we were moving everybody off of Maui,
which was the language that we were using before that.
And then there's also been some additional movement
on updating our desktop application.
But that sort of thing is still in progress and being investigated.
Cool.
Have you guys been able to roll out any new features as a result of this?
Have you been able to do more system integrations
as a result of the native rewrite?
Yeah, actually.
We had a fun one come out.
Actually, both in the same month towards the middle of last year.
On Android now, you can do what's called responsive colors or reactive colors.
It's part of the Google Material You thing.
So if you wanted to set it up, you can have your entire vault be recolored to match your background on your phone, which is fun for some things.
And then we also have on iOS, we have some Siri integration.
So you could ask Siri to do things like Siri lock my vault or Siri log me out.
You know, just fun little things like that.
Nice.
Yeah, no, it's always nice.
That's like the benefit, I think, of moving to native apps.
I'm personally excited.
When I tried Bitwarden a couple years ago, you guys didn't have native apps yet.
And that was one of my big things.
I'm like, oh, it'd be really cool to have a native app for Bitwarden.
So I should go ahead and download it again to try out the app now.
Yeah, give us another shot.
I think you'll like what you see.
There's also been a few redesigns since then of our extension as well, the web app.
And then also we have a design team who's working really hard to get some really good unification going.
I think you're going to see some pretty big improvements to UI and UX in the next little bit too.
Nice.
That's exciting.
So privacy and security.
I kind of want to start with the general concept first here.
Because anytime I cover password managers on this channel, I think we have our audience.
We have the intermediate users.
but I feel like true beginners, people who have never heard of this concept before,
their first fear is, oh, this sounds scary.
This doesn't sound safe.
I'm putting all of my eggs in one basket.
So can you just kind of start off by talking about why is a password manager more secure?
And when it's maybe not more secure for a regular user,
so people just understand why this is a useful tool in the first place.
Oh boy, let me give you the whole pitch here for why people even need a password manager.
So I think the first thing, let's think about, I mean, shoot, I don't even know.
What was the latest breach we've heard about?
There's so many, right?
I can pull up my RSS feed if you want.
Let's see.
We had PayPal to breach exposed user data for six months, social security numbers, and unauthorized charges.
That's a big one.
Yeah.
Anyway.
French Bank Registry, 1.2 million accounts.
Mississippi Medical Center.
Yeah.
Anyway.
Anyway, all these sites have had breaches, right?
And so there's a lot of people out there, like myself included, before I even first joined Bitwarden, where I was like, oh, I have my own system for a password.
I use my same email address that I use or username for everywhere else.
Shoot, sometimes I use like my AIM screen name that I created like in the late 90s, right?
And then I would, you know, have some prefix, whatever I was logging into, what was about, say, insurance, and then a suffix.
Like, okay, I got it.
I can guess my password if I ever need to.
And that worked for a certain amount of time.
But, you know, you start getting a lot of breaches, breach here, breach there, breach there.
And then suddenly people are able to, like, cross-reference databases.
Like, hey, look, this username and this password was breached here.
This username had this password here.
Oh, look, there's a pattern.
Let me see if I can try and log it everywhere else.
And there's also such things called, they're called rainbow tables or compilations of the most commonly used or known passwords that have been created by humans.
And what some people will do, especially if they can get an offline copy of some data, is that they will just try your username and then millions and millions and millions and millions of passwords that exist out there.
And then maybe they'll get a hit.
Like maybe, oh, shoot, maybe you used admin Minda.
Like that's a very common combination or password one, two, three.
Or if something gets leaked, like, you know, people always have to rotate passwords commonly.
They might have their password, whatever password.
And then we'll say one at the end of it.
Oh, I have to rotate it after so many months.
It'll be two.
And then they have to rotate it again.
So what happens is that, well, the hackers will start going like, okay, well, I'll set this algorithm up that will attempt to log in with this breached password.
And then, oh, it ended with a one.
Well, let me try logging in with a two at the end.
Oh, guess what?
We just got in.
And so these are called credential stuffing attacks.
And they're probably the biggest threat that you see out there.
Basically, people will have botnets that can just attempt to log into your account.
And they are attempting to log into your account hundreds and hundreds of times a second with passwords that have leaked out on the Internet,
including ones that you might have already, if you're especially bad, if you're someone who reused a password anywhere.
So if you reused a password, say, I don't know, like even let's go back in the day if you wanted to break something out.
Let's say you had a Neopets password that was like really strong.
Right. And then that got leaked, which I think happened like several times.
But you use the same password on your bank account.
Right. Like they're going to try that.
These people are going to do that.
And they're just they just have algorithms and programs that are doing that.
So why is a password manager important?
I don't know any of my passwords because they're all machine generated.
They're all 18, 20 digits long of just random strings.
I have no idea how to log into my investment accounts.
I have no idea how to log into my bank account.
