> Every user understands two things about the internet: 1) check the URL before entering any sensitive data, and 2) don't run random stuff you download

I think you're severely overestimating the things every user knows.