Good security practices are safER not safe