I can't even log into my insurance account, like I had mentioned before, because I don't
know those passwords.
I don't need to know those passwords.
The password manager takes care of all of that for me.
All I need to know is the master password for logging in.
Got it.
And later, I have a whole section dedicated to the eggs in one basket argument, because
what you suggest users do, how you can maybe make Bitwarden even more secure to help protect
against these things. So I want to touch on that later. But before we get there, so I think that's
a pretty understandable use case because a lot of people either like forget their passwords and it's
annoying to have to reset your password every time you lock into a service you created three years
ago. So it makes a lot of sense. But nowadays, you know, you have a browser password managers built
in to browsers. And also some people just keep local notes. So can you maybe speak to why still
a dedicated password manager might be useful compared to those tools or where maybe some of
those other tools might be okay for a user? Yeah. So a dedicated password manager, especially one
that's cloud-based like Bitwarden, pretty much you can gain access to your password from any device
that you need to. So this is especially handy if you're traveling or if you lose your phone and you
need to log in on a friend's phone. This way you can just like have cross-device syncing. I mean,
You seem to be a techie.
How many devices do you own?
It's complicated because there's like review devices for the channel.
There's my devices.
There's there's like the NAS that sits behind me.
So it's pretty all over the place.
You have a lot of devices, probably all running different operating systems.
Right.
So it's especially handy.
I actually just recently replaced my phone.
I was using a really old, an older Samsung like S21 and then FE like fan edition.
I don't really prioritizing having like the newest and the greatest phones.
Samsung released an over-the-air update that broke my SIM card.
My phone could not connect to anything at all.
And so I had to run out that day to go and buy a new phone.
First thing I install, Bitwarden.
Like I can just log into every service, no problem.
It's so, so, so easy, especially if you're ever like reformatting computers, getting a new computer.
It's very handy that way to have something that's cross-platform and cloud-synced.
Yeah, what I like to do in my password manager is I have a folder label tag, you know, whatever the system the password manager uses for a new device setup. So there's probably like, you know, your email client, whatever you use to sync browser bookmarks, etc. There's probably like a set list of accounts that you want to set up consistently anytime you update a device or you get a new device in your workflow. And for me, that was a big help for this exact thing.
So kind of the next question I have here is the cloud.
I feel like people are rightfully skeptical of the cloud.
It's not your computer is kind of what it is.
It's not a cloud either.
It's someone else's computer.
Like all of these kind of phrases exist.
And so when you think of storing your passwords on somebody else's computer, that's a pretty intimidating concept.
When you put it this way, even I get a little creeped out, even though I understand fundamentally what's going on.
So can you maybe speak to zero knowledge and then encryption, what that looks like, what it guarantees, what it doesn't, kind of the threat modeling process behind that?
Yeah, absolutely. And, you know, this is also something that I was first nervous about when I had first learned about password managers at all.
I remember hearing about one that had taken the market by storm back in 2009.
And I was like, why would you trust something like this? This doesn't make any sense for that.
This is before you had hundreds and hundreds and hundreds of accounts, right?
It was like, oh, I have five.
I can just remember everything I need.
So the really important part about this process
was what's called end-to-end encryption.
For people who aren't very familiar with cryptography,
you actually are.
You're just not familiar with the modern term of it.
So A equals 1, B equals 2, C equals 3,
and then you just write a code as you pass as a note to somebody.
That's encryption.
It's way more complicated than that these days
because A equals 1, B equals 2 is something
that someone could crack in half a nanosecond.
And instead, there's a lot of mathematical cryptography
that goes into making sure that something is encrypted
in a way that nobody else can read it
except for the person who has the key.
And when you work with an application
that's end-to-end encrypted,
and you can confirm that Bitware is end-to-end encrypted
because it's open source,
you can see how all the clients work.
The file that has all of your passwords in it
is encrypted on your device.
So on your computer or on your phone before it gets sent to the cloud.
And that's where it stays in storage.
It goes in the cloud storage.
There's extra layers of encryption that goes on top of it to make sure that it's absolutely 100% secure.
And then when you log in later, that encrypted thing comes out of storage and gets sent to your phone or your laptop or your computer.
And then you enter in the key to unlock it.
And then it unlocks and decrypts again on your device.
And there's nothing that gets sent back and forth that's not encrypted in your vault.
Perfect.
So you mentioned earlier Argon2.
Do you mind expanding where that fits into this picture and how and where that gives people a bit more protection?
Yeah.
So this is where things get a little complicated.
Thinking about how deep to go.
Okay.
Let's go all the way down.
We're going to go all the way down.
So when you enter in your master password, that's not actually the key that unlocks your vault.
And you can read all this in the Bitwarden white paper.
It's all posted online.
You can just check everything on the security white paper.
But when you enter in your master password, it gets seeded with an account seed that's also based off of your username and then becomes stretched out into a really long random code.
But it's not completely random because it's determinant, right?
So it just gets stretched out into a really long code that's suitable for using encryption.
And then that is used to unlock an even bigger code that's actually what's used for decrypting your vault.
And so your vault is actually stored with this really, really big key.
Now, the way to get to the key that unlocks the bigger key,
first you have to go through what's called the KDF algorithm,
That's key derivation function. And what happens is that it's imagine like a giant,
long mathematical formula, right? You enter in the first number, and then it goes through the
formula, and then it spits out a different number. That's considered one iteration. So when you enter
your master password, and then it gets rushed out into a key, then into the first key, and then it
goes through the KDF algorithm, it spits out a different key. By default, we use pbkdf2. And by
default, that's set to 600,000 times. So I said, you have to put it, you grab it, it goes through,
and then you take that result, you feed it back into the algorithm, and you do it again, and then
you do it again, and then you do it again, 600,000 times. And the point of that is to be a speed bump
for people who are trying to just guess your password, right? So it's intentional slowdown.
That's an intentional slowdown. So it takes a lot of resources to do it. And if you think about how
many guesses somebody would have to do to get to your correct password, if they don't know anything
is a lot, right? So after 600,000 times running through this on the default key derivation function,
then you get at what's called the master key that can then unlock your vault.
Now, Argon2ID uses things in a different way. Instead of going from taking the result and
dropping it back, taking the result again, that's a very processor intensive function and could be a
little bit weaker to GPU attacks. So that'd be somebody who's using like, imagine like Bitcoin
miners, right, who have hundreds and hundreds and hundreds of graphics cards that are just running
because they have a lot of cores. And so they're able to run this process a lot more efficiently,
a lot more quickly. Now, Argon2ID, the way that works is that it requires basically filling up
memory every time that it runs an algorithm. And so it really slows things down because
these days your graphics cards are probably more constrained by the available VRAM
than they are by processing cores. And so that just, somebody who is trying to guess rapidly
would quickly fill up all their VRAM and then crash your system. So it constrains how quickly
they can make guesses significantly that way.
Does that make sense?
Perfect, yeah.
You mentioned earlier on that there was some kind of key generation
based on the username.
Is that?
Yes, so that's currently how it is.
There is some work being done so that username can be changed
without affecting the encryption.
So anybody looking at the code right now would be able to see that
that work is being done.
So right now if you can't change your username or if you do,
then something changes?
If you were to change your username in a way that we do it right now, it would generate a new key.
You do that through the security tab.
No problem.
You can still change it.
It becomes a little bit more complicated in businesses when they're using SSO login and then somebody needs to change their email address.
For example, they got married and they want to change their last name.
It becomes a little bit more complicated that way.
So I'm trying to make it a little bit more modular.
Got it.
And does that mean that, I know this is so like not really a part of it, but technically,
does that mean that the username you choose has like the most tiny difference in the security
of the rest of the system?
Or does the rest of the system kind of supersede any kind of tiny benefit there?
Right now, it's just basically used a little bit as a salt.
Okay.
You can, again, you can look up to see exactly how it works.
We're a little bit over my head here.
But yes, so that's also why, too, if somebody were to do a vault export, if they choose like what's called an account-specific export, and then you try to import again later under a different email address, that won't work because it requires the way the seeding works.
So if you were to ever need to restart everything and you did an account-specific export, a backup won't work into a new account because that's account-specific.
Got it. Interesting.
Now, I want to talk about them.
This is going to be a whole section as well.
But for now, it's relevant here.
In the last pass data breach that happened where vaults were leaked,
something that was interesting to me,
and I never quite got a good answer about this,
it sounded like some fields in the last pass vaults weren't encrypted at all.
So what happened there,
because to me, when I first started getting the password management,
I'm also going to ask you about keypass in a second here.
KeePass is quite literally the way you define it.
Like you have a KeePass database vault.
And theoretically, it's easy for me to understand this single file is encrypted and then uploaded.
But based on the LastPass data breach, it sounds like it's not as much of a single file that's encrypted and more of like a dynamic, very complicated vault with various types of encryption, unless LastPass does something weird.
So can you maybe speak to Bitwarden and how it might differ from what LastPass does?
Is everything in Bitward encrypted completely or are there specific things that are not end-to-end encrypted?
Yeah, you can see this.
We have this documented on our website.
So first, let's start by talking about the LastPass breach and what happened there.
So that was a very complex attack that was not a result of any encryption-based breaches.
Does that make sense?
It was an operational breach.
So there was something that was not secured properly in their day-to-day operations.
And a very targeted attack was able to breach that and get this set of encrypted data out.
Now, there was a couple of problems with this encrypted data.
The first one is what you mentioned, that not everything in the vaults was encrypted.
And this was something that, you know, here at Bitwarden, we had kind of raised as flags for a long time.
is, you know, they actually actually had a link.
