I was reading Social Engineering: The Art of Human Hacking [0] a few years ago and it was really fascinating to see how easy it is to get the user to give us da

I was reading Social Engineering: The Art of Human Hacking [0] a few years ago and it was really fascinating to see how easy it is to get the user to give us data versus unlocking an AES256 encrypted value on a computer I'm not allowed to touch. Since I do a lot of work in PCI (Ecommerce / Orders / Credit Cards) I've learned that the most secure systems never allow the human user to access decrypted data. That things like tokenization work, and it's far better to give an abstraction of a credit card for tech support and developers to work with than the actual card even though on the surface it seems like it's not a big deal. If you are designing a system and at any point think, "This data is okay for the user to access because they can't (share/steal/walk out of the building with) it." You should seriously read the book I mentioned above. It really is impossible for you to imagine all of the very logical scenarios that would lead a janitor to keep a door unlocked. In fact, I can already think of a handful of reason why, if I were a janitor, I would keep that door unlocked because of a sticky note. [0]http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539 http://www.amazon.com/Social-Engineering-The-Human-Hacking/d...