The better way is to make the secure path the easy path. You don't have to educate users to do something that makes their life harder, you can educate them in a

The better way is to make the secure path the easy path. You don't have to educate users to do something that makes their life harder, you can educate them in an easier way to do what they want. That's far more likely to stick. Usability is a security issue; at the ultimate extreme a DoS attack is just creating a very poor user experience.