People still fall for "convincing" emails and social media profiles with a name and a photo. I work tech support at my university, and we regularly have to deal with faculty clicking on things they shouldn't, or not clicking on things they should. I also do some work for a local non-profit and a month ago two employees came uncomfortably close to costing us thousands.

Cryptographic trust won't help much either unless it is packaged and presented in the right way to the end user - it's basically advanced black magic to most people. I would love to have cryptographic verification setup for the non-profit's communication so that they can have some guarantee of legitimacy, but first I have to figure out how to make it fit into their workflow and not require them to actually take any action.

It's important to keep in mind that we have some distorted sampling. I would guess that most if not all of the people on HN are technical to some degree, so we may tend to have a bit of a bubble. We are a pathetically, uncomfortably small minority.

Never, ever, ever rely on humans doing the right thing if you can help it, whether in the form of an individual, a corporation, or a government.