Comment by tremon

"the attacker probably won't do that" is very much part of threat modeling, the #1 step in any serious security design.