> When you run a service on the web, it's not enough to protect yourself Nothing but agreement there. Can you identify a specific recommendation by the IETF o

> When you run a service on the web, it's not enough to protect yourself Nothing but agreement there. Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case? > And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa". I had to look up that apparent reference to Harry Potter, but I disagree. Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.