Interesting logic but bad conclusion -- why didn't you do the final calculation?!?! 1 minute/day verifying URLs --> cost of $0.33 of lost productivity --> avoi

Interesting logic but bad conclusion -- why didn't you do the final calculation?!?! 1 minute/day verifying URLs --> cost of $0.33 of lost productivity --> avoid .01% chance of phishing attack --> avoid .01% chance of loss of $500 --> avoid a loss of $0.05 With these numbers, it never makes sense to verify URLs ($0.33 > $0.05). > my loss is $500 + WEEKS of hassle with banks, credit reporting agencies, etc, to clean up the mess! This is the rub IMO.. if it costs you $2,000 in time/lost wages/whatever to work through fixing it, it still only costs $0.25 total/day, ie still not worth it. If it costs $3,000, then it's worth it. > This is like the antibiotics trade-off. Not really - you saw "population" and made the connection, but it isn't there. In the antibiotics situation, there's a common resource - antibiotic effectiveness - that is slowly depleted as a member of the population partakes. It's in the population's interest to maintain the resource, and in the individual's interest to deplete it. This is called Tragedy of the Commons [0]. For security though there is no analogous common resource; my security practices as a user and yours aren't connected in that way. It's everyone for themselves. [0] https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons