1820: Security Advice - Revision history

FaviFake: Undo revision 389310 by 2001:4450:813D:C800:FCCA:442D:8C9D:DF33 (talk)

2025-10-23T20:32:08Z

Undo revision 389310 by 2001:4450:813D:C800:FCCA:442D:8C9D:DF33 (talk)

42.book.addict: we don't use TOCs in comic pages

2025-10-23T05:04:52Z

we don't use TOCs in comic pages

2001:4450:813D:C800:FCCA:442D:8C9D:DF33 at 22:21, 22 October 2025

2025-10-22T22:21:09Z

FaviFake at 14:58, 6 August 2025

2025-08-06T14:58:40Z

FaviFake: /* Explanation */

2025-08-06T14:41:46Z

‎Explanation

FaviFake: /* Explanation */ oops

2025-08-06T14:40:41Z

‎Explanation: oops

FaviFake: another evil table destroyed for good

2025-08-06T14:39:56Z

another evil table destroyed for good

Show changes

Waldir: removed Category:Computers; added Category:Computer security using HotCat

2025-08-05T14:44:50Z

removed Category:Computers; added Category:Computer security using HotCat

172.68.174.231: /* Security tips */

2025-01-30T21:24:37Z

‎Security tips

172.69.71.97: why do we need a trump reference.

2024-10-21T18:36:45Z

why do we need a trump reference.

@@ Line 4: / Line 4: @@
 | title     = Security Advice
 | image     = security_advice.png
 | titletext = Never give your password or bank account number to anyone who doesn't have a blue check mark next to their name.
 }}

← Older revision		Revision as of 05:04, 23 October 2025
Line 9:		Line 9:

	==Explanation==		==Explanation==
−	~~{{TOC}}~~
	This is another one of [[Randall\|Randall's]] [[:Category:Tips\|Tips]], this time a list of security tips.		This is another one of [[Randall\|Randall's]] [[:Category:Tips\|Tips]], this time a list of security tips.

@@ Line 4: / Line 4: @@
 | title     = Security Advice
 | image     = security_advice.png
 | titletext = Never give your password or bank account number to anyone who doesn't have a blue check mark next to their name.
 }}
 ==Explanation==
 This is another one of [[Randall|Randall's]] [[:Category:Tips|Tips]], this time a list of security tips.

← Older revision		Revision as of 14:58, 6 August 2025
Line 106:		Line 106:
	[[Category:Computer security]]		[[Category:Computer security]]
	[[Category:Tips]]		[[Category:Tips]]
		+	[[Category:Computers]]

@@ Line 33: / Line 33: @@
 ; <span id="tip6"></span>Use a 2-factor smoke detector
-: {{w|Multi-factor authentication|Two factor authentication}} describes the practice of using two different identification factors (such as a password and a code from a secure token) to authenticate the user. A two factor smoke detector presumably uses two or more factors to identify ''smoke'' (such as {{w|Smoke_detector#Ionization|ionization}} and {{w|Smoke_detector#Photoelectric|photoelectric}}). Such devices [https://alarmspecs.com actually exist], but, while improving the user's general safety, they do nothing to improve their internet security.
+: {{w|Multi-factor authentication|Two factor authentication}} describes the practice of using two different identification factors (such as a password and a code from a secure token) to authenticate the user. A two factor smoke detector presumably uses two or more factors to identify ''smoke'' (such as {{w|Smoke_detector#Ionization|ionization}} and {{w|Smoke_detector#Photoelectric|photoelectric}}). Such devices [https://alarmspecs.com actually exist], but, while improving the user's general safety, they do nothing to improve their internet security. A month before this comic the newest [[:Category:xkcd Phones|xkcd Phone]], [[1809: xkcd Phone 5]], was released with a 28-factor authentication.
 <!-- Previously, this row argued:
 "Also, the logic behind using two-factor authentication is that '''both''' types of credentials must match to grant access. Smoke detectors work otherwise - usually firing if '''any''' of the sensors detect a fire. If the smoke detector worked according to the authentication logic it will be less likely to detect smoke, effectively lessening fire safety as compared to a single sensor one."
-: That analysis is not correct, because detection is not binary, it involves thresholds. A smoke detector with two independent detection mechanisms can lower the threshold of one or both mechanisms in combination with the other, adjusting the likelihood of detection and the confidence of each detection. With any detector there is a tradeoff between nuisance tripping and detection failure. A dual function detector allows those tradeoffs to be made in two dimensions and not just one, and is not inherently more prone to nuisance tripping.  And all that assumes the mechanisms are functioning as AND, which does not seem to be a requirement put forth in the comic. ~~~~
+: That analysis is not correct, because detection is not binary, it involves thresholds. A smoke detector with two independent detection mechanisms can lower the threshold of one or both mechanisms in combination with the other, adjusting the likelihood of detection and the confidence of each detection. With any detector there is a tradeoff between nuisance tripping and detection failure. A dual function detector allows those tradeoffs to be made in two dimensions and not just one, and is not inherently more prone to nuisance tripping.  And all that assumes the mechanisms are functioning as AND, which does not seem to be a requirement put forth in the comic. -->
 ; <span id="tip7"></span>Change your maiden name regularly

