How does typing in your password make you vulnerable to phishing? When do you authenticate someone in the physical world? What question should you be asking yourself more often?