The most interesting part for me was the MS security paper he linked to:<p><a href="http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf" rel="nofollow">http://research.microsoft.com/en-us/um/people/cormac/papers/...</a><p>It's a great explanation of why users are rational to ignore all our security advice; the expected benefits are so low compared to the effort required, and a lot of the costs are borne by other people anyway.