The most interesting part for me was the MS security paper he linked to: http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf

The most interesting part for me was the MS security paper he linked to: http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf http://research.microsoft.com/en-us/um/people/cormac/papers/... It's a great explanation of why users are rational to ignore all our security advice; the expected benefits are so low compared to the effort required, and a lot of the costs are borne by other people anyway.