00:00 Hello, I'm Seth For Privacy, and welcome to Season 2, Episode 9 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Looking for the right tool for password management? Wanting to make sure you use something that's open source and encrypted by default? This episode, we're going to sit down with Ryan Lubrin to chat about Bitwarden and their password manager tool.

Welcome on to Opt Out, Ryan. Hi, Seth. Thanks for having me here today. Yeah, I'm really excited to finally chat with somebody from Bitwarden, as it's one of the first tools that I started using and kind of started using to organize my digital life as I transitioned into caring more deeply about my own personal privacy and my own security, that have my wife and family members, too. So it's been an absolute must-have for me and a critical piece of my toolkit.

So I'm really excited to walk through it a bit, learn more myself, share with listeners, and just get people learning a little bit more about what Bitwarden is and how it can fit into their toolkit. But for those people who aren't familiar with you or Bitwarden, do you mind introducing yourself and telling us a little bit about what Bitwarden does? Absolutely. My name is Ryan Lubbibrand. I am in product marketing at Bitwarden. And what Bitwarden is, is a password manager.

I imagine that a lot of your audience is already familiar with what a password manager is. But basically, it is a piece of software that can generate, save, and then autofill passwords that you create. The important part is the generation part. I mean, of course, all of that's really important. But the generation part is what's really important in that it can create long, random, complex passwords that you don't have to bother learning to remember.

All you need to know is the one password that you need to get into your Bitwarden account. How long, Seth, have you been using Bitwarden for? I want to say going on a year, year and a half maybe at this point. It's been a while. Got it. That's great. No, Bitwarden's been on a pretty fantastic journey over the last several years. As a company, we've had a lot of growth internally. And we've been driving ourselves towards a vision where we just bring internet security and password security to everyone.

And I'm sure if you look back in the earlier forums, you'll see our founder, Kyle, was originally using a password manager on his own and just didn't like the features that were basically and said, you know, I could probably do better than this and decided to create an open source alternative. And that's where Bitwarden started. And he's been doing that and was managing, like, all the customer support himself and eventually decided, like, hey, like, I don't want to manage a company.

So he ended up hiring some people who were really good at building a company around him. He actually is now the CTO and was the startup Bitwarden. And that is basically, like, our history in a quick nutshell as we're continuing to grow and become community favorites as an open source password manager. Yeah, it really does seem that they all have kind of taken over a lot of the mindshare recommendation space, I guess you could call it, especially in the privacy and security companies.

And I do think those two key pieces are that it's a solid open source alternative. Because I think of all the things that we use, a password manager is one that really needs to be open source. We can verify that it's doing what it says that it's doing for us, that it's actually securing those accounts. In the case of things like Bitwarden, that it's actually encrypting locally before sending to Bitwarden servers, all of that kind of stuff. So the open source nature is extremely important with a password manager.

But I think we do definitely take for granted, those of us who use password managers, take for granted that a tool like Bitwarden and password managers in general is not something that everyone uses. So it is definitely something that if you're not using a password manager, obviously, the key risks are that you're probably reusing passwords across different accounts, which could open you up to a lot of issues. If one of those accounts gets the credentials leaked, which, as we know, happens all the time these days on the internet.

So using something like Bitwarden really does help to not only improve your security online, but it also just drastically improves your experience when using different accounts. Because like you mentioned, the autofill piece is a huge, huge one, especially through the browser extension. Being able to autofill those passwords directly to know what site needs what user information, all that fun stuff. So there's a lot of key pieces that go into the password manager and getting started using one.

But if people haven't used one yet, obviously, I've recommended Bitwarden so far, but I'm excited to dive into that a little bit more here. Absolutely. And a little bit of background. Actually, I joined Bitwarden early last year. And I have to admit, I'm a recent believer in password managers. I thought I was more clever than anybody else out there. I had a system. I had a prefix. I had a description of the website I was going to. I had a suffix.

If I forgot my password, I could just guess using that pattern. And I would definitely, usually most of the time, make it in. You know, think of the, oh, the system that I have is great. But then as you say, like you get a couple of leaks out there that are all attached to my personal email account, which I didn't vary between that because I wasn't really thinking too much about security at the time. You would just need two or three passwords of mine to leak that you could link back to me to figure out the pattern and guess and get into my bank accounts, for example.

So now, like truly seeing the light, I don't even know the password to my bank accounts. I don't know the password to my investment accounts. Like they're all completely random and stored within Bitwarden. So I just count on autofill. What you mentioned is great. And autofill is wonderful for two reasons. One, it makes sure that you're not accidentally putting in your password on the wrong website, you know, like a phishing website that might look similar or look alike.

And then, two, I mean, it just saves you a lot of time. You don't even have to remember the old password or try to find something. It's actually relatively life-changing. And something that some possible Bitwarden users might not be aware of is just the hot key for autofilling is Control-Shift-L or Command-Shift-L. I recognize that we don't do a great job advertising that, but that really makes all the difference when it comes to autofilling with Bitwarden.

I had absolutely no idea that that was a thing. Yeah, well, you know what? I just improved your life. Mind absolutely blown. I will be playing with that right after we finish recording. Nice. Absolutely. So before we dive too much more deeply into Bitwarden itself, I always love to hear a little bit more about the specifics and kind of the history of the people who are building out tools like Bitwarden today. So I'd love to hear a little bit more about what it was that woke you up to the need for personal privacy.

