Attackers don't need these practices to be normal, they just need them to be common enough (significant minority of)