periodic reminder for infosec folks: stop deciding things are done badly or "insecure" outside of the context of a threat model

it's disingenuous and irresponsibly ignores that security and cryptography are fundamentally about balancing risk tolerance and risk abatement