🤔 Learn & Play
Myth or Fact?
Eleven common tech beliefs. Make your guess first, then tap to reveal the answer.
“Macs and iPhones can’t get viruses.”
Myth They face fewer attacks than Windows PCs, but they are not immune. Malware exists for every platform, and phishing works on any device because it targets the person, not the machine. Keep every device updated.
“Private or incognito browsing makes you anonymous online.”
Myth It only stops your own browser from saving your history on that device. The websites you visit, your internet provider, and your employer or school network can still see your activity.
“A long password beats a short, complicated one.”
Fact Length matters most. A passphrase made of several unrelated words is usually much harder to crack than a short jumble of symbols, and it is easier to remember. The golden rule is a different password for every account, ideally kept in a password manager.
“If a website shows a padlock, it’s safe.”
Myth The padlock means your connection to the site is encrypted. It says nothing about whether the site is honest. Scam sites can have padlocks too, so check the address carefully before you enter anything.
“Hackers only go after big companies.”
Myth Many attacks are automated and look for any weakness, whatever the size of the business. Small businesses can be attractive targets because they often have fewer protections in place.
“You should change all your passwords every month.”
Mostly a myth Current guidance, including from the US standards body NIST, advises against forcing regular password changes without a reason. Change a password if it may have been exposed, and focus on unique passwords plus two-step verification.
“Software updates are mostly just annoying new features.”
Myth Many updates fix security holes that attackers already know about. Delaying them leaves the door open. Turning on automatic updates is one of the easiest ways to stay safer.
“Deleting a file and emptying the recycle bin removes it for good.”
Partly true On many devices the data can still be recovered until it is overwritten. Before you sell, recycle, or give away a computer or phone, use its proper reset or secure erase option, and ask us if you are unsure.
“Text-message codes are useless for two-factor authentication.”
Mostly a myth Codes sent by text are weaker than an authenticator app, a security key or a passkey, because a fake website can trick you into typing the code in. But Canada’s Cyber Centre says every two-factor option improves on a password alone. Use the strongest option your account offers, and do not skip two-factor just because the best one is not available.
Sources: Cyber Centre baseline controls; NIST SP 800-63B-4.
Sources: Cyber Centre baseline controls; NIST SP 800-63B-4.
“Putting all my passwords in a password manager is riskier than remembering them.”
Myth NIST says password managers have been shown to help people choose stronger passwords, and expects services to let you use them. The part to protect is the manager itself: give it a long, unique master password.
Sources: NIST SP 800-63B-4.
Sources: NIST SP 800-63B-4.
“One backup is enough.”
Myth CISA recommends 3 copies of your files, on 2 types of storage, with 1 copy kept off-site. A backup is only worth having if you have tried restoring from it, so test it on a regular schedule.
Sources: CISA, Back Up Business Data; Cyber Centre baseline controls.
Sources: CISA, Back Up Business Data; Cyber Centre baseline controls.
Heard something you are not sure about? Send it to us and it could become next month’s myth or fact.
General education only. Technology and guidance change over time.