Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security through obscurity is not bad

mobeigi.com

Post reply on HN
Print view View original

201–210 of 228 posts

Re: Security through obscurity is not bad

#201

Post by Bender »

tokai wrote: post #30
Bender wrote: post #2

Security through obscurity is NOT bad. Security ONLY through obscurity is bad (Kerckhoffs's Principle). Security through obscurity, as an additional layer, is good! I've been saying this ever since that phrase was coined. A layer or two of obscurity keeps a lot of noise out of logs, reduces alert fatigue and cuts down on storage costs especially if one is using Splunk as their SIEM and makes targeted attacks much eas…

>I've been saying this ever since that phrase was coined You have been alive since the 1880s?

1492 was the first time I experienced the quickening.

Re: Security through obscurity is not bad

#202

Post by walrus01 »

TZubiri wrote: post #196
walrus01 wrote: post #108

Earlier quoted context omitted.

Because I love how seriously the DoD takes newly invented terms, we have: "The Integrated Survivability Onion" https://cogecog.com/the-threat-onion/ 1. Don't be seen. 2. Don't be acquired 3. Don't be hit 4. Don't be penetrated 5. Don't be killed It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.

The acquired concept is new to me, is this an established term?

in the sense of one military force contacting another, yes, as in acquiring a target.

Re: Security through obscurity is not bad

#203

Post by trashb »

walrus01 wrote: post #108
rascul wrote: post #67

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

Because I love how seriously the DoD takes newly invented terms, we have: "The Integrated Survivability Onion" https://cogecog.com/the-threat-onion/ 1. Don't be seen. 2. Don't be acquired 3. Don't be hit 4. Don't be penetrated 5. Don't be killed It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.

I feel like "Don't be captured" should be included, perhaps between 4 and 5. In cybersecurity this would be applicable to ransomware.

Re: Security through obscurity is not bad

#204

Post by trashb »

Security is the lock on the safe.

Obscurity is the information you need to find the safe.

All security can eventually be broken, given enough time, this is why A very useful measure for the security of a lock is how long it takes to break. The same is true for cryptography.

Obscurity can add a buffer before you can start breaking the lock and it can act as a deterrent for opportunistic attacks. Additionally it can help with signal to noise and monitoring of the lock.

This is why you have a lock on your front door and don't tell anyone you meet where exactly in your house you store your valuable jewels (preferably out of sight). You also want to monitor anyone in your garden more closely than on the road passing by.

Re: Security through obscurity is not bad

#205

Post by allknowingfrog »

trashb wrote: post #204

Security is the lock on the safe. Obscurity is the information you need to find the safe. All security can eventually be broken, given enough time, this is why A very useful measure for the security of a lock is how long it takes to break. The same is true for cryptography. Obscurity can add a buffer before you can start breaking the lock and it can act as a deterrent for opportunistic attacks. Additionally it can he…

Isn't it all just information? The lock code and the location of the safe are both just data. I think it's possible that all security is obscurity.

Re: Security through obscurity is not bad

#206

Post by OhMeadhbh »

srdjanr wrote: post #183
OhMeadhbh wrote: post #168

Saying anything about security without mentioning the nature of the threat is bad. It's also industry common practice. Obfuscating JS is probably a decent defence against your 9 year old brother. It is not against a motivated, well funded state sponsored attacker. Part of what bugs me about English is the practical ambiguity of the colloquial understanding of what " is " implies. Does it mean that all foos are also b…

The author gave a few examples where compiled/minified code is public (Javascript and games) or automated vuln exploits (Wordpress example). That does explain nature of threat well enough for me. There's a whole spectrum between 9 year old and a motivated state actor, and obfuscation is effective for a big part of the spectrum.

I was talking about the click-baity title more than the content.

Re: Security through obscurity is not bad

#208

Post by grayhatter »

> Security through obscurity, as an additional layer, is good!

If and only if the security advantage it gives outweighs the the numerous disadvantages.

It never* does. That's why the comment calling it bad got so many upvotes. Mixed in with those cargoculting the meme, are people like me who have had to deal with obfuscation techniques, written by someone else, that the bad guys understood before I did.

Obfuscation as a security measure is bad, because it feels like it's positives can compete with it's negatives; but that's rarely the case.

*: effectively never

Re: Security through obscurity is not bad

#209

Post by red-iron-pine »

Maxion wrote: post #164
neoCrimeLabs wrote: post #156

Earlier quoted context omitted.

Agreed with your sentiment, and that was a great example. Just like any security control, if it's your only means of security, it will not offer much risk reduction. Just like all security controls, the if you want risk reduction use more security controls together. Like all security controls, there is no way to eliminate risk, just reduce it as much as possible while still being able to effectively achieve your miss…

Obscurity by itself does provide risk reduction. Think about leaving your bike unlocked in times square, vs. the top of a 7 000 meter mountain in the himalayas. Which unlocked (unsecure) bike is more likely to be stolen, and ergo has a lower risk attached? ---- Obscurity does not help you when the thief has already found your bike, nor is obscurity very helpful for keeping your bike safe if you happen to live in time…

the security controls for a bike on a high mountain are not obscurity, they're the lack of oxygen (that kills), the cold (that kills), the height (that kills), and the literal sheer difficulty of getting there.

you could put the bike right on the side of the mountain without any obfuscation and it won't get got because ain't no one gonna die for a bike.

its like how we know where dead people are on Everest but we can't get them down; they serve as landmarks.

Re: Security through obscurity is not bad

#210

Post by grayhatter »

bigstrat2003 wrote: post #105
minitech wrote: post #57

Earlier quoted context omitted.

ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079

ASLR is, by definition, security by obscurity. The entire purpose of it is to make it so that it's hard to find the memory which is in use.

no because it's still possible to find the data using standard techniques, it doesn't count as obsecurity it's still possible.

I.e. just because you* don't know where something is, doesn't mean it's using obsecurity to hide.

The reason is important, because words mean things: If you say, knowledge of some secret is security though obsecurity. That means passwords are security though obsecurity.

*: that may or may not be available to the attacker.

it other words, just because a secret exists, doesn't put that secret into the 'obsecurity' category.

Post reply on HN