Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That it gets pushed an astonishingly high number of times on technical forums kind of illustrates though how little critical thinking even people who should know better do sometimes I guess. And I suppose how fractally wrong it is can be a good starter for discussion.
Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like?
XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.
Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like?
XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.