at the same time, it's possible for the website to do absolutely everything right and still lose a lot of information. one reasonable solution is just to say t

at the same time, it's possible for the website to do absolutely everything right and still lose a lot of information. one reasonable solution is just to say tough luck, it's still your fault, and then every company dealing with sensitive information buys data-breach insurance, with the insurance company helping to vet and improve their systems and processes if they want. this arrangement is pretty common and i could imagine it becoming legally mandatory. even if there's a real unavoidable zero day, still hold the company liable, make them use their insurance, and then let the insurance company sue whoever is really at fault to recover their losses.