
Show Notes
Most people think their passwords are safe. Most people are wrong. Henry sits down with Ryan Luibrand, Senior Product Marketing Manager at Bitwarden, to cover why open source changes the trust equation, the LastPass data breach, how KDF algorithms work, whether storing your TOTP codes in your password manager is a good idea, and more. 🔗 SOURCES & LINKS Written breakdown: https://techlore.tech/password-manager-security-explained-with-bitwarden/ Bitwarden: https://bitwarden.com Privacy Policy: https://bitwarden.com/privacy/ Compliance & Audit Reports: https://bitwarden.com/compliance/ Security White Paper: https://bitwarden.com/help/bitwarden-security-white-paper/ Security Readiness Kit: https://bitwarden.com/resources/bitwarden-security-readiness-kit/ HackerOne Bug Bounty: https://hackerone.com/bitwarden GitHub: https://github.com/bitwarden
⏱️ TIMESTAMPS
(00:00) - INTRO
(00:52) - RYAN'S BACKGROUND
(02:07) - BITWARDEN ORIGINS
(03:09) - BITWARDEN TEAM
(03:29) - FUNDING
(06:18) - OPEN SOURCE
(08:18) - AUDITS
(10:11) - FORKING
(11:19) - INTERNAL VS. COMMUNITY DEVELOPMENT
(12:21) - SELF-HOSTING
(14:13) - NEW NATIVE APPS
(16:38) - ARE PASSWORD MANAGERS SECURE?
(21:08) - WHY USE A DEDICATED PW MANAGER?
(23:08) - CONCERNS WITH THE CLOUD
(25:39) - ARGON2
(29:16) - USERNAME KEY GENERATION
(31:06) - LASTPASS DATA BREACH
(37:17) - WHAT CAN BITWARDEN SEE?
(39:40) - WHERE IS BITWARDEN DATA HOSTED?
(40:18) - GOVERNMENT REQUESTS
(41:08) - "EGGS IN ONE BASKET" ARGUMENT
(43:57) - 2FA & BITWARDEN AUTHENTICATOR
(47:39) - PASSKEYS
(49:04) - COMMUNITY VS. ENTERPRISE
(50:17) - RYAN'S SETUP + ADVICE
(53:45) - THIRD PARTY INTEGRATIONS
(54:20) - AI
(56:16) - PRICING
(57:15) - F-DROID APP?
(57:54) - LINUX APP?
(58:12) - MORE THOUGHTS ON CLOUD SECURITY
(59:10) - FINAL THOUGHTS
(59:55) - WHAT'S NEXT?
🎥 VIDEO Watch on YouTube
🧡 SUPPORT TECHLORE Keep Techlore Talks independent & growing: ★ Support this podcast ★
More from Techlore Talks
DNS quietly reveals everywhere you go online - even on encrypted sites. In this interview, John Todd (CTO at Quad9) provides a DNS masterclass: how DNS works, the privacy implications, how to change your DNS, why Quad9 collects nothing on you, why they are being sued, DNS vs. VPNs, and how a nonprofit can fund itself without compromising privacy. 🔗 SOURCES & LINKS • Quad9: https://quad9.net ⏱️ TIMESTAMPS
Josh Summers spent a decade living in western China before 14 police officers showed up at his door, accused him of espionage, and confiscated every device his family owned. This Techlore Talks interview covers what 17 days of interrogation taught him about digital privacy while traveling, and the practical steps that could make the difference for you. Stop handing out your real email address. addy.io gives every site an alias that forwards to your normal inbox. Open source, self-hostable, with browser extensions and mobile apps. 🚀 Get started for free: https://addy.io/?utm_source=techlore 🔗 SOURCES & LINKS • All Things Secured (website): https://www.allthingssecured.com/ • All Things Secured (YouTube): https://www.youtube.com/@AllThingsSecured • All Things Secured (Odysee): https://odysee.com/@AllThingsSecured ⏱️ TIMESTAMPS
Flock Safety is one of several companies quietly building a searchable database of everyone's car — no warrant required, and no way to opt out. In this Techlore Talks interview, Bob from DeFlock breaks down how ALPR technology works, what "end-to-end encryption" really means in Flock's case, why this issue is bipartisan, and what you can do about it in your own city. 🔗 SOURCES & LINKS • DeFlock: https://deflock.org • No ALPRs Week of Action: https://noalprs.com ⏱️ TIMESTAMPS
California created a free service that deletes your personal information from over 600 registered data brokers. Tom Kemp, Executive Director of the California Privacy Protection Agency (Cal Privacy), breaks down how the DROP system actually works, why data brokers face fines of up to $40 million a day for non-compliance, what to do if you live outside California, and more. 🔗 SOURCES & LINKS • Cal Privacy: https://cppa.ca.gov/ • DROP: https://privacy.ca.gov • California Safe at Home Program: https://www.sos.ca.gov/registries/safe-home ⏱️ TIMESTAMPS
Once you use Strongbox, a community favorite KeePass client, it's hard to use anything else. Alex Logan is the VP of Engineering at Applause, the company behind Strongbox. He dives into why KeePass syncing works differently than cloud-based password managers, how Strongbox's sync tries to close that gap, what the Applause acquisition actually changed, the open source nuance that trips people up, and whether a Windows or Android client is ever coming. 🔗 SOURCES & LINKS • Strongbox: https://strongboxsafe.com/ • Strongbox Subreddit: https://reddit.com/r/strongbox • KeePass: https://keepass.info/ • Have I Been Pwned: https://haveibeenpwned.com/ ⏱️ TIMESTAMPS