Most security advice is BS. We try to help...but wind up w/conflicting recommendations based on hunches that leave users feeling confused & guilty. THREAD https://twitter.com/eredmil1/status/1304135705321299969

2. Great realtalk from @CormacHerley& @eredmil1. Much of what users are told is not backed by evidence, or statistics.

3. Case in point: On the *daily* we encounter people obsessively focused on strong passwords because they were told to. These are then used for everything because...strong

4. Its like trying to create a healthy, balanced diet based on garbage health reporting (coffee causes! no kills! cancer)...

5. "come bearing data." Sure! Unfortunately good data lives at platforms, which don't share. Platforms must do better at disclosing & communicating about threats, and actually encouraging behaviors that work.

6. What platforms do communicate is sometimes so lawyered that we have to do kremlinology just to figure out what actually happened. Even for threats to elections. Good luck deriving advice from that. I'm looking at you: everyone.