Why treating them as the same breaks your security model | Not Hacker News!