Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

41–50 of 530 posts

Re: Security by obscurity is underrated

#41

Post by tetha »

cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

Internally, we phrase it as "Make the system objectively hard, then don't tell all the details". Wasting an attackers time is a fine goal.

Re: Security by obscurity is underrated

#42

Post by daenz »

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventually they found the port. Now with port knocking, I haven't seen a single attempt.

Security by obscurity alone is bad, but as another layer, it can be great.

Re: Security by obscurity is underrated

#43

Post by tgb »

abhishekjha wrote: post #32

This came up in the stackoverflow podcast where Reddit founders were the guest. They mentioned that they stored plain text passwords initially which is fundamentally a bad design but at the same time it helps to block spam. If a user starts to create a lot of accounts programmatically they generally use the same password thus much easier to filter. Security via Obscurity, if you can do it, can be very very effective.

You could do that without a plain-text password, though with a salt it would be harder (though you could still do it proactively by checking the password when the account is made).

Re: Security by obscurity is underrated

#44

Post by weare138 »

cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

But the examples given won't help and is just bad advice in general.

- Assume for every code obfuscator there's a deobfuscator or at least someone as clever as you out there.

- Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker.

- Encrypting the database is an odd one. Your program will also have to decrypt the data to use it. Where do you store the encryption keys? In your code? Don't assume obfuscating your code and/or randomizing variables will protect your encryption keys.

Re: Security by obscurity is underrated

#45

Post by _tk_ »

To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323:

Typically you want to know who is connecting to what server via what service and log these connections. If something is off, an alert can be generated. If ssh isn't served on a standardized port, logging and alerting becomes more complicated - albeit not impossible.

There is more housekeeping to do. In case of a handoff, things like this need to be documented. If all services work on their default port, there is no need for documenting them.

In the case of compromise, it becomes very hard to identify how a machine got compromised.

Yes, a lot of people do not do a full port scan. But those are not the people exploiting risky vulnerabilities. Security by obscurity reduces your risk, but only to a certain extent. Having a proper patch management or firewall management in place reduces your risk a lot more.

A lot of owls do get killed by humans, despite their camouflage.

Re: Security by obscurity is underrated

#47

Post by burtonator »

I mean crypto is based on security by obscurity if you think about it. It's just REALLY obscure.

You can technically compute the private key for someone's Bitcoin wallet for example. It's just you'd hit the end of the heat death of the universe by then.

Re: Security by obscurity is underrated

#48

Post by [deleted] »

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

[deleted]

Re: Security by obscurity is underrated

#49

Post by calvinmorrison »

Security by Obscurity is great. This is a takeaway from the port knocking conversation here last week. If there's a zero day exploit in sshd, I'd rather it be behind some layer you would have to "know" to get in, rather than sitting open to the world. Why make your target bigger than it needs to be?

Re: Security by obscurity is underrated

#50

Post by GhostVII »

One thing I didn't see discussed in the article was the balance between the benefits of security by obscurity, and the benefits of having your code open source (or at least making your security methods known) so more people can audit it. Personally I don't actually think there is that much security benefit to having open source code since most people don't audit random codebases for fun, but that is one of the arguments I've heard against obscurity. Of course some methods of obscurity can still be done with open source code as well.
Post reply on HN