So Bitwarden's always focused on security more than privacy. We don't like to call ourselves a privacy company. It just so happens that what we find to be really focused on the security that we care about, the end-to-end encryption, also happens to be really good for privacy. And we want to maintain that as well. So end-to-end encryption, as I'm sure many listeners already know, is just data on your device, whether it be PC or phone, is encrypted locally before it's even transmitted.

So everything that, for example, if you were using Bitwarden Cloud to maintain your vault, your password vault, which has all your data in it, Bitwarden can't see in it at all. Bitwarden doesn't have your decryption key. It doesn't have your master password. There's no way for us to see any information inside of your vault. We wouldn't be able to, not even the URLs. So just so you know, some password managers will have the URLs for your logins. They don't, they decide to not call that personal encrypted data and will use it for quote-unquote analytics purposes.

But with Bitwarden, we can't see anything except for what we call administrative data, which is, you know, everything we need to know to get the vault to the right person when you request it and log in. But what was it that woke me personally up to the use of privacy? Again, you know, working for an internet security company can make you paranoid really quick. It's probably the best way to describe it. It's very true. Yeah. And I've learned so much just in the last few years about, you know, using a VPN and just what end-to-end encryption means.

But when focusing on internet security and back to Bitwarden, when you do security well, it really provides a large degree of personal privacy. And so that's where we like to put our focus. Does that make sense? Yeah, no, it definitely does. I think you did a really good job of breaking down the difference there. Because it is important that people don't kind of assume that Bitwarden is a tool that provides them privacy while online specifically.

But you also, I think, really well mentioned that it does provide you privacy and that it helps you to secure your accounts online, which limits the amount of data that can be leaked and hacked. It limits if one of your accounts is being held by somebody who leaks it or has it hacked and stolen, that password is not the same one you're using across all of your other accounts. Hopefully, too, that email address isn't one that you're using across all your other accounts if you're using some sort of A-link's.

10:00 aliasing service like SimpleLogin. So having strong passwords, random passwords that are unique per account that you have online, it does link back to privacy. But obviously the key piece is security there. So I often do conflate those two because they do so often go hand in hand that I really can kind of refer to them interchangeably. But it is very important that people do understand that the difference is there and understand that Bitward really is a security first tool.

But when you have good online security, it helps to enable you to have good privacy, and vice versa in many ways as well. So it's a really good call out that there's a lot of crossover there. Well said, very well said. So jumping back into Bitwarden, what's kind of the key thing that you hope users get from using Bitwarden? I know we talked a little bit about just really the simplicity of being able to not have to remember the password to every single account that you have online.

But is there any other specific thing that you're hoping that users who jump in and start using Bitwarden get out of it? The main thing is really added security and peace of mind. When I kind of, I guess, you could say I ceded control from my financial accounts to Bitwarden, actually was a huge kind of weight lifted off my shoulders because I know that now that password is incredibly strong. So it's like a really weird psychological thing. I don't even know how to describe it. I would never even put that in my marketing materials. I don't even know why I'm telling it to you right now.

But just that little bit of peace of mind and added security you get for managing your passwords is incredibly useful. Additionally, time savings are fantastic. You get, I like to joke about my wife, like her password was the I forgot my password link. And so whenever she was never logged in anywhere, she always had to go through the process of updating her password and remembering her security questions, which you know, are also not the safest vector either sometimes.

And it just saves a lot of time whenever you're on a different device or new device or logging in, especially with the hotkeys, as I said, control shift L command shift L. At work, it's great for sharing. So that's one of the problems that Bitwarden really excels at is sharing passwords securely, or not just passwords, but like anything within your personal digital vault, which could include credit cards, like if you're with a partner, or it can include corporate credit cards, It could include secure notes like what this code is on the safe in the closet.

Or it could include the corporate Twitter handle. And in particular, the two-factor authentication toe tip seeds in there. That is the code that counts down and asks for you to enter a code to log in. That way you're not texting a coworker who has Authy on their phone at the time or whatever. And they're on vacation out in the mountains. And you need to do an emergency tweet and you need to get a hold of this one person. It just adds a lot of convenience to managing your online security.

I've recently started using that, actually. And it's called organizations within Bitwarden, right? Is that the main way that that kind of password sharing and information sharing happens? That's right. To get into our nomenclature a little bit, when you have your own Bitwarden account, your Bitwarden account can join an organization, which would be your family, or it would be your business. And once you're a member of that, you have access to collections.

And collections are basically the shared folders of passwords and other vault items. It's not standard nomenclature, but it's how we handle it at Bitwarden, if that makes sense. Yeah, I think it does make sense once you kind of get used to the language there. And it's been a really important tool for me, personally, less from the idea of sharing information with other people to be able to both access the account at the same time. But I think another valuable use case is kind of as a, I don't know if this is the best term, but dead man switch to share accounts that are critical in the event that I was incapacitated or something happened to me, my wife would still be able to access the important things that we share, even if I'm the main person that manages the account.

And that doesn't, like you said, it doesn't have to be something where she has to rely on a piece of paper that I've written it down on, or she doesn't have to just hope that that doesn't happen. It's a good way that I've found to be able to enable her to have access to those accounts in case of an emergency, even if I'm the main one that's managing them. So it's kind of like an alternate use case, but I am hoping to explore the sharing piece more, especially like among family members.