@@ Line 14: / Line 14: @@
 As a result, Cueball suggests using {{w|reverse psychology}} and give out bad advice instead, in hopes of achieving a positive effect. The last panel contains a list with 13 security tips, which are parodies of actual security tips. The title text is just one more tip. See [[#Security tips|table]] below for explanations for all 14 tips.
-: ; <span id="tip0"></span>Print out this list and keep it in your bank safe deposit box (header)
+; <span id="tip0"></span>Print out this list and keep it in your bank safe deposit box (header)
 : This is a standard recommendation for documents that must be kept secure because they are irreplaceable and/or contain sensitive information. However this list itself is easily replaceable and the contents will be well-known, so storing it in a safe place is totally unnecessary.  Putting it in a {{w|safe deposit box}} would even be counterproductive since the list can only serve its purpose as a ready reminder if it's easily accessible to everyone. So when people fail to follow this tip, they may end up keeping it in a place where they have easy access to the tips so they may also fail to follow all the others.
-: ; <span id="tip1"></span>Don't click links to websites
+; <span id="tip1"></span>Don't click links to websites
 : The usual tip is "Don't click on ''suspicious'' website links" or "Don't click any links in suspicious emails". The comic's variation instead tells users not to click on any links to any websites, which essentially stops them from using the World Wide Web altogether. So this tip is not really helping, as the opposite of this would be to click on all links. [https://www.sketchywebsite.net This is an example website that showcases an extreme example of what ''could'' (probably wouldn't (this is not advice)) happen if you clicked on a suspicious link.]
-: ; <span id="tip2"></span>Use prime numbers in your password
+; <span id="tip2"></span>Use prime numbers in your password
 : It is usually recommended that one uses numbers in one's password, to increase its entropy, making it harder to find with a {{w|Brute-force attack|brute force}} attack. In contrast the comic suggests using {{w|prime numbers}} in one's password. Large prime numbers are an essential part of modern cryptography and security systems, when used in algorithms that are computed by machines.  They don't have any effect when used by humans in passwords, except for maybe making it harder to remember. In addition, if people were to regularly use prime numbers in their passwords, it would actually make passwords ''easier'' to guess, as it would substantially reduce the number of possible passwords people may choose from.
-: ; <span id="tip3"></span>Change your password manager monthly
+; <span id="tip3"></span>Change your password manager monthly
 : It is often recommended to change passwords on a regular basis and to use a {{w|password manager}}. Password managers are programs which can help users create, store, and change their passwords easily and securely. Changing password managers monthly would involve copying all stored passwords from one manager to another, which would be quite impractical and has no security benefit.
-: ; <span id="tip4"></span>Hold your breath while crossing the border
+; <span id="tip4"></span>Hold your breath while crossing the border
 : At some border crossings, government agents may search computers, cell phones, and other electronic devices.  The usual advice for such situations ranges from asserting your rights to resetting all devices and deleting all data prior to crossing a border.  Holding one's breath can potentially prevent inhaling germs or poisons in some situations, though useless in the context of computer security.  These two topics mixed in the same advice won't achieve anything, but if you hold your breath for too long you could pass out when crossing, or look stressed/suspicious and invite even more scrutiny. This could also be a reference to the superstition of holding one's breath when passing a graveyard, or similarly to the movie ''{{w|Spirited Away}}'', where the main character is instructed to hold her breath while crossing the bridge that acts as the border between the human and spirit world. In any case, holding one's breath while browsing the Internet would have no useful effect, supernatural or otherwise.
