>How much usability do you lose to close a cross-site scripting attack? How much usability do you lose to close an SQL injection? How much usability do you lose

>How much usability do you lose to close a cross-site scripting attack? How much usability do you lose to close an SQL injection? How much usability do you lose to close a buffer overflow? None of course. But these aren't philosophical security factors (like the OP). They could actually be classified as "security bugs" or just "bugs". >how much usability do you lose from adopting two-factor authentication on top of a secure system? That can greatly add to a system's security, but you pay the price ("enter a number from this fob") once per login, hardly something to cry about. Considering normal users - a whole lot!!! If I put in a system like this, I would expect a whole load of problems. Consider: Delivery of fob, recall of fobs, damaged to fobs, lost fobs, stolen fobs etc etc. Not to mention about 20% of users would just hate learning how to use it.