Security through obscurity is the same thing as security through praying. A stopped clock is right twice a day.
Security through obscurity is not bad
101–110 of 228 posts
Re: Security through obscurity is not bad
#102The problem with security through obscurity (even if it’s just an “addon”) is that it pollutes your code base, system. It’s just not worth it.
Like moving ssh to a different port. If you are the only one working on it, sure fine, as long as you remember the port. If you re working with others, then everyone needs to know the new port, so it has to be documented somehow. It’s a pita
Re: Security through obscurity is not bad
#103When a firewall rule blocks a port, is that security or obscurity?
Re: Security through obscurity is not bad
#104Everybody trying to discuss this gets the framing wrong. Obscurity isn't "bad" or "good". It's not "not" security. Security in the real-world sense is about risk. It fixes an adversary and then applies costs to them. Obscurity changes costs (usually by raising them for the adversary).
Depending on the setting and the adversary, obscurity measures can raise costs by a material or immaterial amount.
Obscurity measures usually also impose costs on defenders (and, transitively, on the intended users of the system). Those costs are different than they are for adversaries (usually: substantially lower). They might or might not be material.
Your general goal is to asymmetrically raise costs on the adversary.
Seen that way, it's usually pretty easy to reason about whether obscurity is worth pursuing or not. Don't do it if it doesn't materially raise costs for attackers, or, even if it does, if it doesn't raise costs way less for defenders and users.
What trips people up in forums like this is that we're used to dealing with security problems framed in settings where we can impose \infty costs on attackers: foreclosing all known avenues of attack (to something like a mathematical certainty, and stipulating that computer science discoveries may change the cost function tomorrow). In those settings, all obscurity measures have relatively immaterial attacker costs associated. But it's still the same underlying problem! And, in the real world, we're actually rarely operating in model situations where we really can impose \infty costs on attackers.
Re: Security through obscurity is not bad
#105Earlier quoted context omitted.
> Obscurity is not security. So ASLR [1] is not a security control? I guess you are pretty alone with this opinion. [1] https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079
ASLR is, by definition, security by obscurity. The entire purpose of it is to make it so that it's hard to find the memory which is in use.
Re: Security through obscurity is not bad
#106Earlier quoted context omitted.
All modes of cyber security depend on some obscurity (e.g. password) Ideally we want a viable plan B, for when it’s leaked/figured out. (E.g. generate new passwords) (For convenience let’s label air-gap as kind of physical security)
i don't know a lot about the subject, but the little i know tells me this is not the way to look at this your password (plain text) is secret because only you are supposed to a have it. in the digital realm, sharing the contents of the password (plain-text) is be akin to making a copy of it — undesirable now, the algorithm that hashes the plain-text for comparison with the stored hash, that can be know by anyone, and…
Yes. Password and hashing algorithm are distinct things. I fully agree with you.
Re: Security through obscurity is not bad
#107I remember when port knocking was discussed here on HN many years ago it was shit upon because people said security through obscurity is bad. What really frustrated me, at the time and still (when people shit on it), is that it's not just obscurity, it's also security. Port scans see nothing, but just knowing the port doesn't give you anything. You still need a password or key.
Re: Security through obscurity is not bad
#108Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.
Because I love how seriously the DoD takes newly invented terms, we have:
"The Integrated Survivability Onion"
https://cogecog.com/the-threat-onion/
1. Don't be seen.
2. Don't be acquired
3. Don't be hit
4. Don't be penetrated
5. Don't be killed
It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.
Re: Security through obscurity is not bad
#109[deleted]
Re: Security through obscurity is not bad
#110 I am the Modern Man (Secret, secret, I've got a secret)
Who hides behind a mask (Secret, secret, I've got a secret)
So no one else can see (Secret, secret, I've got a secret)
My true identity