-: ; <span id="tip5"></span>Install a secure font
+; <span id="tip5"></span>Install a secure font
 : A real tip might be "Install a secure browser" especially when many people used {{w|Internet Explorer 6}}. Secure fonts do exist and are designed to make checks difficult to alter, but using one on a computer would not help one's internet security. May also refer to Google Chrome [https://www.proofpoint.com/us/threat-insight/post/EITest-Nabbing-Chrome-Users-Chrome-Font-Social-Engineering-Scheme "Install missing font"] malware.
-: ; <span id="tip6"></span>Use a 2-factor smoke detector
+; <span id="tip6"></span>Use a 2-factor smoke detector
 : {{w|Multi-factor authentication|Two factor authentication}} describes the practice of using two different identification factors (such as a password and a code from a secure token) to authenticate the user. A two factor smoke detector presumably uses two or more factors to identify ''smoke'' (such as {{w|Smoke_detector#Ionization|ionization}} and {{w|Smoke_detector#Photoelectric|photoelectric}}). Such devices [https://alarmspecs.com actually exist], but, while improving the user's general safety, they do nothing to improve their internet security.
@@ Line 43: / Line 43: @@
 A month before this comic the newest [[:Category:xkcd Phones|xkcd Phone]], [[1809: xkcd Phone 5]], was released with a 28-factor authentication.
-: ; <span id="tip7"></span>Change your maiden name regularly
+; <span id="tip7"></span>Change your maiden name regularly
 : A {{w|maiden name}} is the family name that a woman has at birth. (The gender-neutral term is "birth name" or "birth surname"; it is unclear whether this "advice" is meant to apply only to women.) Security experts frequently criticize the concept of security questions like "what is your mother's maiden name?", on the basis that they can often be deduced from publicly available information. In the sense that it refers to a historical fact, a maiden name cannot be changed retroactively, although in the sense that it refers to the last name on one's birth certificate, in some narrow cases this ''can'' be amended. For instance, when someone is {{w|adoption|adopted}} and takes their adoptive parent's last name, in many jurisdictions a {{w|legal fiction}} holds that they have had that last name since birth, and governments will issue new birth certificates to that effect. However, it is unlikely for anyone to be able to amend the surname on their birth certificate more than once, and impossible to do so "regularly".
 : A real tip for dealing with security questions is to enter false data.
-: ; <span id="tip8"></span>Put strange USB drives in a bag of rice overnight
+; <span id="tip8"></span>Put strange USB drives in a bag of rice overnight
 : The usual security tip is "Don't plug strange {{w|USB flash drive|USB drives}} into your computer," because sometimes attackers leave USB devices with malicious programs lying around, hoping that people will plug them into target computers out of curiosity. This tip states that you should "put USB drives in a bag of rice overnight" which is a common technique for drying out water-damaged devices, due to rice's absorbent qualities. This would not clean the drive of viruses, and unless the drive was wet (perhaps because you found it outside due to it being called "strange") it would not do anything. In [[1598: Salvage]], another attempt is made to salvage something unconventional with rice, and here it is shown that Randall considers the rice drying of a wet mobile is a myth, so this is yet another jab at the idea.
-: ; <span id="tip9"></span>Use special characters like & and %
+; <span id="tip9"></span>Use special characters like & and %
 : You can use special characters to increase the entropy/strength of your password, though as described in [[936: Password Strength]], that often leads to passwords that are hard to remember but not particularly strong.  The password context is missing here, and in everyday situations the characters & and % are not special. These two characters are often disallowed in passwords because of their relevance to {{w|SQL}} (a common database query language). If these characters were used in a password, a badly written security system using SQL could have severe bugs (and security vulnerabilities) similar to the security flaw in [[327: Exploits of a Mom]].
-: ; <span id="tip10"></span>Only read content published through Tor.com