It doesn't exist any longer,
but there was a link to the help documentation that said,
yes, URLs for items are not encrypted.
And we do this to ensure that we can provide you a better service
and also serve icons to your fault.
But what ended up happening is that hackers who had all of this data
we're able to find like the the login like the URIs universal resource indicator which is a
little bit more than just a link right which is like a URL and we're able to find like really
specific ones and then target all of their cracking capabilities into those and this would be
crypto wallets for example somebody could be like oh this is the address for a crypto wallet
let me dedicate all of my time to cracking this and like sucking up the eight or nine bitcoin that
was in that wallet. It's still happening too. There's articles that they're still draining
wallets to this day probably due to that. As people are, yeah, as people, yeah, it's crazy
because it's still taking a while, which is also like a testament to some of the encryption because
it's been years now and it's still going through and they're targeting very specific, very specific
accounts to do so. Additionally too, LastPass had a little bit of a failure in the KDF algorithm
that I had mentioned. I said Bitwarden's default is 600,000, right? Back when LastPass first started,
their default was one. And then they upgraded it to 10. And then 100. And any account that was over
10 years, they didn't do any forced upgrade to the new KDF algorithm, because some of that requires,
you know, manual intervention, depending on how the system works. And, you know, because you have
to enter your password to like undo everything and redo everything all over again. So some people were
having all these crypto wallets that were exposed and only protected by a hundred cycles of this KDF
algorithm. So it was just trivial for someone just to set like a cracking machine onto some of these
vaults just to crack them open and get what they wanted. So this KDF algo, first off, has it always
been 600,000 for you guys or has it upgraded over time as well? It's upgraded over time.
And we're actually implementing some work to allow people to make adjustments without having
any additional inputs to, or logouts.
So it's still being hardened.
- Got it, and I assume for a regular end user,
someone might go, "Why not just blast it to the max?"
And I assume it's because it's gonna take a lot longer
for your system to unlock the vault
each time you type in the password.
- That's right.
People have tried on modern devices to go up to a million.
We'll let you do whatever you want.
You can go to the settings to do a million iterations
or whatever, and some people would report,
"Oh yeah, it took six seconds to log in."
You know, it's like, whatever, that's fine to get some additional security on it.
But 600,000 right now is the recommended amount of iterations based on NIST, which is the National Institute for Security and Technology.
So that's where that is.
And is the reason why this is adaptive over time is because computers get more powerful.
And so that your local device becomes more capable and has an easier time with a larger amount as well as an attacker.
So you need to keep bumping it up.
And it's overall going to always take the same amount of time to unlock.
That's right.
Yeah, it's a constant arms race.
Got it.
Perfect.
And we always have to balance, you know, like usability with the likelihood of there being issues.
Is it adaptive?
Do you do like a test when someone opens Bitwarden for the first time to test how powerful their machine is and then pick an algorithm based on that?
No, we don't do that.
Some people might not like it if we're tracking their machine, right?
Yeah.
I feel like it could be done locally somehow.
like if someone opens it and it just does a quick CPU stress test for like five seconds and sees how
the CPU responds and then automatically sets like a recommended algo that is that's a very interesting
idea I like the idea there's only one challenge here and that is the KDF algorithm is universal
across every machine so you could be running on your like super powerful gaming rig right
or you could be running on your dinky little laptop from 10 years ago or raspberry pi it would have to
have to go through the same level of algorithms.
So probably not.
Got it.
Interesting, though.
Just to clarify, what can Bitwarden see?
If I register for a Bitwarden account right now, I move all my passwords to it.
Can you see my email to log in?
Can you see anything inside the vault?
What can you see on your end?
Let's say you just wanted to leave the company.
You're mad and it's an insider threat.
And your goal is to find my vault before you leave.
What could you find if you really wanted to find me?
All right. So there's a couple of couple of things here is going to get into some fun stuff. So first, you can see whatever is collected and necessary on bitwarden.com slash privacy. Like everything is clearly stated, what's encrypted and what isn't. What's not encrypted is your login email address, right? Because we need to be able to see who we're giving the vault to, right?
So that's something that is kind of important to bring up here is that security and privacy often go hand in hand.
But it's important to remember that Bitwarden is a security company, and that's what we focus on is security.
And our services require that we have some data about you, like how to deliver you your vault from the cloud.
That's a little bit difficult to do if we don't know who or what it's going to, if that makes sense.
Got it.
And so other than that, because the email makes sense.
Yeah, so there are a couple of things.
So here's a really fun experiment you can do.
If you download the Bitwarden desktop application,
you can log into your vault, right, and download it and get it on your machine.
And then you can lock your vault without a pin code, right?
But if you lock your vault with the master password,
you can then actually go onto your computer,
find the vault blob in the data folder, and just open it up in Notepad.
And everything you see there is, that's it.
