From the third paragraph: That’s a key difference between hypothetical and practical security – your attacker will only do really wacky, creative stuff you hea

From the third paragraph: That’s a key difference between hypothetical and practical security – your attacker will only do really wacky, creative stuff you hear about at conferences (or wherever) when there’s no easier way and the target of the attack justifies the extra effort. Emphasis mine.