One password, one weak point.

The argument

You cannot remove the weak point. You choose it.

In a hosted system, the weak point is distributed and invisible: a provider's staff, its suppliers, its login flow, its recovery e-mail, the phone number a stranger can talk a shop into transferring.

In ours it is singular and obvious: the password you keep in your head, and the physical whereabouts of three cards. Neither is comfortable. Both are things you can inspect, practise and improve.

That is the whole design decision. Not fewer risks, legible ones.

Making it survivable

Three habits that carry the weight.

1. I

   Rehearse

   Open a card a few times a year, from memory. A password you never type is a password you are losing.

2. II

   Distribute

   Three cards in three places. One fire, one burglary, one lost coat should not be the end.

3. III

   Tell one person

   Somebody should know a card exists and roughly what it is for, even if they cannot open it.