It depends on your risk model.
If you can trust the person paying you, you can accept payment on 0/unconfirmed if you want.
As a merchant or trader, you want to use the configuration that is more secure (no incoming connections permitted, explicity connect to well-connected nodes).
With zero confirmations you are vulnerable to the race attack and the Finney attack, as well as the 51% attack.
With one confirmation you are vulnerable to the 51% attack. There could also be a miner with a lot of hashing power who could get a couple blocks in a row, so three confirmations removes most of them.
With six confirmations it is essentially mathematically impossible for an attacker with less than 51% of all mining capacity to get six blocks in a row. and still surpass the longest block chain. With 51% or a lot more than 51% the attacker can get six confirmations by creating a parallel blockchain in which only transactions approved by the attacker get included in blocks.
A merchant like a retailer can likely accept even on 0/unconfirmed in most instances (e.g., purchases up to $100 worth). A merchant that ships e-commerce might hold off until the transaction has three confirmations.
A cash, face-to-face cash trade will probably be best if three confirmations for a large amount, maybe one confirmation for small amounts.
Any recommendation would need to come only after determining which risks are deemed acceptible.