Over years of trials security teams at places like Google have managed to successfully phish even people on those security teams. The verdict is in on whether this UX provides acceptable security.