The same shows here: > security engineers need to design systems that are resilient to them The problem here, to a security engineer, is that we need better s

The same shows here: > security engineers need to design systems that are resilient to them The problem here, to a security engineer, is that we need better systems. I suspect they mean the hardware and software systems, although the 'system' includes the participants. The problem and solution space should strongly include people as it just was clearly demonstrated. Could be an occupational hazard, having seen so many insecure and poorly designed system to have low opinions of them. Having low expectation of security practices sets a lower bar for acceptance of what's authentic. I can't say if I would be caught in similar circumstances without being in the moment. The two things I hope I'd do is see the tx in my own history and not tell a human a code. These are for machines to verify. I recall when everyone switched their system so PINs could be entered for machine verification and the human returning after. A machine sent code should also be checked by a machine. A practice that does bother me greatly is how many different domain names are used by a company. Only subdomains should be used for any kind of official interaction (or perhaps period).