And as I kind of start to share some of the work, maybe at the podcast with other people, that sort of thing. Yeah, actually, it's interesting you mentioned that because, yes, I do the same thing. I have a collection with my wife for all the utilities and the mortgage payments. And, you know, if something were to happen, she has access to the bank. access to that and can log in and handle stuff because, um, I mean, it's never fun to talk about the morbid stuff, but it can take, especially these days, it can take months to get a death certificate and you can't do anything until you do get that. So like what happens if your electric bill was on auto draft or something, or like, like you're sitting at home and suddenly use electricity and you have to like plead with the, with the, there's, there's too much going on at that scenario. So, um, it's funny this comes up because this is something that I'm a little bit passionate about having just gone through a death in my family. Um, and with, without like a managed

estate and premium accounts at Bitwarden, uh, there's a, there's a feature called, uh, emergency access and you can designate another Bitwarden user to be able to take over your entire account after a set amount of time. So it's, it's actually, it's, it's really neat. And I like to, uh, we can bring it up later break. I could talk about it for a long time, but the way it works is, um, that person would request control of your account, right. You would get alerted about it. And after 30 days, they would be granted access to your account. So, you know, long enough that, you know, you can, you can manage bills that might've gotten past due. Um, for example, in the case that, uh, you and your wife were both incapacitated at the time, um, and you needed to help manage things, or you could include, uh, you can, uh, you can attach files into vault items too. So if you needed to include like insurance information or, um, even like who my current lawyer is to hand that handles my, that has my legal will, like there, you can put that in there too, that information for whoever you

need to. So that's, uh, a very long side conversation, but it's, it really just shows like what you can use a personal encrypted vault for beyond just storing passwords. Yeah, definitely. The main use cases is storing and auto filling passwords, but there's a lot of value, like you mentioned, and in those things, I don't know like that specific topic isn't a fun or exciting one, but it's an important piece, especially as we continue to move more and more digital and get really everything online. Um, and a lot of the tools that we use do not have any kind of built in ability to, to handle those kinds of situations. So having a tool like Bitwarden to be able to do that is, is very, very important there. Um, and no, we talked a good bit about the, uh, I guess kind of the, the positives and the advantages that Bitwarden brings, but what are some limitations that users who start using Bitwarden or already are using Bitwarden should be aware of in using the service.

There's a little bit of a catch-22 here, right? Because one of the reasons you want a password manager is to manage your passwords. You don't have to remember them, and they have to be complicated and stuff. But of course, you need to have a password in order to access your password manager. And that password manager needs to be long, complex. But you also need to remember it. And the way the end-to-end encryption works and zero-knowledge encryption, I mentioned it earlier, Bitwarden has no way to access your data.

All it is is just a scrambled encrypted mess. And without the actual encryption key that's generated as part of your password, nothing can be done. So what I'm getting at here is that if you forget your master password to log in to Bitwarden, the best that you're going to be able to do is delete your account and start over again. Now, depending on who you ask, that's an advantage, but not a limitation. But to people who may not be used to having to...

It's pretty high stakes for remembering that password. Yeah. You can't just rely on the company. You could have a designated emergency contact that could take over your account in the event that you lose your master password and cycle your master password for you. But that's... Yeah, it's really not a great scenario for individual users. Yeah. And that's just a tricky one that you can't really work around if you're actually doing the encryption that you say you're doing.

And that's really kind of a key tell for any company that is claiming to do end-to-end encryption. If they can still restore your account somehow, there's something going on there. Because they shouldn't be able to have access to that unless they have that secret that you got when you generated the account or the password you use, like with Bitwarden. So it's definitely... There's a key reason why that limitation exists. And it's a very important one because you don't want Bitwarden or anyone else to be able to access your passwords without your knowledge and consent.

But yeah, obviously that drawback of any service that uses true end-to-end encryption is if you forget all of the ways to access it. It's just kind of gone. The same is true of other things like cryptocurrency, where if you forget the seed phrase to your wallet, it's gone because there's no central company that knows that and can return that to you. There's a lot of different scenarios like that as we kind of get into the self-sovereign or data sovereignty.

20:00 piece of privacy and security. A lot more responsibility falls on your shoulders, but a lot of major and very, very important advantages come along with that. A little bit of a, you touched on it a little bit there. We actually just posted a blog about Web3, and we talk about exactly that, where decentralization of everything is great, but you got to make sure you manage it well. So I would, yeah, go check out the blog about it, bitwarden.com slash blog, and read our opinions on what Web3 brings.

Yeah, I'll definitely be sure to link that in the show notes so people can jump right into that after they're listening or while they're listening. So I did definitely want to dive a little bit more into the settings and features that listeners who either start using Bitwarden or have been using Bitwarden should become familiar with. So is there any specific features or settings you'd recommend people take a look at and get more familiar with? Yeah, so for beginners, first comers to Bitwarden, a couple of things.

First, we already talked about the autofill hotkey, control-shift-l, command-shift-l. Really saves you a lot of time. If you have the Bitwarden authenticator that comes in premium accounts, when you use that, it'll also copy the toe-tip phrase to your clipboard that you can just paste at the next screen. So that's definitely one thing that you want to be aware of. I see a lot of people on forums will say, oh, I don't like I have to go up to the thing, click it, and then click it again.

That's a great way to save a lot of time and get in a lot faster. The next thing that people should look at when they're starting, especially if you're in the password manager for the first time, is to go into your Chrome, Firefox, Valdi, Brave, whatever settings, and disable saving passwords. So yeah, you can always, it's too easy to accidentally save a password and then your password manager just sitting in the background forgotten. And then you go onto an application or to a laptop that's maybe not be one you use all the time and you try to log in and you're like, I had this password saved, where is it?

