Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

431–440 of 530 posts

Re: Security by obscurity is underrated

#431

Post by scarby2 »

Retric wrote: post #364
acoard wrote: post #222

Earlier quoted context omitted.

Fair point! Obscurity as confusion is not what I had in mind, but your points on confusion are totally valid. Your analogy with predators works better here. Using base64 encoding, or encrypting your database, are both examples in the article. While I agree base64 is super trivial, the point about either of these is defence in depth. In the language of the article, it's reducing likelihood of being compromised. >If an…

There is supposed to be a response when a port is closed telling you the machine is online but not listening to that port. https://en.wikipedia.org/wiki/Port_scanner

most people have firewalls configured to simply drop traffic not destined for open ports, in which case there is no response as the traffic never makes it beyond the firewall.

Re: Security by obscurity is underrated

#432

Post by PowerBar »

draugadrotten wrote: post #254
tetha wrote: post #41

Earlier quoted context omitted.

Internally, we phrase it as "Make the system objectively hard, then don't tell all the details". Wasting an attackers time is a fine goal.

> Wasting an attackers time is a fine goal. reply This. Putting a tarpit on port 22 isn't going to stop an attacker, but it will slow the ssh scans down for everyone. https://github.com/skeeto/endlessh

Honeypots are fun, but be VERY careful how you deploy them. Ideally they are on a completely separate network on the WAN side of a second firewall. The last thing you want is for someone to find an exploit in your honeypot and use that to gain access to your network.

Re: Security by obscurity is underrated

#433

Post by mindfulhack »

The ironic thing is that it would be logical not to share or publish examples of security by obscurity, in order for them to be more effective!

Doesn't that reveal part of the problem of 'security by obscurity'?

Indeed, how many people publicly disavowing 'security by obscurity' do so to secretly benefit from the methodology?

Re: Security by obscurity is underrated

#434

Post by beefarino »

cthalupa wrote: post #405
beefarino wrote: post #392

Earlier quoted context omitted.

I'm struggling to walk away with a crystallized view of why port-knocking is bad, though. I do agree, nobody should be going to sleep at night, relying solely on obscurity as their source of protection. But these commenters are offering it as an additional layer of indirection. They're not touting it as _the_ solution, full stop. At the most basic level, would you refute the claim that port knocking or alternate port…

There's several components to this. Foremost, there is an opportunity cost to setting it up. The time you spend setting up port knocking could be spent setting up another form of security. I believe it is a sound argument to say that a VPN provides more security at a similar level effort. No public SSH means an attack cannot know SSH is running on the server from a port scan because it simply isn't listening. It allo…

Thanks, I appreciate the thoughtful response.

It sounds like port knocking and VPNs, while starkly different in approach, have some overlap in their approach to threat mitigation.

Wireguard et al are much better equipped to handle the needs of an organization, while port knocking's value trends to smaller teams, or even individuals.

I wouldn't want to manage knock rotations for 600 employees, for example.

Re: Security by obscurity is underrated

#435

Post by m3kw9 »

Ppl that say obscurity is bad must be saying look here try hacking my site, it’s unhackable and secure. Everyone knows it’s good, it just make you look weak to say obscurity is useful. Ppl are scared to admit how useful it is in security.

Re: Security by obscurity is underrated

#436

Post by rukuu001 »

cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

Sure, like giving a login page an unexpected URL to foil bots (eg hiding WordPress admin).

If that was the only security it’d be terrible.

But not having 1000s of bots pounding on the door saves a lot of headaches.

Re: Security by obscurity is underrated

#437

Post by kempbellt »

The best security is telling people:

I have a super secret password to my bank account! It's super hard to guess, and there's 12 factor authentication. You have to get my cat's paw print to sign in.

When the truth is: There is no bank account, password, or cat. And you are actually a homeless, broke, dog lover.

If you want to keep something secure, don't brag about how secure it is. Don't talk about it at all.

Re: Security by obscurity is underrated

#438

Post by will4274 »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

> In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else.

I think this analogy perfectly explains my hostility to security by obscurity. When I see a system that uses standard ports and demonstrates best practices, I think "oh well, they probably know what they are doing." When I see a system using strange ports and / or has extra extraneous crypto, I think "well, maybe this guy is an idiot" and take a deeper look.

Post reply on HN