The tech department invites all users to the organization, but you have to create an account to accept the invitation. To get started, check your email (after the initial training or once you have been hired) to find an email from Bitwarden, with the subject “Join West Fork Schools.” It should look something like this:

Once you click on the “Join Organization Now” button, you will be taken to a page asking you to log in or create an account. You will need to click on “Create account” to get started.

On the next page, you will be asked to provide your name and to set a strong “master password.” This password will be the one that unlocks all of your other passwords, so it HAS to be strong.

Here is a tip for making a super strong password:

For example… You may have a soft spot for 80’s power ballads (because who doesn’t). Perhaps you have to pull over when Journey’s “Faithfully” comes on the radio because your air guitar and totally stage-worthy singing on that last chorus are nothing if not a hazard to other drivers.

A great password might be a riff on “I’m forever yours, faithfully.” Maybe something like this:
1983I’m forever yours, faithfully!

In addition to setting a master password, You will be asked for a password hint. You don’t have to do this, and the tech department will be able to reset your master password if you forget it, but it is always nice to not wait on the ticket time. Notice that I put in a hint (Journey to the Center of the Earth), but it would not be obvious how it relates to my password unless you knew what my password was. This is also a good habit to get into.

Once you have filled out the information, go ahead and click on “Create Account.”

You will be taken to the login screen. You may now put in your email address and click on “Continue.”

On the next page, enter your master password, then click on the “Log in with master password” button.

Once you have logged in, you will need to verify your account, and the tech department will have to approve your new account before you have full access.

Verify Your Email

On the Vault Page, There is a box on the right labeled “VERIFY EMAIL.” Go ahead and click the “Send email” button inside of that.

Now, you should go check your school email. There should be two new emails from Bitwarden. The first is a “Welcome to Bitwarden!” message. That one might be worth a read as it has download links for the extensions, but we want the other one for now. The subject should be “Verify Your Email.” It should look like this:

Go ahead and click on the “Verify Email Address Now” button.

You will be taken to the login again. At this point, you are verified, and you may begin using BitWarden for your personal and school password-saving needs. We will release more training on BitWarden in the coming days, but the end of this article will go into setting up your Chrome extension.

Account is Now Pending Approval

While the basic functions of BitWarden are now active, you must wait for the tech department to manually approve your account before you gain full access to the West Fork Schools organization. This organization will have specific capabilities depending on who you are. More information will be coming soon, but, for now, just wait for the email letting you know that you have been approved. It looks something like this:

Once this happens, you will be able to log in with full permissions.

LOGIN IS DIFFERENT ONCE APPROVED

Once you are approved, you will be required to use the “Enterprise single sign-on” at any point you see the button available. This means that BitWarden will verify your identity by also using your Google account and any two-factor authentication that is tied to it. This might seem annoying, but when you stop to think about the student, personal, financial, and institutional data that will be stored in this manager, one extra login a day isn’t that big of a deal.

Also, we added a “BitWarden Password Vault” option to the WF Bookmarks menu. That will take you directly to a page with a “Log in” button. Clicking that button directs you to Google for your actual login.

After you click the “Enterprise Single Sign-On” button (or use the link in WF Bookmarks), you will be prompted for your master password, so I don’t even bother typing that is the page, otherwise, you will have to type it twice.

Once you unlock your account with your master password, you will be greeted with your vault again.

The good news is that we already pushed the extension to all Chrome browsers with sync enabled. Woot!

The better news is that you can also install it on unmanaged Chrome browsers (and pretty much every other browser). This page has download links for desktop clients, web browsers, and phones.

Once you have the extension installed, you will be presented with a login screen. But wait!!! Before you type in your email, there is a setting you need to change. Click where it says “Accessing: bitwardent.com” as shown in the screenshot.

You need to change this to Self-hosted. That will bring up a window, and in the top box, labeled “Server URL,” type in:
https://bw.wftigers.org

Then click on Save at the top.

You should then get a green confirmation notice at the bottom, and it should say Self-hosted under the email address box.

Now go ahead and type in your email address! I also click the “Remember email” checkbox.

Then click on Continue.

On the next page, if you have been approved by tech, you need to click on the “Enterprise single sign-on” button. That will take you to a Google page (unless you are already logged in). Complete the Google authentication and any two-factor that is required.

You will then get this screen:

This just means you may now open the extension, and then type in your master password, and click on “Unlock”

You will now be presented with your Bitwarden vault and other options.

You don’t have to do the whole login routine on the extension every time. You will sometimes have to refresh the Google login, but, for the most part, you will only be asked to type in your master password when you start Chrome for the first time each day. This setup just ensures that other people will have a MUCH more difficult time getting the information that is stored within BitWarden.

As for the web vault, as long as you use the WF Bookmarks menu item, the same rules apply. 🙂

Short answer: INCREDIBLY!

Longer answer: Bitwarden, by default, if you just used the free version available to the public, is HIGHLY secure. The company routinely submits its code to third-party security agencies for review and correction, PLUS, their code is open source, meaning that everyone in the world can read every line of the code, suggest security fixes, and generally make the security even better.

To go further, we are using a self-hosted version, meaning that your password management will never touch the public version of the service. We get the same level of code security with the added security of being isolated.

That is totally valid! Here is the super great news… We can’t see your passwords (unless you specifically share them with a group we are in)! We can’t even tell how many passwords you have in the system.

The truly beautiful thing about how Bitwarden works is that all of the fancy security stuff happens on YOUR end, meaning inside of the browser or on the phone you are using when you save or use a saved password. When it gets to the server, it is HEAVILY encrypted, to the point that the server and anyone with access to it (like the tech department or any malicious hackers) can’t tell what is going on. To crack your password, the person would also have to know your Master Password. That is why that password is SO IMPORTANT!

That is totally up to you! Obviously, there is a personal level of comfort that you need to have, but, as far as the safety of your data goes, Bitwarden is going to be a safe way for you to store that.

You are permitted to store credit card information, personal passwords, and secure notes in your vault. Just use good judgment, and consider exporting your vault every now and again in the event the server crashes.

Well… While full-on server crashes are rare, they do happen. This is another place where Bitwarden is super helpful. There are automated nightly backups built into the system. The tech department will be taking these backups, and they will be moved to a dedicated Google Shared Drive as well as a local storage server. In the event of a data crash, we should be able to get the backups recovered in a couple of hours with very little (if any) data loss. The only potential data loss would be passwords/info saved between the backup and the crash.

Look… We know that Google’s password manager is handy. Really. We get it. The problem is that it is so deeply tied to Google Chrome and your account. If someone gets access to your Google account, they also get access to EVERYTHING stored in the Google password manager, including any credit cards, passwords, whatever…

BitWarden doesn’t rely specifically on your Google account. In fact, it is only using your Google account as a THIRD layer of authentication. That means for someone to gain access to your BitWarden account, they have to be able to know your Google account info, defeat your two-factor, AND know your BitWarden master password. That is an awful lot of hacking required.

We will be honest here. Absolutely! That said, most of those possibilities are totally avoidable. The weakest point of this chain is having a poor master password. We have required specific rules be met to help combat this, but it ultimately comes down to you putting in the work to think of a strong passPHRASE.

Furthermore, hackers are not just weird kids in their mom’s basement anymore. Some hackers are among the wealthiest people in the world, and they got that way because they are really good at their job (hacking). Again, BitWarden submits to regular security audits, and their code is available to the world, but there are other ways for hackers to get into those systems. We won’t go into details (unless you ask), but IF you fell for a phishing campaign or were otherwise infected with malware, it is possible that there would be systems running on your computer that track what you are typing. In that case, your master password could be compromised. Also though, in that case, we would be relying on Google’s security and the two-factor authentication layer to further protect.

The simple answer is that, while it is SUPER unlikely that your data will ever be able to be taken from BitWarden without your consent, it isn’t a 0% chance.

Also, to be clear, that answer is sort of a general one. There is no such thing as 100% online safety.