What's up, what's up, what's up?
Freedom Tech.
What's going on, everybody?
I'm going to check real quick that we're live.
It should be here, YouTube.
YouTube says coming soon.
But I'm live.
I'm recording.
Strange.
Go check.
All right.
Okay, I'm good on X, so that's good.
And something went wrong with YouTube.
There we go, now we're live on YouTube.
Right on.
Okay, cool.
Welcome, everybody, to Freedom Tech Weekend.
Today is May 2nd.
Let's see, this is the fifth episode.
So we've done this five weeks in a row.
we just need to do it for like seven more years never missing a week and then we'll start to be
as cool as some other streamers out there but cool no welcome hope you're having a great day
we made it through april and uh let's get going so last week we we did a poll and we asked
everybody what they wanted to cover we had orion web browser from kagi up against bitward and the
password manager. And so the polls won out. We covered Orion last week and Kagi was so
great to provide us with some information that we could cover on the show. Today, now
we have Bitwarden. We're going to be talking about Bitwarden as well as password managers
in general. So I'm going to take us on a brief tour of a few different password managers
and we'll look at some of the pros and cons of using them. But then also, what was I going
to say. I lost my train of thought already. Oh, yeah, yeah. Yesterday was World Password
Manager or World Password Day, right? I don't know who decided it was World Password Day,
but it was. The internet was all about it, especially all the password manager websites
that were doing deals. So you're actually in luck. A lot of them still have deals going.
So if you want to use the password manager that I talk about, you might be able to get
like a 30% off deal or something like that. You know, you can pick your own poison there.
All right, let's go and jump in the stream.
I actually have back-to-back streams going today.
I'll likely be on another show right after this.
So I'm going to try and move through this quickly.
We might have to stop slightly early today, but I wanted to be on time.
Here we are.
Let me go and share my screen.
Let's get going here.
I am at Bitcoin Park today in Austin,
but I'm actually able to remote in and still do my normal setup on my server,
which is great.
Let's share the screen here.
Let me get back.
Make sure that it's sharing correctly.
Alright, so cool.
We've got that going there and then I'm in the bottom corner.
I want my thing to be a circle though.
I always forget how to do this.
But, you're going to have me as a square.
It's all good.
Customize.
Circle.
Boom.
Okay, you don't need to do so much of me.
sunny here in Austin today, which I love. I was out at Presidio Bitcoin earlier this
week. Beautiful place. Had great weather out there. Okay, so let's jump over now. You can
see two cursors. That's fun. Okay, jump right into it. So we've got four things that we're
going to cover on this password manager tour today. We have Bitwarden, and then there's
a tool called Vault Warden which works with Bitwarden. But then I want to actually start
by talking about general password managers that we've seen. Bitwarden was not the first.
There's a couple that are really popular in the business world. First one is LastPass.
This one became really popular first on Windows is my understanding. That's when I first saw
it was a lot of Windows users were telling me to use LastPass. And then another prominent
The one is 1Password, which got its start on the Mac,
became very popular among Mac users and iOS users.
They both are cross-platform now.
These are two big ones.
But then you also have password managers that are built into your operating system,
macOS.
Apple has their own iCloud password vault.
Man, it's been forever since I've been on Windows.
I assume Windows has some kind of password manager.
Probably does.
And then the browsers all have their own password managers.
And I mentioned this last week when talking about Orion,
how every browser wants to store your passwords for you.
So there are plenty of places to store passwords,
but you've got to understand the trade-offs
and secured trade-offs that you're making with those.
So let's talk about those.
Let me quickly check the chat here,
make sure that I'm not missing anything.
All right.
Feel free to drop something in the chat if you want to,
any questions that you have, any experience you have with your password managers.
Yeah, would love to engage with people if you have anything you want to say.
All right.
So, LastPass, this is a corporate password manager along with 1Password,
and both of these are going to be very similar,
but they've got their pricing structures and all that.
However, when I search for the word source on the page,
I'm looking for open source,
There is no open source here.
Same with 1Password.
There's nothing about being open source.
So these are closed source corporate apps that you can use.
And like I said, they do have 30% off right now for that World Password Day.
But let's go over here, and I want to understand a little bit more about these.
So I guess I should back up real quick.
If you've never used a password manager before, let me give you a brief primer.
So passwords, right, we try to store them in our mind.
We log into a website.
You have to generate a password.
And if you are typing in passwords and trying to remember them yourself,
you end up using passwords that are memorable but tend to be weak,
and you tend to share passwords among websites.
Or, you know, maybe you use the same password,
but you alter it just a little bit.
This is inherently insecure.
