Requirements to improve security may hurt more than they help