The question, then, is this: to stay safe? Should we that are easier to use, so that users are less likely to ignore them? Or is this a problem that can only be solved if users have a better mindset about security? Security education may not be enough if users continue to make unsafe choices--even when they know better.