If someone breaks into one website
and gets your password from that website
and leaks it online,
now all of these scripts out there,
people are going to run these programs out there
that take these known passwords
and start testing that password against other websites
and using your username and password combination
on other websites.
And guess what?
They are smart enough that they can slightly alter the password
and try a whole bunch of things.
So you lower your security when you try to keep all your passwords in your brain.
This is where password managers come in.
So password managers allow you to alter your passwords and have different ones for a website.
But then they go even farther to say, why do you need to have a password be easy to remember?
Why not just have it be randomly generated?
So most password managers, the default is to randomly generate a password per website.
So each website, each login, you get a unique password.
And this is great.
This offers a lot more security, so that way if a password gets leaked on the internet,
you're not vulnerable on other websites.
That's why password names are standalone.
Now we have these who are not open source, so you actually don't know what software they're running.
You don't know what the software is running on the client, the app that you use,
as well as the server that is synchronizing everything.
You cannot verify the security model.
You cannot verify that they are treating your data correctly.
So it's very possible in any of these apps, if you cannot verify the source,
you can't build the source yourself,
it's possible that they have some kind of line of code in there
that is storing your password somewhere else.
Let me make my copy of them.
Or that's simply just printing it out to an error log.
These things happen a lot where apps have like diagnostics that they run, right?
So if someone runs into an error, it prints out a thing on their server.
And whenever there's a problem, they go look at all of their server logs.
Occasionally, you have somebody who accidentally, during development, they're trying to debug something.
And so they print a password out into the log just for their own purposes.
And then they forget to remove it.
And so they deploy it to production.
And now production is spitting out passwords for users in the production logs.
This has happened countless times all over the place at companies that you would not expect.
So it's great to be able to verify things.
That's why we're going to talk about Bitwarden and Vaultwarden today.
But I wanted to cover these two as well because these are really popular,
and I want you to understand the tradeoff, right?
Okay.
Now, let's quickly do, I want to look at vulnerabilities that have happened for these services.
So, we're going to hop into Maple here.
Tell me about prominent hacks.
We'll make it singular or plural for the app last hack.
Okay.
Let's see what kind of hacks and vulnerabilities they have had in the past, data breaches.
I know that last hack actually had a fairly large one, and that's what makes me want to do this.
All right, so we have four that were, you know, 2015, they had a daily breach, and they
supposedly plugged it.
2016, local password tracking, so this was in their browser extension of vulnerability
where an attacker could brute force within the browser.
2019, password vault exposure.
Your researcher discovered a vulnerability in LastPass Android app that could expose
password vault to other apps on the same device.
so other apps on your Android app could potentially access passwords.
And then 2022, data breach and encryption key exposure.
This is where they had a data breach, including encrypted password vaults.
So this is, it's these last two that I remember that are sticking out of my mind
where the actual password vaults were accessed.
However, it looks like it allowed attackers to access LastPass development environment and steal encryption keys.
So they've plugged these up, but there are some major vulnerabilities that have happened in the past.
Now do this for the app 1 password.
It looks like a 1 password, so I don't want to do that.
Go away. There we go.
Okay, so one password also has some browser extension vulnerability in 2017, 2019 security
audit and vulnerability disclosure.
So this is just an audit, has some vulnerabilities, and they patched them.
So this is what's been exploded in the wild.
The desktop app had a vulnerability in 2022.
They could access them through data including passwords and encryption keys.
It was patched, and then 2022's vulnerability in their Android app discovered one password
Android app allows hackers to access sensitive data, including one password and encryption
keys, sorry, passwords and encryption keys.
It was patched.
Okay, so a lot of these are security researchers, but neither of these apps are open source,
and so they hire audit firms to come in, and we have to trust the audit firms, and
we have to trust the password company that they're willing to disclose these
vulnerabilities ahead of time or just, you know, disclose these maps of the facts
so they can get people upgrade. But it's not as transparent, right? They get to
control the message, control the narrative there. Now let's look at Bitwarden. So
Bitwarden is, we're going to do our little search here, resource, open source.
That's right. So Bitwarden is open source and that's one thing that makes it such
a powerful option for people who want to use a password manager. Now something that all
these password managers do is you have a master password that you generate and this one is
something that you need to remember. Don't write it down anywhere. Don't, I mean share
it with someone if you feel like you need to in case your brain goes to mush. But this
This is something that should be long and complex, but also memorable for you.
There are various things you can do.
Help me generate...
How should I generate a long, complex password that is memorable?
Forgive my spelling.
There are a lot of different tricks you can do to generate a long password that you can
right so use a passphrase so instead of a single word use a phrase or sequence
of words that you'll remember for example I love coffee exclamation mark
my dog is named Max exclamation mark right you can make them even longer and more
complex and maybe swap out a few things here and there combine words mix
uppercase and lowercase using the same example here use a password generator
with a twist, create a story, right?
The quick brown fox jumps over the lazy dog.
You take the first letter from each word in that sentence
and you create something like that.
I've heard people use song lyrics before or movie quotes
or really inspirational quotes that they, you know,
that speak to them, a phrase from a book.
So you can take a letter from each one of those words
and make a password out of it.
So there are lots of different things you can do here.
but you want to make one really good strong master password and then that is used to locally encrypt
all of your other passwords before they are sent to the servers of last pass or one password or
one bit warden so that's kind of the key to all of this is that you encrypt locally and then this
app is able to for each website generate a new password per website something that is kind of
temporary if you will, that can be thrown away and replaced at a moment's notice.
And that's what's so awesome about using password managers. So the difference here
between Bitwarden and these others is that Bitwarden, because it's open source,
you can see how they handle your master password and how they handle encryption
locally before they send it to the servers, right? So in theory you don't
have to totally know what is running on the servers for Bitwarden if you are encrypting
locally. So if you can inspect the local client that you're running and if you even build the
code yourself, then it lowers the necessity to trust what software is running on the server.
Now it's still as really nice if you can know what's running on the server, right? That's why
we do secure enclaves here at OpenSecret. Maple runs on secure enclaves. Everybody knows what is
going on with the server software from Maple and that we're privately encrypting all of your data,
right? And if you haven't, go to trymaple.ai, grab private AI for yourself. It's awesome.
Okay, so Bitwarden, let's go ahead and grab it. Now, they are a company, they have pricing,
you know, they do enterprise things, all that stuff, right? But you can use it for yourself
and use it for free. So we're going to do it for free. Get started.
Create your pre-Bitwarden account and you can sign up with their website, right? And I can do
that. I will in just one second, but I want to tell you about something else, which is Vault
So Vault Warden is a Bitwarden compatible server written in Rust.
Right? So somebody wrote their own server software that speaks to the
Bitwarden app. So you could download or build the Bitwarden, you know, iPhone app,
Android app, the desktop, that kind of stuff. But instead of pointing it to
Bitwarden servers, you can run Vault Warden yourself. You can run it at home,
You can run it in your own cloud instance. There are, let's go to Start9.
There are different, start9.com. Okay, here we go. There are these home server operating systems like
Start9. You can buy their server or you can run it on your own server, but they
make it super easy to install things like Vault Worden where you just, it's like an app, you just click and install it.
The other one is Umbral and we are going to cover both Start9 and Umbral in a
episode because these are awesome for getting, helping people to run Freedom Tech tools easily
at home. Okay, got about seven minutes left. So let's keep moving on. But just wanted to call
this out that Vault Warden is really easy. You can run it on your own or you can run it within
one of these. It's kind of like a one-click install and then you point your Bitwarden app
at your own vault warden installation, and you start to have more sovereignty with how
things are handled.
I'm punching ice on a screen.
That's probably like an amateur rookie mistake.
Okay, let's, before we create an account, let's look at vulnerabilities for bit wardens.
tell me about
that
or
the app
bit warden
see if they have any
so we want to give everybody a fair shake here
2018 browser extension
you're noticing a pattern here
all of these password managers
have browser extension
what does that mean?
well what that does
it's really nice and convenient
where
rather
you generate a password for a website, it's quite a process to go to a website and then
open up your password manager app, type in the website address, generate a password,
and then paste it back into the website. And then every next time you want to log in,
you have to go back to your app, copy the password, paste the website. That gets cumbersome.
So they have all created browser extensions where it basically lets the app live within
your web browser, you have to give access to the website, to give the browser extension
access to the website. And a lot of people will just check and say, give it access to
all websites. That is something you should just kind of heavily consider as you're doing
that, that you are giving some third-party software access to every website that you
browse. So they are now effectively getting your browsing history, which again is nice
if you get warden because you can inspect what the browser extension is doing and that
it's not logging your browser history.
Okay.
So they had a vulnerability in the browser extension security audit vulnerability disclosure
in 2019.
It looks like a lot of the apps did audits in 2019.
I'm sure they do them on an ongoing basis.
2020, they had a vulnerability in their Android app.
Allow attackers to access sensitive data including passwords and encryption keys.
it was patched. And then 2022 they have a vulnerability in their web vault.
Research or discover a vulnerability in the BitWard web vault that could
allow attackers to access sensitive data including passwords and encryption keys. It was patched.
Okay, so they are not without their things. I want to
say right now really quick, I am not double checking all of these. This is just
AI telling me this. AI hallucinates all the time.
