Security by obscurity is underrated
utkusen.com
Security by obscurity is underrated
1–10 of 530 posts
Re: Security by obscurity is underrated
#2Article is down for me. Cache:
https://webcache.googleusercontent.com/search?q=cache:Bgl-ex...
Re: Security by obscurity is underrated
#3Like the article. Security also needs to be sensitive to usability trade-offs. Make things hard for adversaries, easy for intended users.
For some things, like VPNs, the adversaries are going to be more familiar with the details than the intended users. I often joke that an effective way to crack a VPN would be offer to configure it properly for a user in exchange for ten minutes of unfettered access to the target company; enough users are sufficiently frustrated they would take this bad deal fully knowing what it meant.
Re: Security by obscurity is underrated
#4Where I work I am not allowed to make risk decisions for the organization.
Re: Security by obscurity is underrated
#5Please do not use random variable names in source code. Uglify/minify instead. It’s a bit unclear because right above that “tip” is obfuscating code, did I miss something?
Re: Security by obscurity is underrated
#6The higher level of abstraction behind an article like this is that security is a mitigation activity within a broader risk management plan. Most of the time, the best practices in the security field are best practices for good reasons - they costs are a reasonable to mitigate the business risk of not having security, so we do them.
But there are times when you just need to discourage people, not truly secure a site. Not many, but they do exist. Pseudo-security in those cases is cheap and meets the business needs. Likewise, there are times when best practices aren't good enough, and you need to go beyond the norm.
Either extreme is driven by thinking through the acceptable risks, evaluating costs, and making a decision.
Re: Security by obscurity is underrated
#7I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?
Re: Security by obscurity is underrated
#8I had a Mac SE with an ethernet card in 2001, around when Red Worm was loose. We put an HTTPd server on it, and watched as each RedWorm attempt came in. This ancient super slow machine not only stayed completely safe despite being on Mac OS 7.5 or something around there, while Windows machines of current vintage were being taken apart around the world. Added bonus, the slow speed of the SE meant it took about 10 times longer for each Red Worm attempt to give up, so we at least monopolized some tiny portion of those infected systems for a bit, keeping them from infesting others for a few more seconds...
Re: Security by obscurity is underrated
#9I've used some very tight-arsed VPS providers at the low range (128MB/1IPV4/$12 a year) and some of them mention a high load, and it's mainly due to brute force on port 22.
It makes sense to change port purely to avoid the low-barrier noise but of course it isn't much better security. Port knocking is on the same lines.
I'm by no means a security expert but these measures would surely help: less opportunists = less opportunities.
Saying that, I'm public key auth only and disabling any public facing service I'm not using.
The "security through obscurity" thing seems like a warning to avoid shortcuts rather than some implementations that help reduce noise. As long as you understand the fundamental problem of security, the obscurity thing is just a sidebar.
Re: Security by obscurity is underrated
#10Like the article. Security also needs to be sensitive to usability trade-offs. Make things hard for adversaries, easy for intended users. For some things, like VPNs, the adversaries are going to be more familiar with the details than the intended users. I often joke that an effective way to crack a VPN would be offer to configure it properly for a user in exchange for ten minutes of unfettered access to the target co…
This is the whole "shadow IT" that actually results in a lot of security breaches. Look at the recent twitter hack for a great example. Staff were storing login credentials in a slack pinned message because using the right tools were a headache.