Hackers and technical folks and just the kind of people who hang out here on HN tend to be very inflexible and on the side of being "technically correct" over b

Hackers and technical folks and just the kind of people who hang out here on HN tend to be very inflexible and on the side of being "technically correct" over being "right". From a security perspective, this should never happen. The author is absolutely, positively, without a doubt correct in his stance on this. Being called in such a way and having very little and/or weak security protocols as described is not only a security breach waiting to happen but it really is, as the author points out, training people to get phished. But there's a bigger picture here. And that's the picture of Vanguard as a company having years of experience in talking to, working with, dealing with, and learning about their customers. Just like the manager says in the post, they need to balance security with service (no they're not mutually exclusive but they're not one and the same either). In the end I think this okay. It's not technically correct but it seems like its the right thing to do. Now the reason for this call is never described (which gives some credence to the theories here that this actually never happened along with a lack of other details) but assuming here for the sake of argument that the call was just to talk about something that isn't of super high significance (let's say it was a sales call to upsell something) then a couple of security questions should suffice. If it's to talk about a 10 million dollar bank transfer to some off-shore account then maybe we should be in an uproar here. Another point to consider is who is responsible for security? Obviously the company that hold your data should be reponsible for the safety of that data and should have measures in place to prevent fraudulent access to it. But then there's also the responsibility of the customer who needs to take care of their account credentials and make sure that if someone accesses one of their private accounts somewhere that there isn't a domino effect. I don't think it's Vanguard's responsibility to make sure that all of their customers use different, long, and random passwords on their Gmail and Facebook and what have you so that one day someone can access one of those and get into their Vanguard account. I mean, that's certainly a nice-to-have but customers have a responsibility to secure their data just the same as companies do. We want to be educating regular folks about security all the time but the moment it comes time for them to apply what we're teaching them we turn around and act like they're off the hook for being ignorant of security best practices. It's a double standard if you ask me. I know we all like some good old fashioned manufactured outrage but before we get the pitchforks out let's look at the big picture, and not just one aspect of the issue here.