AnnaleeMay 8, 2023

I've been thinking lately about how we teach folks about digital security and safety and how we don't really have a way to retire old advice

I know folks who heard they should never connect to a public or unfamiliar Wi-Fi network, never scan a QR code, never charge their phone at a public outlet - and they never got the stand down memo that those threats have been largely mitigated and as long as they're keeping their phones and browsers up to date, it's usually fine to do those things.

Show threadAnnaleeMay 8, 2023

And to some extent it's easier to say "just don't" than it is to teach nuanced risk analysis, because sure, connecting to other computers is never 100% safe no matter what.

But I worry that when reasonable precautions calcify into superstitions, we're contributing to the narrative that computers are inherently unknowable and dangerous, which leads to people giving up on even trying.

Show threadJeff XilonMay 8, 2023
@Annalee your first paragraph there just blew my mind as I realized it's basically the sex-ed abstinence only model with pretty much the same outcome: folks generally uneducated about the topic at all.
Show threadJeff XilonMay 8, 2023
@Annalee And I say this as someone who absolutely didn't know that "never charge your phone at a public outlet" was already possibly outdated advice.
Show threadAnnalee
@JXilon yeah, with the caveat that if you are the kind of high risk target that a state actor might burn a 0day on you should maintain a stronger security stance, it's pretty much fine - modern phones will prompt you if you connect to a USB device that wants data and they default to power only unless you grant access
May 8, 2023 at 7:39pmWeb
Show threadLongwingMay 10, 2023

@Annalee @JXilon Good point and part of the issue with most security discussions (or computer discussions in general). We figure out the single optimal practice for a given goal (don't get infected/suborned), without considering other goals (educate people), and then we beat the point into the ground.

This creates the situation you describe, where people have heard "the best solution is to never..." and therefor don't research reasonable compromises instead.

Show threadAnnaleeMay 10, 2023
@Longwing @JXilon true but I'm not even talking about compromise, so much as cases where the threat has been addressed and the advice is obsolete. For the average user, advice not to charge on public chargers or use public WiFi is years out of date.
Show threadAnnaleeMay 10, 2023

@Longwing @JXilon that advice didn't become widespread because it held for high risk targets, but because there were widely known and widely used attacks that average people had to worry about. And that's just not true anymore. Those threats have been remediated.

The rules are different for high value targets because what exploits remain are too valuable to be worth using against random people.