I'm not realizing that you left it on your browser locally on your other machine. So definitely want to look at disabling the browser password storage, your default storage system. setup that they have. The Bitwarden Web Vault, that is vault.bitwarden.com, is probably, I want to say probably the most featured web vault that we have. It has the most features out of everything. There's some settings you can only change there. So even if you have the extension installed, definitely recommend going to vault.bitwarden.com to log in, look at other settings, manage collections, manage organizations, set up two-factor authentication, which is incredibly important.

And, you know, it's so important, we are sure to include it in even our free versions. So definitely go to the web vault and look at those settings and be aware that you can access it on any device with a modern browser as well in case you find yourself on a PC where you don't have install privileges, for example. Yeah, the web vault's been a really useful one for me, especially like if I either have to use an OS that I'm not normally using but need access to a password or if I'm having to like access something in an emergency on someone else's computer, the web vault's a really nice way to be able to do that without having to trust their computer, be able to install something or accidentally leave myself like logged in to the extension or something like that.

You can just pop open a private window so the session isn't saved and then use the web vault for that specific use case, which has been a nice one for me. Let's take a quick break from this episode to chat about the sponsors of Opt Out, Cake Wallet and LocalMonero. Cake Wallet is a key tool that I use daily as it allows me to easily and quickly use Monero for private by default payments. It's available in both iOS and Android and is a fantastic way to get started buying and using Monero with a simple and easy to understand user experience.

I regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency. If you're interested in purchasing Monero for the first time or helping to bring others into a parallel economy, I'd recommend you look at using LocalMonero like I do to buy and sell Monero while maintaining your privacy and avoiding invasive exchange surveillance. LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy.

Thank you to both sponsors for their incredible support and partnership. And I hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors. So one thing too, Bitwarden is really big about sharing securely, right? Sharing password, sharing login securely. And on that same note, we have a product within Bitwarden. It's a feature called Bitwarden Send. And how it works is basically you will select a file or some text and it will get encrypted and uploaded to servers.

Again, end-to-end zero-knowledge encryption. And you, the user, will receive a link that has the decryption key embedded within the URL. And then what you do is that you can send that link to anyone, not just a Bitwarden, but anybody. And they will access that link. That file will be downloaded or the text will be downloaded. And using the key within that URL will be decrypted right then and there. So it's a great way to transfer important data, important files to anybody, including non-users.

So for example, we're hitting tax season. You might have a CPA and you need to get some sensitive tax information to somebody or they're requesting like your 1040 from last year. You would just use Bitwarden send to send it over to them. And you can put extra controls on it too, like how many times it could be downloaded. You can even put a password protection on it. So if you were, say, a company and you're trying to send prototypes to a manufacturer on the other side of the world and you don't want it to go through like unencrypted email or anything like that, through your work email or through another file transfer service, you could use this end-to-end encrypted Bitwarden send to get the data over to them in a way that's completely safe and secure.

It sounds really similar to, I guess, was it Mozilla send or Firefox send? But there was a service kind of like that in the past that I think has disappeared even though there's an open source version of it now. People reference that all the time when they talk about Bitwarden send. I believe it was Firefox, as you said, and I believe they had a one gigabyte file limit at the time. Currently, our system is set up for 500 megabyte limit and people say, hey, can you do like what Firefox used to do and do that?

So we're evaluating that feedback right now. Yeah, it's a really, really powerful tool. I've been self-hosting the open source version of what was essentially Firefox send and there's so much value in just being able to simply share a file with someone and not have to have them also have an account somewhere or have some special app or anything like that. There's definitely a lot of value there. So I'm glad that you mentioned Bitwarden send. And the last thing that I think is really important to talk about for new users to Bitwarden is vault timeouts and biometric unlock.

So after a certain amount of time, you can tell your Bitwarden extension or your application to perform an action. Usually that involves locking or logging out. You just said, you know, accidentally log in to an extension. Sometimes you find yourself on a shared machine or, you know, you walk away from your laptop for some reason, you know, the worst thing you could possibly do for security, but things do happen. You want to make sure that over a certain amount of time that your vault will lock so that nobody can just straight up access all your information.

And when you lock it, you can choose it to unlock with a pin for, you know, four digit pin or unlock with biometrics. And if you have a PC that has a fingerprint reader or if you're using your Apple iOS and you have Face ID, you can use that just to unlock your vault and get right back in it really quickly. So that's also a really useful thing for beginners. Awesome. Thanks for walking us through some of the key features there. There's so much to explore.

And I think a lot of people just assume a password manager is a super simple or like a very small feature set tool where all this is generate password out of full password. But there's definitely a lot more within Bitwarden. And one of those things that you mentioned that I'm curious to hear a little bit more about because I haven't explored it yet is how two-factor tokens work within Bitwarden. So not actually using two-factor to secure your Bitwarden account, even though, like you mentioned, that's super, super important, but actually generating the two-factor codes for other accounts within Bitwarden.

