> Anything that makes the attacker's life harder is fair game. No, security mechanisms also should be convenient to use. Otherwise, people will avoid them and

> Anything that makes the attacker's life harder is fair game. No, security mechanisms also should be convenient to use. Otherwise, people will avoid them and work around them using more insecure methods. Anything that can be configured to be transparent, like IPsec, is therefore inherently better than something like this (fwknop), where you have to run special commands from your .ssh/config, and which also only works for SSH.