At this point, does there exist a way to stay secure agreed upon by the security community. Fundamentally phishing is social engineering. Humans are emotional and irrational especially in social situations. Is everything not just a matter of making sure I am a couple standard deviations more secure than most other people?