Yeah. And it's actually a, it's a subject that has advocates on both sides. And if you, if you want to start an argument on a forum, like this is the best thing to bring up because people have varying opinions on it. So here's, here's the, here's like the, the stance on it. So firstly, separate from two-factor authentication, the Bitwarden authenticator within Bitwarden, make sure that you enable two-factor authentication on your Bitwarden account in the first place.

and then any other website that has two-factor authentication, absolutely turn that on because credential stuffing is an attack where people just try random passwords that, you know, might have leaked in the past. The best way to solve

30:00 that problem is to have two-factor authentication enabled. Now, two-factor authentication within Bitwarden, Bitwarden has for premium accounts what's called the Bitwarden Authenticator. And that Bitwarden Authenticator just, it sits inside of a vault item. So you have like a login, username, password, and then you can put in what they call like the TOTIP code, T-O-T-P, timed one-time passcode code. And it will, you know, generate a six-digit code that can be used as your two-factor authentication for the login. Now, the merits of whether you want to have that stored alongside your password can be, you know, debated until the end of time. The important thing is that if you find yourself with a shared password, I'd mentioned it before, like if you're trying to share with the office and someone needs to log in, now you can just also share that code alongside the password. So you can just log in quickly and easily.

So having any two-factor authentication is better than none. And when you're looking to share this two-factor authentication, this TOTIP through Bitwarden Authenticator, it's also an excellent way to do it within Bitwarden. I think you hit the nail on the head, especially with the sharing piece that I haven't really considered before. Because like I mentioned before, I share accounts with my wife and all of those have two-factor. So it can be really annoying to have to like message back and forth the two-factor code and signal or something like that. So being able to share that easily there, I think is a promising use case for basically anyone who uses password sharing at all. But also, I think kind of the way I would approach it is if you wouldn't use two-factor otherwise on an account, use two-factor within Bitwarden.

I definitely do see the advantages of like having your two-factor on a separate device that's like always going to be in your possession, like your phone. But obviously, then your phone has to be properly secured. You have to worry about that in addition. So there's definitely the pros and cons on both sides. But I think if nothing else, like if you're not going to use two-factor on that account otherwise, or you're not going to use two-factor at all otherwise, using it within Bitwarden can be a very simple way to bundle that with the passwords that you're already storing, generating, and autofilling. It's also incredibly convenient too with autofill because it does paste, or rather, it does copy that to your clipboard. So you just paste it into the next screen, just log in within seconds. And it's definitely a great way to boost your security. Bitwarden, if you do want to move to another service for your authentication, you can access your ToteTip seeds. They're not hidden behind something. You don't have to do any weird temp data hacking to get at your seeds. You can just access

them at any time. So if you wanted to switch out, and let's say your security risk profile has changed a little bit, and you want to try something a little bit different, you can just copy and paste out of Bitwarden into another authenticator, and then remove that data from Bitwarden. So that you, there's no purpose for keeping your data locked down. So that's also one of Bitwarden's policies, that we want to make sure that people can get their stuff out whenever they want to. Like data mobility is pretty important.

And well, that's just one of the things that we care about is being an open source company as well. And that's a really good call out, because if something were to happen to like Bitwarden's servers, but you're using Bitwarden Cloud, you would have that data locally still. So if you wanted to move out something else, or if Bitwarden went under, or something happened, you could transfer those two vector codes out as well as your passwords and usernames. So that is a really important piece to call out. And there's very little chance and really no way that you would lose like your Bitwarden data on all your devices, and Bitwarden Cloud would be destroyed all at the same time. So Man, we were talking about morbid subjects before, but I think that takes the cake.

Yeah, I have no idea what kind of apocalyptic scenario would do that. But we don't need to dive too much into the nitty gritty of maybe EMP warfare or something. I know you were curious about some self hosting. Do you want to talk about self hosting a little bit? Yeah, and I think that that fits in well with the talk of being able to transfer your data out and TOTP and just a lot of different things we're talking about. But I know that within Bitwarden, there's the ability to self host the back end server so that you're not reliant on Bitwarden servers. And obviously, as we talked about that the data within Bitwarden, even when using Bitwarden's cloud is in encrypted. So you're not trusting Bitwarden with that data when you're using Bitwarden cloud.

But you are, I guess, I guess trusting them to keep the data safe, even though they can't see the data. And there's some other things that go with it, like they would have visibility into network access and that kind of thing. But I know that you can self host the Bitwarden back end servers. So do you mind kind of breaking down what the pros and cons of self hosting are versus using Bitwarden cloud? Maybe just a little bit about what the approach looks like for someone who wanted to do that?

Sure thing. So for one, Bitwarden cloud is hosted on Microsoft Azure servers, data center on the East Coast. So we have that Microsoft Azure uptime. We're also looking at adding additional servers at different geographies too. So you can see it on our Bitwarden roadmap that we're looking at putting together EU data center as well for the users who want to be part of the out in the EU. But if you need to self host for, say, for example, some government agencies, for example, have Bitwarden is compliant with every major data security and privacy thing out there, you can bitwarden.com/compliance, you'll find it all there. But some companies have additional policies for themselves. And they may want to self host on their own. And Bitwarden makes it super simple. You can go to our help page, bitwarden.com/help, and you'll find basically an entire section on how to set up self hosting, whether it be Linux, or Windows, or Windows, or Windows, or Windows. So you can see it on Windows, Docker, which is actually the easiest way to do is through Docker. You just set up a container with Bitwarden in it. I'm not a very tech person. I'm not an IT guy. I'm not an admin, sysadmin, anything like that. And I was able to set up a self hosted instance of Bitwarden in about 45 minutes on my old laptop, which is probably not the most ideal for hosting a server on it. But I got to work. And if I can do it, then surely your listeners

who are more tech adapted than me would be able to get that up relatively quickly. Now, the advantages and disadvantages, Bitwarden, the self-hosted version of Bitwarden, is essentially the same product as cloud-hosted. Like there's not too many differences. There are two key differences. One, if you're a self-hosted enterprise, there's additional SSO options for you. If you're an individual, that really doesn't make a difference. But you have a little bit more control over the data itself for a user.

