When the attacker becomes the user: Rethinking account takeover

Leaked private keys for eight CA certificates let any attacker impersonate any domain

User refused to change her password because everyone already knew it

Telegram Desktop vulnerability allowed any user's file to be stolen