A lot of our security advice is crap. Here's the start of a better model