Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

191–200 of 228 posts

Re: Security through obscurity is not bad

#191

Post by Byamarro »

rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Security through obscurity is mitigation basically. You reduce risk/impact, not eliminate it. There are problems - such as denial of wallet attacks - where you can only mitigate and can't eliminate the problem completely

Re: Security through obscurity is not bad

#192

Post by TZubiri »

The source of this bias is voyeurism.

It's always someone outside your org telling you that obscurity is bad, and that you should definitely publish all your source code to let them see.

It's self serving outside judgment to get you to provide them value.

On the other side of the coin, there is a bias towards this trope that comes from exhibitionism: those of us who hold that security through obscurity is valuable, will usually not publish our thoughts on other security mechanisms, since we will consider that doing so decreases our security, whereas those that believe in the trope, will publish all of their thoughts on security, as they do not depend on or value the secrecy of their strategies.

Re: Security through obscurity is not bad

#193

Post by TZubiri »

>For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity.

>My website was vulnerable. However, I was not impacted by any attacks, and I updated the plugin to a patched version a few days later. While other sites were "nulled" and destroyed, I was spared. I later found a PoC script on GitHub showcasing the exploitation. Using that PoC on my own site failed with a generic error like Table 'wordpress.wp_users' doesn't exist.

The biological sciences fully support this form of protection. One of the main benefits of the whole of sexual reproduction is based on this principle. Mutations introduce diversity to populations which allows otherwise extinction events to just affect a fraction of the population.

So yeah, maybe the university of Open Source internet considers your approach to security to be baseless, but (in addition to your empirical experience), security through obscurity is well recognized in zoology.

Re: Security through obscurity is not bad

#194

Post by TZubiri »

rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

>Obscurity can be fine but it's not security

You literally just read how Obscurity protected OP in a cybersecurity incident. Now you are just playing word games, which are a waste of time.

Re: Security through obscurity is not bad

#195

Post by WhyNotHugo »

canpan wrote: post #184
raffraffraff wrote: post #173

Earlier quoted context omitted.

Example: there are teenage gangs going around on high powered scooters in my city, carrying hammers and mini grinders. They pair up on a scooter, steal a bike and disappear. I watched them. They don't want to hang around longer than necessary. They will only approach a bike rack that is clearly visible from the road. They will only steal a bike that has unobstructed access to the road (no tricky bollards or other bik…

It's not great, but basically if your lock is better than the lock on the bicycle next to yours, they will most likely not steal yours..

Your bike should always looks like a less interesting target [for theft] than the other bikes in the same rack.

Re: Security through obscurity is not bad

#196

Post by TZubiri »

walrus01 wrote: post #108
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Because I love how seriously the DoD takes newly invented terms, we have: "The Integrated Survivability Onion" https://cogecog.com/the-threat-onion/ 1. Don't be seen. 2. Don't be acquired 3. Don't be hit 4. Don't be penetrated 5. Don't be killed It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.

The acquired concept is new to me, is this an established term?

Re: Security through obscurity is not bad

#197

Post by TZubiri »

rileymat2 wrote: post #74
MattPalmer1086 wrote: post #68

Earlier quoted context omitted.

Kerkhoff's principle is not about security in general, it is about the design of cryptography. Assume your opponent knows everything about how your crypto system works. Your security then lies in the keys and not knowledge of the method. More broadly, anything that raises the cost of an attack helps security. Whether it is worth investing your defensive effort in that vs on more actual security is a different matter.

If it does not obscure your own view of the security or reasoning about the security stance. For instance, with respect to url parameters, I have seen people being told they have an Insecure Direct Object Reference, then apply base64 encoding to it to obscure what is going on. To QA they don't notice it looks like junk, it is obscure, but base64 encoded parameters are catnip to hackers. So in this case, the obscurity…

I love this nuance!

But I think it's covered by your immediate parent comment

> Whether it is worth investing your defensive effort in that vs on more actual security is a different matter.

So the base64 introduces a marginal security gain, but in addition to expending effort in implementation, it increases the cost of other efforts (which is the case for almost all features), in the case of a fixed cost QA (which is again, always the case), the quality of the QA (pardon the redundancy) will be the parameter that suffers.

So yes, if the security gain is very minimal, then it's likely that the cost of the feature will be so great comparatively, that it will not only affect all other parameters like ease of use, but the negative indirect impact on security will be greater than the marginal positive direct impact on security.

Many such cases.

Re: Security through obscurity is not bad

#198

Post by tgv »

TZubiri wrote: post #194
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

>Obscurity can be fine but it's not security You literally just read how Obscurity protected OP in a cybersecurity incident. Now you are just playing word games, which are a waste of time.

It does seem to be a word game, because "it's not stopping any bullets" either isn't honest (it does stop bullets from hitting you when the enemy doesn't know where to shoot) or it's limited, just like obscurity is ("it may stop a few bullets, but it won't stop all, and there will be other weapons it can't stop either"). I think public key exchange is considered security, but it still requires to obscure your private keys.

Perhaps a better word would be resistance (to intrusion), which is a dimension orthogonal to visibility.

Re: Security through obscurity is not bad

#199

Post by pona-a »

mobeigi wrote: post #22
caminante wrote: post #14

Regarding Counterstrike (game) example, there were already a lot of cheaters and a cheater ecosystem that still exists to this day. I suspect Valve could address it if it wanted to, but the gameplay/development cost trade-offs aren't enough. Valve pivoted to server-side anti-cheat and toleration because someone probably did the math on max(profit) with lootboxes.

Valve's VACnet solution is definitely interesting. It uses AI, deep learning and is server side. It's hard to tell how effective that has been for them compared to traditional client side detection systems; I don't imagine they'll share any results. The fact that it's completely hidden from cheat developers gives them a huge advantage though. In the past, any client side algorithm or detection method could be reverse…

Which is a the power of not relying on obscurity. The server not sending you its complete source code is not any more obscure than a secret key.

Security through obscurity is about obfuscating easy-to-recover trivia thinking it buys you any margin, like the client-side anti-cheat handing attackers everything they need to defeat it while trying to then obfuscate that code.

Re: Security through obscurity is not bad

#200

Post by withinboredom »

kombookcha wrote: post #186
canpan wrote: post #184

Earlier quoted context omitted.

It's not great, but basically if your lock is better than the lock on the bicycle next to yours, they will most likely not steal yours..

You only need to be faster than the slowest gazelle in the pack, right?

Gazelle bikes are pretty fast ... instructions unclear.
Post reply on HN