A threat model where the attacker is assumed to be stupid is a very weak threat model. Better to assume that the attacker is at least as knowledgeable as you are.