> Security relies to a great extent on user behaviour. User behavior is unreliable. We're moving from passwords to passcodes because of how poorly we're pickin

> Security relies to a great extent on user behaviour. User behavior is unreliable. We're moving from passwords to passcodes because of how poorly we're picking and using passwords. > User A visits known domains only, and opens emails from known senders only. They only share card and personal details with known and trusted parties. They only install the strictly necessary apps and from known devs only. It's not enough these days. Known senders can be compromised and send spoofed messages. Supposedly trusted parties have data breaches. Supply chain attacks target known devs, like SolarWinds. > user A is going to be safe most of the time and it's very rare that they in serious trouble. Security is about adapting to emerging threats. Threats that were rare before become widespread, especially if they work. Based on what I've seen it's already happening. Sandboxing and capabilities seem like a step in a right direction. In any case, on a machine and an OS that you own and can modify, you could disable it if you desire. Just like you could disable a firewall. > It would be more effective to create a standard for all browsers where the first screen you see is a big message saying: "Welcome to your 3 second online tutorial [...]" If all that it took to train users about online safety was a brief pop-up, we wouldn't have security problems. Yet here we are. It would have the same effectiveness as cookie banners, consent pop-ups, terms-of-service checkboxes, and are-you-over-18 buttons. None for the users, but someone will keep their hands clean.