This is something I like to bring up to programmers/designers in context of application security. And that is any assumptions on how the user is going to use said program you come up with will be broken. If you say "No one will do ______" you will likely be incorrect.