The one major key difference is if you're an enterprise, you have an additional SSO option for controlling encryption keys on your own site. But that doesn't really make a difference to individual users. Additionally, for teams, enterprises, for companies that are self-hosting, the way that Bitwarden works is that you create an account that's attached to your work account, and then you join the organization. So if you ever left the organization, you would still have access to the account.

So let's say you save some passwords on your work computer into the personal side of the vault. You would still maintain access to that if you were a cloud installation. But if you were a self-host installation, you could purge that. I mean, it's not really the best for the users, but you have a little bit more control over that sort of thing. Additionally, like Azure server backups, the cloud has the advantage of having all the uptime, where people who are self-hosting or running home servers or anything know all about the rigor of backups and making sure you have data integrity and security, maybe off-site storage of things.

So it pretty much follows the same pros and cons. What's nice is that any Bitwarden application can just be directed to the address of your self-hosted installation, and everything will work, including your mobile apps, for example. Awesome. Yeah, that's, I think, a really good overview. And I think it's actually funny that you mentioned the old laptop wasn't a great way to host things, because it actually has a lot of nice advantages, like built-in battery backup and a lot of other things that go with it.

So actually, it's one of the things I recommend people to use if they need a lightweight server. Actually, it's not bad. I found that Docker was a little bit RAM-heavy on my old laptop. But that might just be me malconfiguring things, not knowing what I was doing. So it had nothing to do with the actual instance of Bitwarden. It was like all the other Docker environment stuff. No, it's definitely understandable. And self-hosting it is something that I've dug into.

And I've spun up the server. I haven't actually switched to using it yet. But it was really straightforward and something that's not really even out of reach of people who aren't technical, but can be a good option. But I really do like that you focused or at least brought up the backup piece, because like we talked about with Bitwarden Cloud, if you lose your password, you would lose access to all of the information within. You add additional risk when you self-host something like Bitwarden, because even if you remember your password, if wherever you're hosting the Bitwarden server itself, the password itself,

40:00 process, if you lose that data, if the service goes up in flames, if the, like something happened to your home or server room flooded or whatever happened there, and you lost that data and you didn't have other backups, you could lose the vault as well. If I understand it correctly, you would still have the local data on whatever devices you had connected to that. But obviously you're opening up risk to losing access to all of those accounts. You're losing the usernames and passwords to those. So it adds the extra burden, again, like we talked about before, more responsibility for more control over the data and more control over where the data is stored.

Absolutely. Yeah, you've nailed it all pretty, pretty well. And you're right too. So Bitwarden does locally cache everything. By locally cache, I mean, it's in the file, but it's all encrypted, right? Until you unlock the vault, then it's in memory. Any device has the ability to export the data that's on it. So if you're on your mobile phone, your Android and you somehow lost your password or something went wrong, you can still export everything from your phone.

The web vault, you'd be able to, though, that wouldn't really call that a local device, but your Bitwarden desktop application, you'd be able to, your extension, you could do an export. The only key thing here is that you would not be able to export anything out of a organization unless you were an admin or an owner. So that's just something to think about and who owns what and whatnot, if that makes sense. That's another good call out that, you know, again, that's another thing that would be on your plate to make sure you have set up in that scenario. So definitely important, but I do really value that y'all put the time and effort into making the tool self-hostable. You put out good guides that walk you through it, great Docker images that work well. Like, I know there's a lot of effort that goes into that, and that's not something that directly generates revenue for Bitwarden.

So I'm very glad to see that you've taken the time to do that anyways and make sure that people can continue using it. Obviously, that people could use it if Bitwarden went under, something happened, the source is still open, the Docker images and everything are still out there. So it's a very important piece of that. But I do also want to remind people that if you do choose to self-host and you don't pay for a subscription or something like that, and you enjoy what Bitwarden does, try to contribute back in some way. And we'll chat about how listeners can support Bitwarden later on a little bit more. But I definitely do want to just encourage people, if you're using the open source and the self-hosted version, make sure to find a way that you can give back to Bitwarden, whether that's something as simple as recommending it to other people or donating, just whatever way fits. But make sure that you don't just take advantage of the free thing and give back, if at all possible.

Yeah, I know we'll get back into it in a moment. But another great way to give back is to help contribute to our code. We have internal goals of making sure that we implement a certain percentage of community PRs. So it's definitely big. The Bitwarden community is a huge strength. People are always contributing code and we'll give credit where credit's due. In fact, just recently, the Web Vault just released a dark mode, which is very popular amongst the tech community. And that was made possible by a user, a contributor. And we absolutely said, hey, thank you so much for this. And we even had them interviewed and brought them up and had them talk about one of our Vault Hours, which is our version of Office Hours. And, you know, really thanked him for his contribution. So that's also a way to help out too.

