Airport coffee in hand, watching people type passwords in full view of security cameras. Thirty years in this field and the basics never change. We build elaborate defenses while ignoring the obvious.