I highly recommend reading this security paper (which happens to be written by my boyfriend).