Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

11–20 of 228 posts

Re: Security through obscurity is not bad

#11

Post by fortran77 »

Wordpress is a great example. He cites

> There is a long-standing security recommendation to change WordPress's default database table prefix to a random one. For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity.

I found that just changing the default URL for the wordpress login from the usual wp-admin to anything reduces by several orders of magnitude the number of scripts that try your site for the most common vulnerabilities---something that happens constantly for any site on the web, once a minute or so.

Re: Security through obscurity is not bad

#12

Post by Latty »

INTPenis wrote: post #7

I've been saying for years, it's one layer of security. That's undeniable.

I'll push back on this: obscurity isn't a "free" layer of security, it has both security benefits and security costs.

By having obscurity you lose anther layer of security: public scrutiny. It's harder for security issues to remain if people can see them and point them out, more eyes mean more chances to catch problems.

There is also a cultural component: having to lay out what you are doing publicly means you can't just think "no one will know", and let something slide, which pushes you towards better security practices.

Of course, this doesn't mean obscurity is always going to be the worse choice, there are times it will offer more than it costs and it's particularly evident that in, for example, open source projects, a lot of the time the number of eyes on most code is low enough that "many eyes" is a bit misleading, but I think presenting it as a pure positive is wrong, obscurity has cost, even if you think it's worth it in some cases.

Re: Security through obscurity is not bad

#13

Post by thephyber »

> Security ONLY through obscurity is bad (Kerckhoffs's Principle).

This is the crux of the article.

(1) Kerckhoffs's Principle doesn’t say that. It says to design the system AS IF the adversary has all of the info about it except the secrets (encryption key, certificates, etc).

(2) this rule is okay if you are a solo maintainer of a WordPress installation. It’s a problem if you work at a large company and part of the company knows the full intent of this, while the rest of the company doesn’t know the other layers of security BECAUSE of the obscurity layer. In this way, it’s important to communicate that this is only a layer and shouldn’t replace any other security decisions.

Re: Security through obscurity is not bad

#14

Post by caminante »

Regarding Counterstrike (game) example, there were already a lot of cheaters and a cheater ecosystem that still exists to this day. I suspect Valve could address it if it wanted to, but the gameplay/development cost trade-offs aren't enough.

Valve pivoted to server-side anti-cheat and toleration because someone probably did the math on max(profit) with lootboxes.

Re: Security through obscurity is not bad

#15

Post by pants2 »

fortran77 wrote: post #11

Wordpress is a great example. He cites > There is a long-standing security recommendation to change WordPress's default database table prefix to a random one. For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. I found that just changing the default URL for the wordpress login from the usual wp-admin to anything reduces by several orders of m…

Nice. If you do the opposite of what WordPress does for security you're probably on the right track.

Re: Security through obscurity is not bad

#16

Post by perching_aix »

Cryptography is "just" a mathematically sophisticated version of manufacturing obscurity, so that's missing the point a bit. Obscurity is just information asymmetry, which is the only way we have to "secure" / anchor anything. That quote is about all the other forms of manufactured obscurity not being anywhere near as rigorous, which should be obvious.

Re: Security through obscurity is not bad

#17

Post by i_think_so »

fortran77 wrote: post #11

Wordpress is a great example. He cites > There is a long-standing security recommendation to change WordPress's default database table prefix to a random one. For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. I found that just changing the default URL for the wordpress login from the usual wp-admin to anything reduces by several orders of m…

Same thing as changing your ssh port to something random. It's a trade-off with the convenience of knowing that all of your servers are listening on port 22 and you won't need any customizations in scripts or whatnot. But there are ways to mitigate much of that.

On the benefit side, mitigating most of the computational load, log analysis load, how much are the baddies poking me while I sleep load, etc...all of these together make changing such defaults a slam dunk IMO.

Re: Security through obscurity is not bad

#18

Post by AshamedCaptain »

The problem with this argument is that you can justify an infinite amount of crap with it, the security equivalent of cockroach papers; which inevitably people ends up treating as real security.

One example I remember is Pidgin storing its passwords in plain text in $HOME. They could have encrypted them with some hardcoded string, and made a lot of people happy that they would no longer grep their $HOME and find their passwords right there. However this had the side effect that now people were dropping the ball and sharing their config files with others. Or forgetting to setup proper permissions for their $HOME, etc.

In addition, these layers of obscurity are also not overhead free: they may complicate debugging, hey may introduce dangerous dependencies, they may tie you to a vendor, they may reduce computing freedom (e.g. Secure Boot), etc.

Re: Security through obscurity is not bad

#19

Post by bee_rider »

Bender wrote: post #2

Security through obscurity is NOT bad. Security ONLY through obscurity is bad (Kerckhoffs's Principle). Security through obscurity, as an additional layer, is good! I've been saying this ever since that phrase was coined. A layer or two of obscurity keeps a lot of noise out of logs, reduces alert fatigue and cuts down on storage costs especially if one is using Splunk as their SIEM and makes targeted attacks much eas…

It would be nice if there was no overlap between terms for the operational things that help improve security (log reduction and other non-cryptographic methods of reducing admin fatigue), and the mathematical cryptographic characteristics of the system.

If the focus is on the latter, obscurity buys you nothing and adds complexity/distraction, which is bad. The former can be important though.

Post reply on HN