Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

181–190 of 228 posts

Re: Security through obscurity is not bad

#181

Post by viccis »

high_na_euv wrote: post #176

Wtf, why ppl struggle so hard with simple concept Obscurity increases the bar, and now, some actors will be prevented just by it, some delayed and some not affected at all, but after all you dont know who is attacking you and their skills!

It's just a good component of a defense in depth approach. Where it's bad is when it's the only defense. Putting a sensitive server behind port knocking will cut down on 99.99999% of random internet IPs spraying attacks at it, so it's worth doing. Just don't rely on it for the only auth check.

Re: Security through obscurity is not bad

#182

Post by WesolyKubeczek »

Security through obscurity is only bad when it’s the only measure used. If proper security is also in place, it is the cherry on top.

For example, while I know that ssh bruteforcing bots won’t enter my server no matter how much they try, putting ssh on a non-standard port reduces the number of tries to zero.

Re: Security through obscurity is not bad

#183

Post by srdjanr »

OhMeadhbh wrote: post #168

Saying anything about security without mentioning the nature of the threat is bad. It's also industry common practice. Obfuscating JS is probably a decent defence against your 9 year old brother. It is not against a motivated, well funded state sponsored attacker. Part of what bugs me about English is the practical ambiguity of the colloquial understanding of what " is " implies. Does it mean that all foos are also b…

The author gave a few examples where compiled/minified code is public (Javascript and games) or automated vuln exploits (Wordpress example). That does explain nature of threat well enough for me.

There's a whole spectrum between 9 year old and a motivated state actor, and obfuscation is effective for a big part of the spectrum.

Re: Security through obscurity is not bad

#184

Post by canpan »

raffraffraff wrote: post #173
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Example: there are teenage gangs going around on high powered scooters in my city, carrying hammers and mini grinders. They pair up on a scooter, steal a bike and disappear. I watched them. They don't want to hang around longer than necessary. They will only approach a bike rack that is clearly visible from the road. They will only steal a bike that has unobstructed access to the road (no tricky bollards or other bik…

It's not great, but basically if your lock is better than the lock on the bicycle next to yours, they will most likely not steal yours..

Re: Security through obscurity is not bad

#186

Post by kombookcha »

canpan wrote: post #184
raffraffraff wrote: post #173

Earlier quoted context omitted.

Example: there are teenage gangs going around on high powered scooters in my city, carrying hammers and mini grinders. They pair up on a scooter, steal a bike and disappear. I watched them. They don't want to hang around longer than necessary. They will only approach a bike rack that is clearly visible from the road. They will only steal a bike that has unobstructed access to the road (no tricky bollards or other bik…

It's not great, but basically if your lock is better than the lock on the bicycle next to yours, they will most likely not steal yours..

You only need to be faster than the slowest gazelle in the pack, right?

Re: Security through obscurity is not bad

#188

Post by imtringued »

bigstrat2003 wrote: post #105
minitech wrote: post #57

Earlier quoted context omitted.

ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079

ASLR is, by definition, security by obscurity. The entire purpose of it is to make it so that it's hard to find the memory which is in use.

The point of ASLR is that even if you fully understand how it works, this won't make it easier to bypass the protections of ASLR, since the primary way ASLR works is through dynamic adaptation. This turns it into a probabilistic security technique where there is always a chance that an attack goes through.

Security through obscurity in this case would be to roll your own ASLR implementation with a different randomization strategy.

Re: Security through obscurity is not bad

#189

Post by i_think_so »

vlovich123 wrote: post #161
i_think_so wrote: post #87

Earlier quoted context omitted.

Good luck scanning 64k ports on a server that has a few randomly assigned fail2ban listeners.

If you think it’s not trivial to get 64k random IP addresses to make requests for you for pennies, you are completely delusional if you think fail2ban protects a random port number in any way.

It's not "trivial", and it costs dollars, not pennies for that many attack endpoints[1]. My firewalls scale much more cost effectively, especially when I coalesce individuals into netblocks.

I don't think fail2ban protects obfuscated ports, I know it. If an IP is trying to connect to a system on port 22, it is ipso facto unwanted and doing unauthorized activities. Plonk! Onto the ban list it goes. You'd be surprised how effective that is.

Once the roar of automated skiddies is silenced, the signal of real attacks cuts through the noise quite clearly.

Remember, to avoid being eaten by most bears, you don't have to outrun them -- you only have to outrun the poor sap next to you. ;-) There is real world value in raising the bar and becoming even a moderately harder target than the rest of the crowd.

Maybe I should spin up a vanilla VM and just let it get hammered for a month and post the logs here....

[1] It's been a while since I looked at prices for tens of thousands of distinct proxy connections. Anyone want to pretend to be a hax0r and get a current price quote?

Re: Security through obscurity is not bad

#190

Post by pamcake »

rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Obscurity isn't security but it can support security. Until it doesn't.
Post reply on HN