A new report helps explain why we make bad security decisions. We can summarise its findings in three words: phones, lunch and location.