[mitchellhislop]

In the Wired article, they mention that they were able to reproduce it. It seems that is their policy, and in my opinion, that policy is the mistake. There should be no easy way to end-run user defined security like this - Mat could have the most secure account in the world, doing everything right, and this still would have gotten him hacked. That is a problem, and a big one.