You do, but does the average user? Security's reliance on people's behaviour / knowledge / discipline should be minimal.