And another just massively important piece of a project like Bitwarden being open source, people can look at the code and can contribute. So definitely, definitely love that. And I do want to dig into a little bit about what other tools are out there that are similar to Bitwarden. I know that like a listener specifically asked about LastPass. There's a lot of tools out there like InPass and KeePass. And there's just a million different password managers out there because it is one of the more kind of established pieces of the security field. But I'd love to hear your thoughts about kind of other chief competitors or alternatives and what makes Bitwarden better, unique in your eyes.

Yeah. So it's funny you say that. There's so many out there. And the reason is because it's a very common problem. And we live in a world of passwords. And so a lot of really smart people are trying to come up with innovative ways to solve it. And ultimately, that does lead to several solutions from you go into Staples, for example, and there is a passwords log notebook that you can write pen and paper and you write down your... But that's a competitor to Bitwarden. Like that's how someone can manage your passwords.

And granted, you don't have any of the any cool features at all. But even sticky notes, like they're all different solutions to this problem, even if they're not the best. But when it comes to password managers themselves, there are quite a few out there. I don't really need to go into them all. But you did mention LastPass specifically. And I guess like, one of the things I want to bring up with, with LastPass is, we're actually coming up on about a year since they initiated their policy change for free password management. You're familiar with that, right?

Yeah, I'd forgotten about that. I've never been a LastPass user personally. But I definitely do remember hearing the shockwaves when that hit. That's right. It was actually, I think it was bigger than they expected it to be. But for those who might not be caught up on it, LastPass had taken their pretty, pretty coveted free version of LastPass. Like it had a lot of great features. And they began limiting the number of devices you could use on. And in particular, specifically device type. So you can either use it on PC or mobile, but not both.

Which is a really interesting decision. This happened before I joined Bitwarden. So I don't have any insight into what happened internally at Bitwarden. But we do have a lot of pride in being the, considered to having the most robust free password manager on the market. Saying on the market in air quotes because it's free. But it is, it's just like a big, it's a no brainer, right? Give, give, give password security to everybody. I, there's really not a good reason to, to limit it unless you're, you're trying to monetize significantly. So it just, we, we, we see a future in which we want to have nobody hacked by passwords, password loss at all. And so that's, that's kind of like what we aspire to internally. And having this fully robust open source, free fully featured version, we think is a great way to achieve that goal. Additionally, there's like a couple of other differences. I did just mention open source. We just talked about self hosting, right? Those are two things that Bitwarden does at the

moment that LastPass does not. I kind of mentioned this early, early on, but Bitwarden, we talked about privacy, right? Bitwarden specifically does not look at any data inside of your vault. The only data that we can tell from looking at the encrypted blob is how many entries there are. Everything else is completely encrypted. And you can find this, this is all really publicly accessible on Bitwarden.com/privacy. To their credit, our competitors also have really clear privacy policies. And one of the interesting things about some other password managers is that the URLs for the websites aren't considered personal information. So that could be any login. LastPass, for example, has access to it. They could, they could look at your account and say, oh, this person has a login for this account, this account, this account. It could be a couple more risque accounts, you know, that you don't want LastPass to know about. They don't know the password, obviously, because that's encrypted, but they can,

they can aggregate all this data and use it for quote unquote analytics. And we, we don't even want to do that. That data can tell so much about someone. Like you mentioned specific websites that you don't want to get out. I mean, it could, that could include services that you're not publishing to the rest of the internet that you're not sharing. That can include things at home, DNS that you think you're keeping anonymous. Like there, there are so many things that could be done with that data and such an accurate fingerprint of you as a person could be built out of that data. Just knowing the very specific URLs that you use and knowing all of them together is, is that like, that's a very big deal. I never actually noticed or realized that LastPass did that. So it's definitely a key thing that I'm very glad to hear that Bitwarden does not have access to that. Absolutely. Yeah. It kind of surprised me, especially when you hear about things like, like people getting around VPNs with browser fingerprinting and stuff like that. And

like, it's, it gets, it's kind of creepy when you, when you know what people can do when you give them an inch. Right. Um, but that's just me speaking personally, uh, was, was, was kind of understanding that and being taken aback by it. And then, uh, finally is where I mentioned before, but fully featured free version or limited limited devices, unlimited logins, um, unlimited device types. Like the, it just doesn't make any sense to limit somebody to any of those. Uh, we also include features like some, like a form of two factor authentication. You could use off the, you could use any sort of, um, any sort of, uh, secondary application to act as your two factor authenticator for Bitwarden, um, or email of course. Uh, the, the more advanced versions like hardware keys, we keep,

50:00 in the premium subscription, if that makes sense. But it's the Authy codes or Google Authenticator or Aegis, whatever. That's a great way to make sure your account is secure. And we make sure that that's available to anyone who signs up for an account. Yeah, I can never really understand when a company would lock a basic security feature like two-factor behind a paid account. That's pretty nuts to me. And I understand the monetization piece of the more advanced two-factor, because obviously that requires more upkeep on your end and less people are going to use that.

But just enabling basic two-factor seems like something that should be a given in every service and not behind a paywall. And especially not SMS two-factor authentication. Oh, gosh, yeah. Yeah. I don't need to go into it. But when I joined Bitward and I rolled over a 401k from another company, and I'm transferring a not insignificant amount of money, and all that my investment company did to confirm that this was something that was legit was just send me a five-digit code to my SMS.

It is amazing the number of services that still only support SMS two-factor today. Or email, but usually SMS. And it's been proven to be so insecure over and over and over and over again, and yet remains the only option in so many different services. So hopefully that will change. Something's better than nothing, so you can't be that upset about it. But for something like a financial institution, you would expect additional... Anyway, that's a personal gripe.

