Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

161–170 of 228 posts

Re: Security through obscurity is not bad

#161

Post by vlovich123 »

i_think_so wrote: post #87
vlovich123 wrote: post #35

Earlier quoted context omitted.

If port numbers were 64bit or 128bit, actually it would provide a meaningful amount of security through obscurity. Port numbers are easy to dunk on because it’s such a trivially small search space.

Good luck scanning 64k ports on a server that has a few randomly assigned fail2ban listeners.

If you think it’s not trivial to get 64k random IP addresses to make requests for you for pennies, you are completely delusional if you think fail2ban protects a random port number in any way.

Re: Security through obscurity is not bad

#162

Post by fsckboy »

pdpi wrote: post #132
strken wrote: post #126

Earlier quoted context omitted.

Lucketone likely knows this and was pointing out that "obscurity" is a misleading word to use when talking about systems which all rely on obscurity, in the plain English sense of the word.

We're in a technical forum, discussing a term of art that refers to a very specific bad practice. Lucketone's argument is essentially saying that the bad practice itself isn't actually a bad practice by equivocating the term of art and the plain language definition.

"security through obscurity" is not a term of art; it is not solely that property which RSA does not rely upon.

Re: Security through obscurity is not bad

#164

Post by Maxion »

neoCrimeLabs wrote: post #156
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Agreed with your sentiment, and that was a great example. Just like any security control, if it's your only means of security, it will not offer much risk reduction. Just like all security controls, the if you want risk reduction use more security controls together. Like all security controls, there is no way to eliminate risk, just reduce it as much as possible while still being able to effectively achieve your miss…

Obscurity by itself does provide risk reduction.

Think about leaving your bike unlocked in times square, vs. the top of a 7 000 meter mountain in the himalayas.

Which unlocked (unsecure) bike is more likely to be stolen, and ergo has a lower risk attached?

----

Obscurity does not help you when the thief has already found your bike, nor is obscurity very helpful for keeping your bike safe if you happen to live in times square.

But if you live at the top of a himalayan peak, you can be fairly certain you're not going to have your bike stolen.

Re: Security through obscurity is not bad

#165

Post by Maxion »

walrus01 wrote: post #108
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Because I love how seriously the DoD takes newly invented terms, we have: "The Integrated Survivability Onion" https://cogecog.com/the-threat-onion/ 1. Don't be seen. 2. Don't be acquired 3. Don't be hit 4. Don't be penetrated 5. Don't be killed It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.

Works just as well anywhere, really.

Re: Security through obscurity is not bad

#167

Post by j45 »

rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

100%.

Obscurity alone isn't security. Security that includes obscurity in it's architecture is relevant.

Re: Security through obscurity is not bad

#168

Post by OhMeadhbh »

Saying anything about security without mentioning the nature of the threat is bad. It's also industry common practice.

Obfuscating JS is probably a decent defence against your 9 year old brother. It is not against a motivated, well funded state sponsored attacker.

Part of what bugs me about English is the practical ambiguity of the colloquial understanding of what " is " implies. Does it mean that all foos are also bars or does it mean there exists a foo where that foo is also bar? Does it mean foo is always bad or foo is often bar? Dutch is my first language and I grew up in South Viet Nam, Nigeria and Texas. I did not get the standard programming.

Re: Security through obscurity is not bad

#169

Post by OhMeadhbh »

And the second thing that bugs me about this interaction... Sure... "Security" is a process. It is a way of looking at things. It is proper use of tools and awareness of threat when designing software.

But it is also a set of trade-offs and relationships between architectural components. It worries me that this isn't displayed in the interaction described in the post

Post reply on HN