The best thing I read about modern computer security came from Google, I'm fairly certain, though I can't find the reference now. Basically, the old model was

The best thing I read about modern computer security came from Google, I'm fairly certain, though I can't find the reference now. Basically, the old model was two-party: you vs adversary. It could be assumed that your computer was trustworthy unless it had already been compromised by the adversary. Security in that model was largely based around the "computers should do what their users want" idea. Unfortunately, it doesn't line up with the actual state of computers and computer users today. Modern security systems (especially those in mobile devices and web browsers) are designed to be three-party: you, your agent, and the adversary. You can be trusted, the adversary can't be trusted, and your agent (software on your computer) can be trusted sometimes. It's not automatically true that code running on your computer, on your behalf, is actually safe. Most users have no idea what that code is even doing. This three-party model is what underpins the app sandbox, it's what underpins web app security including the same-origin policy, and it's what underpins things like Mozilla and Chrome's plugin and extension blocking. You can't always assume that computers are doing what their users want. I think what is difficult about this is that, as your technical expertise rises, the two-party model becomes closer to the truth and the three-party model less so. As a developer I find my computer telling me I can't do something enormously frustrating. However, after the thousandth time cleaning malware off my mother's helpful computer, I really wish it would tell her what she can't do more often. So, while I buy the "we can't control the layer above us" argument, I don't find "do what the user wants" compelling at all. Where was that argument when the users wanted to install old insecure versions of Flash? Or had apps that Google remotely removed from Android phones?