No, I think it's one that's shared by a lot of people and a lot of listeners, I'm sure, because it's a constant struggle in the privacy and security space to keep moving forward. But hopefully we will continue to see progress there. Last couple questions for you, and really kind of the last more technical one around how Bitwarden operates, is just what logs about user activity, if any, are kept of specifically people using Bitwarden Cloud? Obviously, people who are self-hosting, that would be a different question.

But specifically people using Bitwarden Cloud, what logs information is kept about user's activity? Everything is clearly spelled out on bitwarden.com slash privacy. You can see everything there. But the key thing is that we have data separated into two categories. We have the vault data, which is the data that's end-to-end encrypted that we have no access to. The one thing that you can see from the website when you read it is that the one thing that we can tell from the way that things are encrypted is how many items are in the vault.

That's it. And that, you know, you can just tell by looking at the encrypted lines. That's it. Everything else is called administrative data. And that would be the email associated with the account, just to make sure that, for one, send two-factor authentication, because a two-factor authentication is for verifying your identity with the server. And then also making sure that when you log in, we're sending you your vault. So you can go to the website.

You can look at everything there. It's clearly spelled out. And I actually kind of want to stop talking about it because I might just make a mistake and say something that's not true, because what's on that page is very much our Bible on how we handle user data. And it's relatively easy to see and understand. We'll definitely put that in the show notes. It's very helpful to have just kind of a one-stop shop for that. And I know that question can get very tricky, especially, I don't know, just really any of these scenarios where you're hosting servers and people are accessing them.

Even when it's in encryption is a part of that, it still could be a tricky question and answer. So I'll definitely drop that. Yeah. And it also has, at bitwarden.com slash privacy, you'll also see information on how payments are handled too, which we contract Stripe to go through. So you'll see all the information there on that. Do you all accept cryptocurrency payments for Bitwarden? I can't actually remember off the top of my head. We do, but not natively.

So you'd have to use a different service to do it, but you can use crypto too to go in. And if you were a company, for example, and you need to pay by purchase order, so this might not apply to individual users. But if you need to pay by PO, we could do that too. You just need to contact our sales team and we can set up something that works for you. Awesome. That's definitely good to keep in mind there. I question that we touched on a little bit more and I brought up just around people continuing to support Bitwarden, even if they choose to self-host or only use the free plan.

But I'm always curious to learn a little bit more about how projects like Bitwarden are funded or made sustainable. So obviously Bitwarden is a company that's for profit. So it's a little bit different than just a community run open source project. But is there anything else you want to kind of add on how Bitwarden is funded or how it's sustained? Yeah. I mean, I need a paycheck, right? Same as everybody else. This is, and working at Bitwarden is a full-time job.

We have a team of programmers working on it full-time to make sure that it's secure and a great product for everyone. And obviously the best way an individual can support us, there's the three ways you mentioned already. One is monetarily, you know, subscribing to a premium account, which is $10 a year. That's less than a dollar a month. There's a family account, which is $40 a year for up to six users, which is still, I think, incredibly expensive.

And there's contributing to the code, which always helps. So we get some of our best features from code contributions from others. But the best way that anybody can help contribute to Bitwarden is through basically spreading the good work. Make sure that you take, just get word of mouth, bring more people into Bitwarden, more people into password security, and then take that to work too. So some of the best advocates that we have, we'll call them like a supporter or a leader, a Bitwarden leader in another company that might be pitching using password management solutions such as Bitwarden to their IT department.

And then we have a very robust plan for both teams, you know, smaller businesses and enterprise that starts at just $3 a month per user. But we find that that's where we provide the most value to businesses who need to support and have password security handled at these businesses and corporations. And that's really where we can also find, I guess, like the biggest amount of support coming from those organizations. So that's kind of how we feel about it.

Like we want to make sure that password security is practiced by everybody at home. We want those people to take those same password security habits to work, have password security at work. And then we want to also have those employees bring that back home to their family. And we actually just launched a new program where if you are a enterprise user, you will have a complimentary families plan that you can bring to everybody in your household. That's pretty awesome, actually.

I love that approach. Yeah, so that's really the like how Bitwarden is funded and supported is through users like yourself telling everybody about it and having some people take that to the office and pitching password security and management there. So that's really the best way anyone can help us support Bitwarden. I've actually been pushing for Bitwarden at my workplace and we're working on self-hosting it right now. So it's been a cool part of that.

And thankfully, other people within my team are also big Bitwarden fans, but it's a great use case for Bitwarden generally. And I know enterprise contracts can be a great way to support a project like Bitwarden while also obviously providing your company with a great service. That's a really interesting call out that I haven't heard anyone else mention on the show yet. But the spreading the word about Bitwarden, I mean, that's a huge part of why I do this podcast, huge part of why I've been focusing this season on projects that I love or want to learn more about.

And obviously Bitwarden has been one that I've been using for a while, kind of singing your praises for a while. And I'm really excited to get more people out there hearing about what Bitwarden is doing and just the excellent tools that you're building, that you're continuing to do that with an open source ethos, with a privacy first ethos. And I'm really, really grateful for the product that you all have built so far. So thank you so much for coming on, Ryan.

And yeah. Yeah. Thanks for having me on the show. I appreciate it. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode. Now get out there and opt out this week.