+; <span id="tip10"></span>Only read content published through Tor.com
 : {{w|tor (anonymity network)|Tor}} is a software solution to provide anonymity on the web for its users. The website [https://tor.com Tor.com] is the website of fantasy and sci-fi book publisher {{w|Tor Books}}, which has no relation to the Tor-network. In January 2024, the website was renamed to [https://reactormag.com/ Reactormag.com].
-: ; <span id="tip11"></span>Use a burner's phone
+; <span id="tip11"></span>Use a burner's phone
 : A play on using a {{w|Prepay mobile phone|burner phone}} (a cheap/disposable cell phone like those purchased at 7-11, often used for drug deals or other activity one might not want traced), and using the cell phone of a burner, i.e. a person who habitually uses marijuana (or, less likely, a person who goes to the {{w|Burning Man|Burning Man festival}}).
-: ; <span id="tip12"></span>Get an SSL certificate and store it in a safe place
+; <span id="tip12"></span>Get an SSL certificate and store it in a safe place
 : {{w|Transport Layer Security|SSL/TLS}} is a protocol for securing connections on the internet. To check if someone is who they claim to be, you can check the individual's {{w|Public key certificate|certificate}}. Such a certificate has to be public; storing it in a safe place makes the certificate useless. You have to store the private key that matches the certificate in a safe place, else someone could steal the identity.
-: ; <span id="tip13"></span>If a border guard asks to examine your laptop, you have a legal right to challenge them to a chess game for your soul.
+; <span id="tip13"></span>If a border guard asks to examine your laptop, you have a legal right to challenge them to a chess game for your soul.
 : This tip is a reference to the common trope {{tvtropes|ChessWithDeath|Chess with Death}}, in which a mortal challenges a god to a game or challenge, often for their life. This version of the trope traces back to {{w|Ingmar Bergman|Ingmar Bergman's}} film {{w|The Seventh Seal}}, in which the protagonist {{w|The Seventh Seal#Synopsis|challenges Death}} to a game of chess. But instead of avoiding death, this tip suggests you have the right to do the same to get out of handing your devices over to a border guard. (This trope is also featured in [http://www.explainxkcd.com/wiki/index.php/393 393: Ultimate Game]).
 : Extrapolating from context clues, the real advice may have been that one has a legal right under the Fourth Amendment to be secure from unreasonable search and seizures. This, however, falls under the [https://security.ucop.edu/resources/traveling-with-electronic-devices/border-search.html#q1 border search exception], rendering it pointless.
-; <span id="tip14"></span>'''Title Text''': Never give your password or bank account number to anyone who doesn't have a blue check mark next to their name.
+; <span id="tip14"></span> Never give your password or bank account number to anyone who doesn't have a blue check mark next to their name.  (title text)
 : The usual security tip here is ''"only trust Twitter accounts claiming to be legitimate if they have a blue check mark next to their name"'', which means that the account is verified as legitimate. This tip suggests only giving your ''password'' to verified accounts, although you shouldn't give your password to ''any'' account. Twitter Verification would be revisited in [[1914: Twitter Verification]].

@@ Line 115: / Line 115: @@
 [[Category:Comics featuring Ponytail]]
 [[Category:Chess]]
-[[Category:Computers]]
+[[Category:Computer security]]
 [[Category:Tips]]

@@ Line 70: / Line 70: @@
 |If a border guard asks to examine your laptop, you have a legal right to challenge them to a chess game for your soul.
 |This tip is a reference to the common trope {{tvtropes|ChessWithDeath|Chess with Death}}, in which a mortal challenges a god to a game or challenge, often for their life. This version of the trope traces back to {{w|Ingmar Bergman|Ingmar Bergman's}} film {{w|The Seventh Seal}}, in which the protagonist {{w|The Seventh Seal#Synopsis|challenges Death}} to a game of chess. But instead of avoiding death, this tip suggests you have the right to do the same to get out of handing your devices over to a border guard. (This trope is also featured in [http://www.explainxkcd.com/wiki/index.php/393 393: Ultimate Game]).
 |- id="tip14"