Editing 1820: Security Advice

|This is a standard recommendation for documents that must be kept secure because they are irreplaceable and/or contain sensitive information. However this list itself is easily replaceable and the contents will be well-known, so storing it in a safe place is totally unnecessary.  Putting it in a {{w|safe deposit box}} would even be counterproductive since the list can only serve its purpose as a ready reminder if it's easily accessible to everyone. So when people fail to follow this tip, they may end up keeping it in a place where they have easy access to the tips so they may also fail to follow all the others.

|The usual tip is "Don't click on ''suspicious'' website links" or "Don't click any links in suspicious emails". The comic's variation instead tells users not to click on any links to any websites, which essentially stops them from using the World Wide Web altogether. So this tip is not really helping, as the opposite of this would be to click on all links. [https://www.sketchywebsite.net This is an example website that showcases an extreme example of what ''could'' (probably wouldn't (this is not advice)) happen if you clicked on a suspicious link.]

|At some border crossings, government agents may search computers, cell phones, and other electronic devices.  The usual advice for such situations ranges from asserting your rights to resetting all devices and deleting all data prior to crossing a border.  Holding one's breath can potentially prevent inhaling germs or poisons in some situations, though useless in the context of computer security.  These two topics mixed in the same advice won't achieve anything, but if you hold your breath for too long you could pass out when crossing, or look stressed/suspicious and invite even more scrutiny. This could also be a reference to the superstition of holding one's breath when passing a graveyard, or similarly to the movie ''{{w|Spirited Away}}'', where the main character is instructed to hold her breath while crossing the bridge that acts as the border between the human and spirit world. In any case, holding one's breath while browsing the Internet would have no useful effect, supernatural or otherwise.

"Also, the logic behind using two-factor authentication is that '''both''' types of credentials must match to grant access. Smoke detectors work otherwise - usually firing if '''any''' of the sensors detect a fire. If the smoke detector worked according to the authentication logic it will be less likely to detect smoke, effectively lessening fire safety as compared to a single sensor one."

 

|A {{w|maiden name}} is the family name that a woman has at birth. (The gender-neutral term is "birth name" or "birth surname"; it is unclear whether this "advice" is meant to apply only to women.) Security experts frequently criticize the concept of security questions like "what is your mother's maiden name?", on the basis that they can often be deduced from publicly available information. In the sense that it refers to a historical fact, a maiden name cannot be changed retroactively, although in the sense that it refers to the last name on one's birth certificate, in some narrow cases this ''can'' be amended. For instance, when someone is {{w|adoption|adopted}} and takes their adoptive parent's last name, in many jurisdictions a {{w|legal fiction}} holds that they have had that last name since birth, and governments will issue new birth certificates to that effect. However, it is unlikely for anyone to be able to amend the surname on their birth certificate more than once, and impossible to do so "regularly".

|You can use special characters to increase the entropy/strength of your password, though as described in [[936: Password Strength]], that often leads to passwords that are hard to remember but not particularly strong.  The password context is missing here, and in everyday situations the characters & and % are not special. These two characters are often disallowed in passwords because of their relevance to {{w|SQL}} (a common database query language). If these characters were used in a password, a badly written security system using SQL could have severe bugs (and security vulnerabilities) similar to the security flaw in [[327: Exploits of a Mom]].

|A play on using a {{w|Prepay mobile phone|burner phone}} (a cheap/disposable cell phone like those purchased at 7-11, often used for drug deals or other activity one might not want traced), and using the cell phone of a burner, i.e. a person who habitually uses marijuana (or, less likely, a person who goes to the {{w|Burning Man|Burning Man festival}}).

|This tip is a reference to the common trope {{tvtropes|ChessWithDeath|Chess with Death}}, in which a mortal challenges a god to a game or challenge, often for their life. This version of the trope traces back to {{w|Ingmar Bergman|Ingmar Bergman's}} film {{w|The Seventh Seal}}, in which the protagonist {{w|The Seventh Seal#Synopsis|challenges Death}} to a game of chess. But instead of avoiding death, this tip suggests you have the right to do the same to get out of handing your devices over to a border guard. (This trope is also featured in [http://www.explainxkcd.com/wiki/index.php/393 393: Ultimate Game]).  

Under President [[Donald Trump]] (inaugurated two and a half months prior to this comic), border patrol and customs agents have become notorious for profiling non-Caucasian travelers and immigrants. Stories abound of agents coercing and threatening travelers to hand over their smartphones -- they do not have legal right to just take your devices under the Fourth Amendment, but have many not-entirely-idle threats they can level at you until you do as they wish.

|The usual security tip here is ''"only trust Twitter accounts claiming to be legitimate if they have a blue check mark next to their name"'', which means that the account is verified as legitimate. This tip suggests only giving your ''password'' to verified accounts, although you shouldn't give your password to ''any'' account. Twitter Verification would be revisited in [[1914: Twitter Verification]].

 

 

It also refers to problems especially visible in the US banking system, where there is very little security for direct account drafts, and because of that it is advised there to keep the account number as secret as possible. In contrast, in Europe giving your account number to someone is one of the most common ways to get paid.

A related tip might be "Never give your password or bank details to a website that doesn't have a padlock icon next to the URL". In most modern browsers, if you access a secure website, there will be a padlock icon in the browser indicating you've connected to a secure website using {{w|HTTPS|Hypertext Transfer Protocol Secure}}.  It doesn't provide that it is not malicious site, and that is secure to enter.  So this tip treats the verified account icon the same way you might treat a secure website icon.