Right, the hard question is how do you prevent the spread of trojan horses which use basic social engineering?

It's not difficult to get people to run a sketchy program and type their password into any old prompt. You need layers upon layers of security to mitigate this.