Psychology of a con

One of the biggest security weak spots in all systems is the user.  Yes, there are many complicated processes for attacking networks and cracking password files, but why bother with that when you can simply ask an inside user for their network credentials?  I'm just getting caught up on email so have just read Bruce Schneier's December cryptogram which highlighted a great article by Paul J Zak called How To Run a Con. While this article is specific to traditional con men and their marks, this same logic can be applied to how easy it is to social engineer data out of so many users. We want to trust people, and most of all, we want to be trusted, too. Interesting reading!