The Vault

The Vault is a password manager hosted by XR using BitWarden/Vaultwarden software. It is a place for XR groups to securely store and share the passwords to their online accounts.

What is a password manager?

A password manager is a tool that lets you store all of your passwords together in a safe place. Browsers such as Firefox have this facility. It allows you to generate and securely store passwords that are very strong (e.g. cj*XknvKPgg9b5) because they are not guessable but you don't have to remember them. Instead, you have to know the one master password to access them. This makes life easier for you and much harder for hackers.

You can store lots of passwords, even ones you created years ago if you wish. And you can also store other codes like bike locks and notes you don't want to lose or leave lying around. That said, XR may not be around forever, so our servers will not be the best place for storing important personal information such as bank account logins!

Using our XR Vault you'll be able to access passwords from each of the XR groups that you're involved with as well as your own private storage area.

How do I join the Vault?

Ask your XR group's Group Admin to send you an invite to your group's organisation in the Vault. If your group doesn't yet have an organisation see here

1. Check your emails. You should have received an email:

2. Click on Join Organization Now.

You will see:

3. Click on Create account

You will see:

4. Fill in your email address and name (an alias is fine)

5. Create your password

It is important to choose a master password that is really hard to guess (the Vault will tell you whether it is a strong password or not) and you shouldn't use this password anywhere else. If there's any chance that you might forget this master password, make sure to record it somewhere safe. See also Don’t get locked out of your vault account below

Type your master password then click Submit.

6. You have now created an account on the Vault and can begin to use it to store your passwords.

If you want access to the passwords shared by your group you need to do some additional steps:

1. From the Vault homepage click on Settings at the top of the page (circled in red).

   

2. Under the My Account section note down your account's fingerprint phrase. This will be a string of five random English words (e.g. alligator-transfer-laziness-macaroni-blue).

   

3. Send this fingerprint phrase to your group admin. This will help them to identify you and give you access to the group's passwords.

What if my XR group isn't already using the Vault?

If you want your group to be able to use the Vault, have your group's Secretary, Internal Coordinator, External Coordinator or Group Admin get in touch with the Digital Discussions Applications Team using this Mattermost channel. They can then create the Vault organisation and give you access so you can begin sharing passwords within your group.

How do I access the Vault?

Accessing the Vault via laptop or PC (web browser)

The most straightforward way to use the Vault on your computer is by using a browser extension. To install one of these:

1. Go to the Download part of the Bitwarden website and scroll down to the Web Browser section:

2. Click on the browser that you are using and install the extension.

3. You should now see a small shield icon at the top-right of the browser window:

   

   If you click on this the following screen should pop up:

   

   Click on the gear icon in the top-left corner (circled in red).

4. Under SELF-HOSTED ENVIRONMENT, set the Server URL field to https://vault.extinctionrebellion.uk and click Save.

   

5. Click Log in, enter your email address and master password and then click Log in (top-right corner).

To access the Vault on your mobile device:

1. Install Bitwarden from either the Google Play Store or Apple App Store

2. Open the app. You will see a screen that looks like this:

3. Click on the Settings icon in the top-left of the screen (circled in red). This will bring up a screen that looks like this:

4. Enter https://vault.extinctionrebellion.uk in the Server URL field (red box) and then click Save (circled in red)

5. Click Log in

6. Enter your username and master password and click Log in

Using the Vault

The following instructions are mainly describing use via a laptop/pc web browser, but similar operations are also available via mobile devices

Adding new passwords

To add new passwords to the Vault for either new or existing accounts:

1. Click on the small shield icon at the top right of your browser window:

   

2. You should see a screen like this (without the black squares):

   

3. Click on the + icon in the top-right corner (circled in red). You will see:

   

4. Enter your username and password. If you want to generate a random secure password (strongly recommended!), click on the generate password icon circled in red.

5. Click Save (top-right).

Filling existing passwords

To access the information in the Vault when you want to log in to a website:

1. Click on the small shield icon at the top right of your browser window:

   

2. You will now see a screen like this:

   

3. If the correct account appears under LOGINS then click on it and the username and password fields on the website page should automatically be filled.

   If the account is not there then you will need to search for it in the search bar circled in red. Once you have found the correct account you will have to copy and paste the username and password into the website.

Accessing your password history

If you generate a password and forget to save it to the Vault, you can retrieve it:

1. Click on the small shield icon at the top right of your browser window:

   

2. Click on Generator (circled in red):

   

3. Click Password History to access previously generated passwords.

Sharing passwords

You can only share passwords you create within your Organisation in the Vault. The passwords within your organisation can be assigned to Collections, and you can share collections with other people. You have total control over who can see, edit, etc. which collection, and who can invite others.

All this is documented in Get Started with Organizations in the Bitwarden docs. Be aware that our Vault is a self-hosted installation, and there are no charges for using it - always use our Vault, rather than the commercial Bitwarden one.

Removing access

If someone loses their phone, gets arrested, or has their devices compromised, you should remove their access as soon as possible.

The group owners can remove someone's access to the group, or change which collections they have access to, by going to the group, and clicking Manage, People.

What to do if someone leaves your group

If the person has had access to important passwords, you should assume they have a copy of them. So, as well as removing them from your group on the Vault, you should also CHANGE ALL THE PASSWORDS they had access to.

Don’t get locked out of your Vault account!

If your password is lost then there is no way to regain access to your account (it is designed to be secure after all). Any passwords that you’ve stored in your personal areas will be lost, although it will be possible for you to be re-invited to any shared group vaults after setting up a new account. If you were the sole ‘owner’ of a group’s vault then control of that will also have been lost, although others in your group (who you’d previously granted access to) should still be able to gain access in order to retrieve passwords.

So it’s best to take precautionary measures to ensure you never lose control of your vault.

These might include:

• Use a master password that you’re sure you won’t forget (but which is still complex enough to be secure), or storing the master password somewhere safe

• Set up a password ‘hint’ to be emailed to you when needed (but only do this if you can think of something cryptic enough that it wouldn’t help anyone else guess your password)

• If your account is the ‘owner’ of a group’s vault, invite a second trusted group member to also be an ‘owner’, and make sure to nominate someone to replace you if you leave the group

• You can nominate someone to be an ‘Emergency Contact’. This facility allows you to designate and manage trusted emergency contacts (who must also have XR Vault accounts set up), who can request access to your vault in a case of lost password. If you lose your password you then ask one of your emergency contacts to request access to your account. You will get an email to notify you of the request, and you then grant permission for them to proceed. When selecting your emergency contact, do consider that they will potentially have access to all group vaults to which you’ve been invited

Where else can I find information?

• Bitwarden help

• Why You Should Use a Password Manager, and How to Get Started