Grigg's other writings are also worth a read: http://iang.org/ssl/hn_hypotheses_in_secure_protocol_design.html http://iang.org/ssl/hn_hypotheses_in_secure_proto

Grigg's other writings are also worth a read: http://iang.org/ssl/hn_hypotheses_in_secure_protocol_design.html http://iang.org/ssl/hn_hypotheses_in_secure_protocol_design.... But for me, this is the one that stands above the others. It's such a common problem that people only seem to add in security where they think it matters, whereas a system is only as secure as its weakest point.