I’ve been using Google Authenticator to generate one time passwords for many years. When I get a new phone, it’s pretty simple to get all of my accounts transferred over using the export QR code on my old phone and then scanning the QR code with my new phone. I’ve wanted to switch to an authenticator app that has a better backup story for some time, but that would mean having to log into each service and re-enroll in two factor auth, account by account. …

I set a reading goal for the year of 12 books because I wanted to become someone who reads again. That’s one a month. It seemed like a realistic goal, and it turned out to be not quite ambitious enough. Once it was obvious I would clear 12, I bumped the goal to 26. That’s one every two weeks, still within the realm of realistic, I think. It was a useful constraint without turning a hobby into a performance review. …

Over the past few years, I have given a talk on Cryptography Pitfalls at a variety of conferences. One section of the talk covers the evolution of password storage and the various data breaches the last few years. In addition to covering the ways password storage has been done wrong, I also present the best solutions. Instead of recapping it again, take a look at Coda Hale’s blog post on the topic. A few brave souls will occasionally come up to me later and admit their company still stores passwords in a less than ideal way. There are many reasons for this, but they generally boil down to the fact that the software is old and developers just didn’t know any better when they wrote that part of the system. …

We’ve all seen the tense scene in a war movie where the order has come down to launch the nuclear missiles. The captain and his first officer each take out a special key they’ve had around their neck the whole time. Then they both insert their individual keys into the weapons computer and turn simultaneously. Despite being a popular motif, this is a real policy implemented by many military organizations, including the U.S. Air Force. Once you think about it this kind of policy is obvious, one person shouldn’t be able to launch nuclear weapons on their own. Trustworthy is like having a two-man rule for your data. …