In summary:
- PCWorld examines how even cybersecurity experts like Troy Hunt fall victim to phishing schemes and make critical security errors.
- The article highlights real-world failures including lost encryption keys in cryptography research elections and mistakes by industry pioneers.
- These expert vulnerabilities demonstrate that human error remains cybersecurity’s weakest link, requiring better preparation and defensive strategies against common mistakes.
Turns out that helming the forefront of cybersecurity is not a shield from basic mistakes. Such was the lesson buried in a talk at RSAC 2026, where a pioneer in cryptography recapped a notable slip-up last year: A whole election failing because someone lost their part of an encryption key.
(Yep.)
While discussing the field of cryptography during a panel talk, Whitfield Diffie referenced the International Association of Cryptography Research’s ill-fated leadership election, which took place last November. In an effort to thwart collusion and election tampering, the election required three trustees to hold part of the cryptographic key needed to decrypt the results. Unfortunately, one member lost their piece, leaving the election results forever locked by encryption.
So what are the lessons here for us normies? I think there are a couple. First, everyone gets tripped up by basic human error—and you just have to accept that such errors reveal our weaknesses. Diffie alluded to this idea himself, saying that key management is “on one hand, it’s the subject of a lot of work, but on another, it’s sort of often missed.” In this case, the IACR got through by holding a do-over election the following month, and also made revisions to their election system to avoid such a problem in the future.
Second, if you make a dumb mistake, don’t hide it. Sharing your story can help others. Last year, well-known security guru Troy Hunt fell for a phishing scheme, leading to a leak of info about his mailing list subscribers. He decided to lay the situation in detail for his blog subscribers—an act that helped remind everyone that threat avoidance isn’t always about smarts. Sometimes, you have to guard against your own human vulnerabilities. (In this case, fatigue was at fault.)
How do you create those defenses? Figure out the info you’ll need if your normal process fails—you forget your login info for your password manager, lose your device for two-factor authentication, or realize your encrypted hard drive is failing. (The to-do items for these scenarios? Set up recovery keys; create backup 2FA methods; and save your BitLocker key.)
Think of it as digital disaster preparation, similar to being ready for an environmental catastrophe at home.
Author: Alaina Yee, Senior Editor, PCWorld
A 15-year veteran of technology and video games journalism, Alaina Yee covers a variety of topics for PCWorld. Since joining the team in 2016, she’s written about CPUs, Windows, PC building, Chrome, Raspberry Pi, and much more—while also serving as PCWorld’s resident bargain hunter (#slickdeals). Currently her focus is on security, helping people understand how best to protect themselves online. Her work has previously appeared in PC Gamer, IGN, Maximum PC, and Official Xbox Magazine.