Security by obscurity is underrated

Post by est » Sat, Sep 12, 2020, 4:50 AM UTC

b0rsuk wrote: post #245

Verdex wrote: post #65

Earlier quoted context omitted.

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

I've heard a better analogy - security by obscurity is like camouflage on a tank. A tank has massive armor and a terrifying gun to defend itself with. But even a half-assed camouflage can delay enemy reaction by a few seconds. Sometimes it's all it takes, because it lets you shoot first. In addition, the cost of camouflage paint or a net is laughably low and can be replaced in the field. It's simply an extra layer of…

Post by kstrauser » Sat, Sep 12, 2020, 5:14 AM UTC

weare138 wrote: post #424

kstrauser wrote: post #382

Earlier quoted context omitted.

I didn't take that away from the article at all. It said: > So let’s talk about security by obscurity. It’s a bad idea to use it as a single layer of defense. If the attacker passes it, there is nothing else to protect you. But it’s actually would be good to use it as an “additional” layer of defense. Because it has a low implementation cost and it usually works well. I think it's good to do those things in addition…

In addition to the stuff you should really being doing? That stuff is hard enough for beginners, without confusing them with speculation like this that goes against best practices and common sense, especially without clearly explaining the pitfalls and real dangers to each of these hypothetical scenarios. Besides, if you're already using industry accepted solutions to security problems and someone manages to gain una…

Post by [deleted] » Sat, Sep 12, 2020, 5:29 AM UTC

Post by sedatk » Sat, Sep 12, 2020, 5:47 AM UTC

sytse wrote: post #183

One downside of security by obscurity is that it makes it harder for whitehat people to spot problems in your code. It is like asking everyone $1000 to look at your source code. It is relatively more likely to deter whitehats since their upside is lower.

Post by cthalupa » Sat, Sep 12, 2020, 5:51 AM UTC

ThA0x2 wrote: post #450

cthalupa wrote: post #410

Earlier quoted context omitted.

>This just shows how ignorant you (and most) are on the topic of port knocking. You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not - I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. >SPA port knocking is cryptographically secure and does not suffer from r…

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that te…