The other day, I participated in a discussion on Meta Stack Overflow about what to do when a user publishes credentials (usually inadvertently) to a Stack Exchange post. (GitHub and other sites have similar problems.)
I realized after posting my thoughts that it seems quite cynical for me to always assume that the credentials have been compromised, even if they were only visible to the whole Internet for just a few minutes/hours. And at least one other person pointed this out.
Cynicism is not usually intuitive for me. At work and in life generally, I find that it's better to give others the benefit of the doubt and treat them like real people rather than, say, criminals or malicious users.
So my question isn't about whether I'm right or wrong or even what to do. But I am wondering, does cynicism play a valid role in information security? And to clarify, I'm not talking about being a cynic who is miserable to be around because the negative attitude rubs off. I mean is it recommended from a security perspective to assume that others are motivated only by self-interest? (Or, in other words, is it acceptable to assume that if somebody could have stolen your credentials, they did steal them?)
Is it even possible to approach security from the perspective that people are basically virtuous? (As in, would it solicit a more positive response from potential threats and thus minimize risk?)
If you have specific historical examples or some sort of related academic/scientific publications, that would be helpful.