Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

121–130 of 228 posts

Re: Security through obscurity is not bad

#121

Post by willis936 »

staticassertion wrote: post #94
willis936 wrote: post #81

Earlier quoted context omitted.

I think you're misinterpreting "obscurity" for "lack of obscurity". If you have a vulnerability in an API interface that is completely undocumented that is a vulnerability that is obscured. It's hiding in the woods, not standing in a field. To keep with the analogy: no one is going to stand in a field when people are shooting at you. So then why do a small subset of vocal people online suggest that you just put your…

This isn't about what's a good idea or bad idea. Perhaps it's best to simply leave analogies behind, otherwise we'll just focus on the wrong thing. Security through obscurity merely means that your system is atypical. It's not hidden, it's not secret, it's not hard to find, it's not hard to examine, it's not less visible, etc - there is nothing inherently different about the systems at all other than that one is more…

What you're describing is a thing that is not obscured. Don't refer to things as obscured if they are not obscured. When others talk about about things that are obscured they are talking about things that are obscured, not things that are not obscured.

Re: Security through obscurity is not bad

#122

Post by costco »

reCAPTCHA is a great success story of security through obscurity because probably less than 100 people have reverse engineered it and much less than that have produced a working solver for it that doesn't require a headless browser. Snapchat would be another good example - almost no one is going to put in the work to understand this [0]. Most companies just half ass it though and accordingly achieve nothing with the obscurity at all besides worse performance.

[0] https://web.archive.org/web/20201128060507/https://hot3eed.g...

Re: Security through obscurity is not bad

#123

Post by ChrisMarshallNY »

I don't think "obscurity" really buys you much (especially these days, with LLMs).

However "Not Having Stuff to Steal" works like a charm. It's thousands of years old, and has never gone out of style.

I know that it's considered blasphemy, hereabouts, but I've found that not collecting information that I don't absolutely need is pretty effective.

Even if someone knocks down all my gates and fences, they'll find the fox wasn't worth the chase.

It does make stuff like compiling metrics more of a pain, but that's my problem; not my users'.

Re: Security through obscurity is not bad

#124

Post by gerdesj »

singpolyma3 wrote: post #114
staticassertion wrote: post #71

Earlier quoted context omitted.

I don't think that really works because obscurity isn't harder to see or find. I don't know the analogy, it's like standing out in the open and being like "yeah but who would think to look here lol".

The first rule of not being seen: to not stand up.

Not stand out.

Re: Security through obscurity is not bad

#125

Post by Lammy »

rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

> Obscurity can be fine but it's not security.

All security is security through obscurity. When it gets obscure enough we call it “public key cryptography”. Guess the 2048-bit prime number I'm thinking of and win a fabulous prize! (access to all of my data)

Re: Security through obscurity is not bad

#126

Post by strken »

pdpi wrote: post #111
lucketone wrote: post #98

Earlier quoted context omitted.

All modes of cyber security depend on some obscurity (e.g. password) Ideally we want a viable plan B, for when it’s leaked/figured out. (E.g. generate new passwords) (For convenience let’s label air-gap as kind of physical security)

> All modes of cyber security depend on some obscurity (e.g. password) That's not what the expression means. "Security through obscurity" has a very specific meaning — that your system's security depends on your adversary not understanding how it works. E.g. understanding RSA is a few wikipedia articles away, and that doesn't compromise its security, so RSA isn't security through obscurity.

Lucketone likely knows this and was pointing out that "obscurity" is a misleading word to use when talking about systems which all rely on obscurity, in the plain English sense of the word.

Re: Security through obscurity is not bad

#127

Post by danparsonson »

ChrisMarshallNY wrote: post #123

I don't think "obscurity" really buys you much (especially these days, with LLMs). However "Not Having Stuff to Steal" works like a charm. It's thousands of years old, and has never gone out of style. I know that it's considered blasphemy, hereabouts, but I've found that not collecting information that I don't absolutely need is pretty effective. Even if someone knocks down all my gates and fences, they'll find the f…

That's fine if the goal of breaking in is immediate theft; it might also be more along the lines of leaving something behind.

Re: Security through obscurity is not bad

#128

Post by ChrisMarshallNY »

danparsonson wrote: post #127
ChrisMarshallNY wrote: post #123

I don't think "obscurity" really buys you much (especially these days, with LLMs). However "Not Having Stuff to Steal" works like a charm. It's thousands of years old, and has never gone out of style. I know that it's considered blasphemy, hereabouts, but I've found that not collecting information that I don't absolutely need is pretty effective. Even if someone knocks down all my gates and fences, they'll find the f…

That's fine if the goal of breaking in is immediate theft; it might also be more along the lines of leaving something behind.

Not sure if obscurity buys you anything, then. In that case, it's all about standard security practices.

Re: Security through obscurity is not bad

#129

Post by mazone »

In a corporate setting my experience is that it is rarely worth it to add any obscurity on top of security. Your biggest challenge is getting peoples time and resources, and you need to use that time to implement security controls. A secondary objective you have is to build security culture over time and teach people too see patterns where more security is needed, so it is important to select what to teach to get maximum impact.

Re: Security through obscurity is not bad

#130

Post by dreambuffer »

staticassertion wrote: post #94
willis936 wrote: post #81

Earlier quoted context omitted.

I think you're misinterpreting "obscurity" for "lack of obscurity". If you have a vulnerability in an API interface that is completely undocumented that is a vulnerability that is obscured. It's hiding in the woods, not standing in a field. To keep with the analogy: no one is going to stand in a field when people are shooting at you. So then why do a small subset of vocal people online suggest that you just put your…

This isn't about what's a good idea or bad idea. Perhaps it's best to simply leave analogies behind, otherwise we'll just focus on the wrong thing. Security through obscurity merely means that your system is atypical. It's not hidden, it's not secret, it's not hard to find, it's not hard to examine, it's not less visible, etc - there is nothing inherently different about the systems at all other than that one is more…

I'm having a hard time understanding what you mean here. If something is obscured, by definition it is less visible. Being 'less typical' is a form of security because most attacks rely on some form of pattern recognition, and obscurity literally dissolves patterns into noise.
Post reply on HN