>> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to

>> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. I don't follow you. In the first sentence, the "we" is developers of web sites, right? Who is the "we" in the second half? Who are you suggesting should assume developers will make mistakes, and what can/should be done to mitigate that? One possible interpretation is that the second "we" is users, and as a user, yes, I do assume that sites will make mistakes. One reaction is not re-using passwords. But if the user and the site are both naive, I don't see who is left to keep the wolves out.