[gherkin0]

I think it's a little bit of this, a little bit of that. We need regulation to attempt to enforce baseline security practices (e.g. no passwords in cleartext, encryption during authentication, etc), since that can be proactive if not comprehensive. In addition to that, we need stronger consumer advocacy and liability for the more complicated, unanticipated cases.

> We'd have to find a balance though, as we are already way too litigious and we'd be stifling innovation out of fear of getting accused of negligence.

If we're "way too litigious" to the point of stifling innovation, then I think the problem and solution are in a completely different area than this.