An anonymous reader writes: Security guru Bruce Schneier contends that money spent on user awareness training could be better spent and that the real failings lie in security design. "The whole concept of security awareness training demonstrates how the computer industry has failed. We should be designing systems that won't let users choose lousy passwords and don't care what links a user clicks on," Schneier writes in a blog post on Dark Reading. He says organizations should invest in security training for developers.