always first blame the flawed security. sure, also blame attackers. never blame the attacker's tools. this is a place where "victim-blaming" is exactly the r

always first blame the flawed security. sure, also blame attackers. never blame the attacker's tools. this is a place where "victim-blaming" is exactly the right thing to do. we can be supportive, even empathetic, of victims, who may have attempted to be secure, but failed due to bad tools, third parties, etc.