So, if I were to actually decide
to use one of these for work, I would go look into these and verify and see that these are
true claims and try to look at the articles for all of these. Right, so we're just giving a quick
and dirty assessment here. Do the same for vault warden and just in case you don't know what vault
interface, essentially get access to sensitive data in their API, and a researcher found
that there could be attacks that way through the API, and then in a Docker image, researchers
discovered that an attacker could get access to sensitive data, including hackers and
cryptos.
Okay, so those are a few.
But again, ball warning is open source.
You can see it all right there on GitHub.
They've got 44,000 stars, a lot of commits, right?
Almost 3,000 commits.
They committed just yesterday.
They have a lot of contributors here.
So there are a lot of eyes on Vault Warden, which is great.
And then same can be said for Bitwarden.
They have a lot of eyes on their open source tools as well.
I want to go look at those.
I know I haven't created an account.
yet, partially because we're running out of time. This is turning out to be more of an introduction
into what they are and lots about how to use the software. Maybe we'll have to do a follow-up next
week and actually use it. Or maybe what I'll do is I'll record a video. That's what I'll do.
I can record a video of me like studying that bit more than I'm using it. Or really you could,
you know, go find a house somewhere.
I hope that I'm providing a really good signal for you right now,
just introducing you to the concept of password managers,
what the different ones are that are out there,
and what the trade-offs are.
But let's see here.
So Bitwarden, they have a bunch of different repos.
And not only do they have a server and client,
the clients, to me, are more important to see what they're doing
because this is where your data is supposed to be encrypted
and decrypted and handled and all that.
And so for me, I want to see what's going on client side.
And I can go look at the iOS app, for example,
or the Android app, carry on the iOS app.
And if I want to, I can download this code
and run it myself on my device.
And then I can know for sure
what's happening with my password on my iPhone.
So if you download Bitwarden from the app store,
They can have one set of code here in GitHub.
They can have a totally different set of code that they deploy to the app store.
And there's no way to verify that.
There is a really cool project called Zap.store.
Orion can't open this page.
Okay.
Well, that's right.
There's a project called Zap.store,
which is trying to create builds for Android apps
and basically allow developers to sign the build,
and then you can verify bit by bit
so that the open source code will reproduce the build.
So you can make a reproducible build of the open source code
and verify that it's the same thing that you're downloading
and running on your Android without having to build it yourself.
Pretty cool project.
I hope I'm excited to see how it progresses.
Okay, so let's go download.
I'm going to try and skip this whole creation thing.
There was a download button somewhere.
There was a download.
It looks download for the Mac.
You can use Homebrew.
Look at that.
That's cool.
You can also download it from the Mac App Store.
I'm just going to download this.
By the way, I'm using Orion as my browser if you didn't know.
Oh, that's what I wanted to point out.
Okay, yeah.
On my very first stream, I covered Tail Scale.
And I couldn't show you exactly how it works because I couldn't VPN, like log in while
I was streaming.
Well, I am logged in now and that's actually how I'm doing the stream.
This is my home server that I use every week on the stream, but I'm here at Bitcoin Park
Austin and so I don't have my home server with me.
So I use Tailscale and I am connected.
I've got my network device here.
That's my home server and I was able to tunnel into my home server and do the stream for
So there's Tailscale at work, your own personal VPN, your own private VPN.
That's awesome.
Okay, so let's open up.
Okay, I've got the application folder.
Hit warden.
You can tell I also downloaded one password to play around with that one.
Open.
Okay.
So they want you to create an account right off the bat.
I'm actually out of time.
We got here.
Let me know if you want me to do a video of how to use Gitwarden later.
I can do that and post it to my YouTube.
But I think we're going to have to end it right here.
This has been great.
Thanks, everybody, for joining today.
Appreciate it.
If you're on YouTube, go ahead and subscribe to the channel.
You're going to get these every week.
Every week we do Freedom Tech Weekend.
It is one tool that you can play with this weekend.
And bit by bit, you can take your data back, right?
You can start to pull away from these proprietary systems that don't share their code with you.
They don't let you see what's going on and try to lock you in, right?
They lock you in by having your data and having control over the app and hope that you don't go elsewhere.
Well, we are going to use freedom tools that help us decouple from that so that we are flexible and we're able to move around as we need and know where our data is being stored and really know that we own our own data.
So that's great.
Yeah, I also stream on X and eventually one day I'm going to figure out how to stream onto Nostra as well.
But thank you for joining.
Like and subscribe, all that, you know, cringe stuff.
But anyways, go play around with password managers this weekend.
If you haven't tried out Bitwarden, download it, give it a go.
All right, later.
Thank you.