For the most part, encryption isn’t magic. Encryption lets you manage secrets more securely, but if users are involved in the key management, that almost certainly comes at the expense of usability and features. Web services should strongly consider encryption where possible to more strictly manage their internal access controls. But think carefully before embarking on a design that forces users to manage their keys. In many cases, users simply don’t understand that losing the key means losing the data. As my colleague Umesh Shankar says, if you design a car lock so secure that locking yourself out means crushing the car and buying a new one, you’re probably doing it wrong.

That last point bears repeating: if you design a system with encryption where users manage keys, you’re going to lose features. You want gravy on that turkey? Sorry, no stuffing for you. “What?” you say. But I want my stuffing and my gravy! I want to believe I can have it all!

"Use bcrypt"

"The only secure password is the one you can’t remember" /by @troyhunt

RT @thoughtbot: Confirmation bias.

Essay about security, specifically looking at the potential danger of biometrics being misunderstood and therefore misued. (via <a href="http://www.schneier.com/blog/archives/2009/01/identity_authen.html">Bruce Schneier</a>)