Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference.

Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference. This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.