Personally, I think the author might be clinically paranoid.

Remember the word "excessive" from that dictionary definition of paranoia which was quoted in the article? I think that's the key. There must be a limit on what qualifies as "excessive", how much is too much.

For example, note that there is no discussion in this article of ROI or costs vs benefits. None. Applying every possible security measure irregardless of whether it actually does anything or not sounds excessive to me. Using a 14-word password with a "lame account" such as a New York Times login, for example, seems excessive to me (just falsify your personal info and the attacker would have nothing to gain). "Excessive" has to represent some limit, and the author shows no evidence of being aware of that limit.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/320/31593#31593