That's all that Bitwarden could see if we opened up your vault in the cloud too.
So that's it.
Yeah, it's pretty straightforward that way.
Got it.
And then how about, I assume, billing?
There is some visibility there as well.
Absolutely.
And subprocessors too.
So Bitwarden uses Stripe.
So there will be some pass-through for there.
And again, all that's available at bitwarden.com slash privacy for all the extreme finer details.
Yeah.
Do you guys support any cryptocurrency payments if someone wants to avoid fiat?
Yeah.
For people who want to pay with Bitcoin, we offer services through BitPay as our processor for that.
Very nice.
And then I guess kind of a final question.
I mean, it's not as relevant if it's end-end encrypted and you're working with small files.
But where do you guys host your data?
So BitWord data is hosted on Microsoft Azure servers in the United States.
It's hosted on the East Coast, on the East Coast servers.
And then we also have a EU option that's hosted in Ireland and the Netherlands.
Got it.
And then if one of those servers comes down, you guys lose access to data,
DF backups, is data stored across multiple?
Yeah, everything is stored by Azure and the Azure point in time processes for those.
Got it.
Okay, and then kind of the last privacy and security question,
this section was a lot longer than I expected.
But in a really critical situation, let's say you get a government subpoena
and it's like, hey, we have this email address for a user
and we want to investigate this user.
I guess what can you hand over?
as Bitwarden and what kind of ways are you forced to have to comply and what can you do?
And also, what kind of policies do you have on like challenging these court orders when they
come up? And do you guys have any kind of like transparency around this?
This is something that, interestingly, I haven't been asked about before, so I'm not exactly the
most knowledgeable on it. I'm sure it's somewhere in our privacy policy, but I do know that no one
will get anything useful besides like the administrative data that I talked about. Like
the strength of at minimum your master password. So like there's, there's, there's, there's that,
like that's not going to be of any use to anyone. Got it. The eggs in one basket argument is
something I want to dive into a little bit because I can make the same arguments to people that you
did. I think a lot of people understand the whole idea of having a central place that generates
unique, strong passwords for you. But then now you're stuck with the situation where, oh my gosh,
if I lose access to this one thing
or if someone I know breaks into this one thing.
Now they have access to all of my passwords
instead of maybe they'd have to guess each one
for all of my accounts
if I was using these semi-random passwords
that added a one or two at the end of them.
So what do you guys kind of suggest to users
who are thinking about this?
And do you think it's a valid concern?
Yeah, it's absolutely a valid concern.
And it really just comes down
to what somebody's preferences are
when you're trying to balance security and convenience, right?
So, for example, our first recommendation to anyone about password managers at all is use a password manager.
We don't care which, just use one.
Like that's going to be way more secure than not using one at all.
That you have random generated passwords for every account.
Now, obviously, like it's best to store all that in easiest to store everything in one place at a password management service.
But then you also want to make sure that any website that supports two-factor authentication,
multi-factor authentication, anything like that, you want to make sure that you have that enabled
too. Now, there's a lot of debate in the community about like, well, should I have my two-factor
authentication be integrated into BitWord? Yeah, I know that's what you're going to ask.
We get this all the time. Yeah, people ask it all the time. And I absolutely get it. What's nice
about having the two-factor authentication in your account, in your BitWord account, for example,
is that it just makes it really convenient for people to, you know, enter the password and then
paste the TOTP code. And we find that if something is convenient, people are more likely to use it
and therefore increase their security. And when you're using something like that, that improves
your security against, like I mentioned before, a rainbow table attack, credential stuffing attack.
It basically acts like a second password. You know, that's essentially not guessable,
which is, you know, very handy. But then some people will say, well, what if somebody got
into my Bitwarden account? Then I wouldn't have any way to prevent that. Well, the answer is make
Make sure you have two-factor authentication on your Bitwarden account too and practice
good operational security.
Make sure your vault locks or logs out at the right time.
Use a strong master password.
Use two-factor authentication.
Be sure that you're not in a logout loop.
For example, if you get logged out of your email address and then you have email 2FA set
up that you won't be able to get into your Bitwarden account because we can't turn it off.
There's no way to turn it off. So yeah, it really just comes down to how you want to do it and what
makes the most sense for you. Yeah. You guys released Bitwarden's own TOTP app, but it's
offline only. It doesn't sync via the cloud still, or did you? No, you can set it up to sync if you
choose. Some people just want it to be easier. For example, you can sync things over and then
disconnect the sync and then delete your seeds if you wanted to, just to just to make things a little
bit easier and separate. But yeah, the Tootp app is created, you know, as an alternative to the
built in authenticator and it's free. So I don't know if you're aware, but like the the integrated
authenticator is a premium feature, right? And if you don't have or pay for premium because Bitwarden
offers a fully feature free plan, then you don't need to use the integrated authenticator because
is you can also use the also free Bitward and TOTP app.
So you have all your options,
everything you need to be secure online right there.
Yeah, the one thing that I kind of also say,
because again, I get asked about this TOTP thing
all the time as well.
And for me, the TOTP, the main issue,
I feel like it prevents is a situation
where your data gets leaked without your knowledge
or something like this.
Like an account login, username, password gets leaked.
on some dark web forum.
They find it, they try to log in with it.
And no matter where your TOTP keys are stored,
you're safe.
Like that's ultimately, to me,
the best thing that TOTP offers users
is that second source of protection.
And then I feel like it's more of a high level threat
to be considering what if someone hacks
into my password manager database,
which would be incredibly hard to do.
So that's typically what I've kind of defaulted to
as a general option.
I don't know if you have any feelings about that.
No. Again, it all comes down to personal preference.
Some people like to have the convenience.
Other people, you know, they don't.
Yeah.
I have some that are half and half, personally.
You know, some inside Bitward and some not.
But it's really convenient for sharing things, right?
So, for example, like I share passwords with my partner.
And, you know, you want to have that two-factor authentication,
but it makes it really difficult, you know,
like you don't want to get a text message and be like,
hey, can you send me the code in the next 30 seconds?
But at least this way you can share.
It's also important for business applications too
that might require TOTP.
And you don't want to try and get a hold of Bob
who's on vacation and try to get into his email address
to get the actual authentication code to log in.
So that's another aspect of it too
is that you can share the TOTP codes.
Yeah, very good point.
And I have a hybrid solution as well.
I guess I haven't really shared that publicly at all
because no one's really asked about it
because it's always an all or nothing, should I do it?
But lately, I've always had a dedicated TOTP app,
and I never really stored them in the password manager.
But I've been getting really frustrated with the whole,
like, oh, I'm just trying to log into a service and get something done.
But my phone is in the other room because my phone is rarely on me.
And so I have to go grab my phone, log into it, get my TOTP stuff.
But anyway, I've set up a hybrid situation as well,
where for me, it's based on high security accounts.
So things like my email, my bank accounts, etc.
are still stored on a separate app.
And then I have just kind of like, okay, this is fine.
If someone ever got into this, it's not a huge deal inside of the password manager.
So that's been a good hybrid for me to balance the two.
That's great.
TOTP is also just one form of two-factor authentication.
So for Bitwarden, you can have email, TOTP code, but also passkey.
So you can use the WebAuthn FIDO2 passkey,
and in particular hardware security keys like a YubiKey.
That's personally what I have too.
I've got one in my wallet that I keep around with me all the time that's also protected by a pin.
So there's a lot of ways you can stay secure.
Got it.
Yeah, no, I love my YubiKey too.
That's my password manager access as well.
Do you guys use it as only a passkey or can you enable it to be your 2FA method?
So both.
You can use it to log in with a passkey or you could also use the passkey as a 2FA method.
Perfect.
And logging in with the passkey is pretty handy for a lot of people.
So passkey is still in development in terms of the standard.
The standard is out there, but sometimes you'll find that your browser might argue with you on who should be managing the passkey first,
and then your operating system will pop into you.
Yeah, I deal with this.
You see it happen.
Yeah, I try to log in, and I didn't mean to click log in with passkey, so then it prompts my extension password manager.
I say no.
It prompts my browser.
I say no.
but then it prompts my operating system, I say no.
And then it gives like the weird errors.
And then it like, ah.
- Yeah, don't worry.
Like we're actually, we're working with Microsoft,
we're working with Apple.
You know, you might've heard about
the credential exchange protocol,
which is something that an industry group
that Bitwarden has been a part of
that makes it easy to transfer pass keys
from service to service.
It's still an evolving and a very promising form of security.
Just need to work on making it a little bit more user-friendly
and have people agree on the best way
that things should work and what it should look like.
Cool.
I'm kind of down to the last few things here.
So first, I want to ask you,
well, actually before that,
I want to ask you about your setup.
But before, I did want to quickly just ask,
this is something I like to ask,
the open source projects that have enterprise and community.
Do you guys ever stumble on kind of a conflict
of which customer base to prioritize
when you're rolling out a feature?
Are you like, hey, we want to roll out this feature,
but it would be really bad for the enterprise,
enterprise customers, but it'll be really good for our community and vice versa. And like,
how do you guys grapple with that and decide who to prioritize?
It's always a balance. But, you know, some of our best features for administrators came from
the community. Like one of the big community requests that we had early on was emergency access.
And that was setting up a way for someone to access your account if you're incapacitated.
Right. I just, you know, as long as you have the premium feature enabled, any other Bitwarden user
you could set up as your emergency access.
And from that code came a level of key exchange
with another user.
And that blossomed into basically
our account recovery process for enterprise.
So there's all these features that are actually,
you know, maybe under the hood.
I mean, maybe on the surface, not related,
but under the hood, they are.
Like you get that code together.
So one can absolutely benefit the other.
Very nice.
And then what's kind of your personal setup
with your password managers?
If, you know, you only have to share as much as you want.
Yeah, I'll share some information.
So one of the things that a lot of people aren't aware of
is what's called plus address email.
So when you create your Bitwarden account
or any other password manager account
and you have a email provider that supports plus address,
that is your email address,
then plus, like the literal plus sign,
and then anything else at whatever.com,
it just still goes to your inbox.
So I would highly recommend that people create a plus address, a unique plus address email
for your login password for your login account and then set up a strong master password and all that.
And what's nice about that is that, you know, like if you're sure your email got leaked,
but not your plus address email. Right. And it's still going to the same account.
You don't have to worry about it. And then I would make sure that you absolutely make sure
that you maintain strong access to your email account if necessary.
So especially if you have like email T-O-2-P codes,
my email provider I secure with my YubiKey
and I remember the password.
So that's like one of the two passwords I remember, right,
is my password for Bitwarden and my password for my email,
and both of which are secured by the YubiKey
and the YubiKey secured with a PIN.
So you have to know a couple of things to get into my account.
Does that make sense?
Yeah, it's very nice.
I assume, I mean, I doubt that you're doing any kind of like large scale analysis here, but a lot of our audience is probably using simple login or like Addy IO.
So I assume the aliasing registration is going to offer a pretty similar thing.
Yeah, I do.
I would recommend, though, that if you ever lose access to your to your aliasing service, like might also be good to have that secured separately as well.
But perhaps the most important thing, and a lot of people forget about this, is making sure that you have everything in a security preparedness kit.
Like write down all the information you need, including a recovery code when you create your two-factor authentication to log into Bitward.
You'll be presented with a recovery code that will disable 2FA.
Write that down. Print it out.
Like put that on a physical piece of paper.
We have a security readiness kit on our website.
It's a template that I put together.
A lot of people love it.
I use it myself.
I've got my stuff written down, like handwritten and put into a safe.
So like that's if you ever find yourself in a situation in which you did lose memory or
access to something or someone else needs to access something for you, they can still
get that piece of paper and log in.
And someone would have to break into my house, go through my vault and know what they're
looking at to, you know, actually compromise that, if that makes sense.
Yeah, no, it very much does.
And it's not something people think about, but I had a family member passing, you know, like three to six months ago.
And I wasn't.
Yeah, it's thank you.
But it wasn't like, you know, I'm not their like go-to family member, but their go-to family member really struggled to get into their accounts.
It's not something people think about until it happens and then you go, ah, crap, I should actually think about this.
Especially, I'm sure, in our community because people really are pretty hardcore about their security and privacy.
So it's always important to build in those backup plans for the people around you.
Because what's the point of good security?
To me, security is about keeping good people in and bad people out.
It's not about keeping everyone out, period.
So, yeah.
Third-party integrations, I'm down to the last couple things here.
I know you guys do integrate with those alias services.
So do you have any other third-party integrations that people should know about?
Some of our two-factor authentication also includes Duo, YubiKey, OTP.
That's for individuals.
And then we also offer a lot of integrations for enterprise, lots of integrations for enterprise.
And if there's something that you don't have an integration for that we don't have, we have two API keys that you can create your own integrations with.
It's actually really cool.
I highly recommend you check out the documentation on that, but you can pretty much do anything you need to.
Nice.
AI, company stances on that?
We did recently release a MCP server for people who want to use AI, you know, a self-hosted MCP server to use with other self-hosted installations for people who are experimenting with that sort of thing.
So like NAN, then people could like automate things with Bitwarden?
Yeah, you could do, you could do auto, you know, you just be able to like, you know, say like, hey, send a Bitwarden send, which is an encrypted communication to my friend that contains this password.
And it could do that for you and send it out.
But, you know, this is mostly for the advanced people who know what they're doing.
And so we've had that, we have, we have that documentation online.
So you can, you can see that.
I didn't know you guys had an MCP server.
So we're not doing, you know, putting AI into the products.
Right.
Yeah.
That's a lot of people are very uncomfortable about that idea.
I think it's the right middle ground.
I think the problem right now and why so many people have this.
Well, there's a lot of reasons why people have a visceral reaction to AI.
But I think one of the core ones is because it's just kind of shoved into the product without much thought into like what it's actually doing for the user.
But I feel like in a lot of those situations, an MCP server would actually solve most of the use case there.
because then you're actually doing something useful potentially with the data.
And I feel like the example you gave is a really good one.
And that'd be far more useful than some like, oh, summarize my vault for me.
AI feature.
I think if you're really comfortable about and you have everything on-prem, right,
which is an air-gapped, which is also a possible thing too.
Somebody could be like, hey, here is, you know,
they get set an agent that connects to like their Slack or something.
And Slack say, hey, give this person access to this item for 25 minutes.
And then, you know, there's a lot of options.
And, you know, when people are working on this, like, we love to hear feedback from the community.
Nice.
A few hours before recording, I have a signal group with some community members in it.
And there is a little bit of outrage because they got an email from 1Password that they just raised their prices quite substantially.
So I did want to just quickly check in.
You said there's always a free plan and that's been a promise.
How do you guys handle price increases and how do you do that, you know, transparently?
And is that something users should expect at some point as well?
So it's funny, this is actually pretty timely.
Bitwarden, we did update our pricing for our plans last month.
And so it was our first time updating pricing since the inception of Bitwarden.
So it was $1.65 a month now charged annually for the individual plan.
But we always have the free plan and the free plan will always be there.
And it already has everything everybody needs.
So you can see the communication.
You can see what the community says.
Most are fully supportive of that sort of thing.
Yeah, I mean, it's still just pennies for good security.
I think it's good.
And then FDroid.
Do you guys have an FDroid app?
We do.
There actually was some chatter about it recently because we had an issue with it publishing.
I need to double check on that.
But it is there.
And people who are like really big into like looking for looking at trackers and stuff, they might notice on our Android app, some tracking applications will say, oh, your Android app has two trackers in it.
Well, it's it's it's Firebase and, you know, crash analytics.
It's nothing.
We're not tracking your data.
But if you want a version of the app that doesn't have those analytics, you can get the FDroid app.
And that is that's out there.
Got it.
And then is that on the official repo or do you guys host your own repo?
It's on the official repo.
OK, very nice.
Linux.
You guys are on Linux, too?
Yeah, of course.
Yeah, we support links.
Yeah, well, so many different kinds.
You can go to bitwarden.com slash downloads
and see all the different options that are there.
Perfect, just making sure I cover my bases
before I get comments about it.
So that is all I have.
Do you have kind of like a final takeaway
for all our viewers?
Yeah, I do.
So first, I do want to add one more thing.
We didn't talk about it before.
We were talking about security on the cloud.
And that is, you know,
when your encrypted vault is uploaded
to the Bitwarden cloud server,
it doesn't just sit there
only protected by your master password.
there are, well, we call it multi-factor encryption.
There are at least three different other layers of encryption
that go onto the cloud server with keys in different locations
that are all protected significantly through key management software
that makes it so that even if there were like some sort of cloud breach
and somebody was just able to grab the blob of the entire Bitwarden server
and take it down, there's nothing there for them, right?
So that's another important thing to talk about.
Like there's no way that anybody will ever get anything into a state that would not have more than three levels of encryption on the cloud server plus your master password encryption.
So something to think about if you're ever worried about security of the cloud server.
Nice.
And then the final message to anybody out there who's interested about security, use any password manager.
Choose whatever works for you.
It doesn't have to be Bitwarden.
Just anything that works for you that you will use is going to make you vastly more secure.
We would like for you to use Bitwarden because, you know, we think we have one of the best
products on the market and it's free with unlimited passwords, unlimited devices.
There's no strange limitations on that.
So absolutely, you know, check us out.
Get any password manager at all.
Get your friends in a password manager because passwords are very stubborn.
They're not going away.
And, you know, you need to absolutely make sure that you are secure in this crazy cybersecurity world.
Perfect. And is there anything on the pipeline that you're able to share that you guys are working on with the audience?
Yeah, there's one thing, especially for Linux users that are interested in this sort of thing, although not out for Linux yet.
One thing that people have been kind of waiting for with bated breath for as they're seeing some of the code be developed is what's called autotype, desktop autotype.
And that is a very, especially handy for people who use virtual machines all the time and they're logging in remotely connections.
And that is just being able to have the desktop app essentially type for you the password out into an application that's local on your machine.
So very handy where you, you know, for example, need to put something into a window that might not be a browser.
Right. And so people are definitely excited for that.
It's going to initially come out as a Windows only feature for the desktop application.
But we're still pursuing going full platform with that.
Awesome.
Well, thank you so much, Ryan.
I know this is very thorough,
and I hope that we were able to at least get some people
using some more secure passwords out there.
Awesome. Yeah, thank you for your time.
I want to thank Bitwarden for coming on this podcast.
It has been a complete honor.
They are a community favorite service,
and so to actually have them on here and talk to them directly
has been an absolute pleasure.
If you have any questions, definitely leave them.
down in the comments on YouTube or I suppose on Spotify too. And if you want to support this
podcast and keep it going, you can also consider becoming a TechLaurian. You get access to a private
signal group. You also get access to my own private RSS feed that I curate with news on a daily basis
and many other fun perks while still contributing to our content. Thank you all so much for being
here, for listening and keeping yourself and the people around you a little bit safer. Until next time.
Субтитры сделал DimaTorzok