It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did.

If someone steals your password, you can change it. But if someone steals your thumbprint, you can't get a new thumb. The failure modes are very different.

The question to ask when you look at security is not whether this makes us safer, but whether it's worth the trade-off.

People don't understand computers. Computers are magical boxes that do things. People believe what computers tell them.

Metadata equals surveillance; it's that simple.

The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something nonrandom like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember.