Is it possible that, after years of indiscriminate leaks, drained bank accounts and successful persistent attacks of all shapes and colors, nothing has changed? Is it possible that, despite the OWASP Top 10 mentioned to death and the desperate warning of all security experts, some habits remain so hard to break? Surfing between truth and legends, we'll try to understand what really matters to the good ol' attacker and what mitigations, unfortunately, offer the Information Technology world, which is perpetually dazzled by the myth of the "magic box".