Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

481–490 of 530 posts

Re: Security by obscurity is underrated

#481

Post by magicalhippo »

cthalupa wrote: post #423
magicalhippo wrote: post #414

Earlier quoted context omitted.

No because I have a firewall in front of the SSH, as mentioned. I would assume a firewall is in front of the VPN as well of course. So either only SSH is exposed to the public, or only VPN is exposed. Without an additional firewall after the VPN, how is my LAN more protected with the VPN vs SSH?

Your goal is to protect SSH, not the VPN network. The VPN network is just a tool for protecting SSH. With your configuration, all that needs to exist is an SSH 0 day to gain access to the server. With a VPN, they need that AND a 0 day for the VPN software to gain access to the server. You can have a more complex setup with a VPN, but that isn't the discussion here - the discussion is securing SSH. If you want to prov…

Fair enough, guess I was restricting my view to my bubble. For a single server sure defense in depth should work, assuming you're not running the VPN on the same box.

Re: Security by obscurity is underrated

#482

Post by teknopaul »

jacobolus wrote: post #349
Verdex wrote: post #111

Earlier quoted context omitted.

> This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). Most of the usages of "security through obscurity" that I've seen dissected and decried haven't been in the sense that something was being hidden, but rather that something was being confused. For…

“Security through obscurity” means something like e.g. “uses a bespoke unpublished crypto algorithm, in the hopes that nobody has put in the effort to exploit it yet.” Usually this is a poor choice vs. going with the published industry standard, because crypto is hard to get right, and people rolling their own implementations usually screw it up, making life much easier for dedicated attackers than trying to attack s…

You are making the same argument this article is trying to explain to you. Security by Obscurity is not bad because _on its own_ its not enough, its good because coupled with other layers it adds security. I have been told to remove security by obscurity layers from systems by people that don't grok this. Security was, in a few cases, reduced to nothing. Systems that have one industry standard approach only laid totally open on the Internet due to a single misconfiguration or a single CVE being published. Any other layer would have helped, however "insecure", but they were removed due to the misconception that the layers themselves were "insecure". I would go so far as to say the first layer should always be security by obscurity for any unique system. If you fire up a web server and have the first security requirement that each http request must have the header X-Wibble:wobble I promise you this layer of security will be working hard all day long. Cheap, impossible to get wrong, it's not sufficient but it works.

Re: Security by obscurity is underrated

#483

Post by eru »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

The security example of stotting would be the exact opposite:

Remove all obscurity and expose all your techniques and algorithms and setting up bounties for people to break your defences.

See eg https://cloud.google.com/beyondcorp and https://cloud.google.com/security/beyondprod where Google gives up on VPNs.

Re: Security by obscurity is underrated

#484

Post by phs318u »

One problem with “obscurity” is that - by design - as few people are aware of the detail as possible (otherwise it’s not obscure. That’s both it’s strength and it’s weakness. With far fewer eyeballs on it, it’s easy to think you’ve gotten it right, when in all likelihood you’ve probably gotten it wrong (somewhere).

Re: Security by obscurity is underrated

#485

Post by austincheney »

gowld wrote: post #191
PragmaticPulp wrote: post #122

Earlier quoted context omitted.

> An argument against obscurity is that it adds additional pains for your "regular" users (as in developers/3rd party developers/app developers) No one should be applying obscurity to public-facing APIs or anything for which documentation is widely distributed outside the company. A better example would be Snapchat's intense and always evolving obfuscation strategies: https://hot3eed.github.io/snap_part1_obfuscations…

When security is totally impossible because there is no way to distinguish a trusted party from an adversary, obscurity is the only hope.

If you cannot distinguish a trusted party from a malicious party everything is then potentially malicious. This is why we have certificates, certificate revocation, and trust authorities.

Re: Security by obscurity is underrated

#486

Post by aborsy »

cthalupa wrote: post #284
acoard wrote: post #273

Earlier quoted context omitted.

Here's a counter-example (I said else-where in this thread): Imagine a 0day for SSH drops tomorrow. Almost immediately script kiddies all over the world will be trying to take over everything running on port 22. I'll also point out that we're generally talking about different threat vectors here, so it's good to lay them out. I don't think obscurity helps against a persistent threat probing your network, it helps aga…

>Imagine a 0day for SSH drops tomorrow. Almost immediately script kiddies all over the world will be trying to take over everything running on port 22. Yep! And I should be clear: I am not saying just don't change the SSH port. I'm saying if you care about security, at a minimum disallow public access to SSH and set up a VPN at a minimum. >Unfortunately that's all too rare in most web-servers I see ( I'm a bit confus…

For a non-expert individual who would like to replace commercial cloud storage with a self hosted server such as a NAS, do all these steps apply equally?

I am limiting the services to simple storage.

Looks like maintaining a secure self cloud requires knowledge, effort and continuous monitoring and vigilance.

Re: Security by obscurity is underrated

#487

Post by blackflame7000 »

austincheney wrote: post #485
gowld wrote: post #191

Earlier quoted context omitted.

When security is totally impossible because there is no way to distinguish a trusted party from an adversary, obscurity is the only hope.

If you cannot distinguish a trusted party from a malicious party everything is then potentially malicious. This is why we have certificates, certificate revocation, and trust authorities.

And that works great until a trust authority gets compromised. It's for this reason why the US DoD has it's own root certificate authorities and thus many military websites actually look like they have invalid https certs. Browsers don't ship with DoD root certs installed as trusted.

Re: Security by obscurity is underrated

#488

Post by aborsy »

wglb wrote: post #394
somedude11 wrote: post #223

Earlier quoted context omitted.

The same with "GnuPG is bad" mantra on hackernews. There is nothing better that GPG currently for all its functionality and the only answer you get when asking for substitute is don't use this function or use some obscure application. Yeah right.

Age is demonstrably better: https://github.com/FiloSottile/age Also, an informed analysis of PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

It’s not an informed analysis, or even an analysis at all.

That’s not how analyzing algorithms or programs work. Even a basic threat model is missing.

Re: Security by obscurity is underrated

#489

Post by LoSboccacc »

cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

> Instead it was originally meant as "if your only security is obscurity, it's bad".

no, not really. what it means is: every important sytem has attackers trying to exploit it. finding an exploit is a series of hunches while probing the system as a blackbox, and you need just one; meanwhile a defender has to be methodical enough find them all.

given the differences, obscurity removes the defender ability to systematically analyze the system while on the other hand for an attacker it remains as much of a blackbox as it was before.

Re: Security by obscurity is underrated

#490

Post by aschatten »

Didn't Telegram challenge this rule as well? > * Never roll your own crypto Afaik, discovered practical vulnerabilities like [1], [2] were patched, and the rest are theoretical, like [3].

  > Using Symmetric Encryption in the Database: When you write data to the database, use a function like encryption_algorithm(data,key). Likewise, when you read data, use a function like decryption_algorithm(data,key). If the attacker can read your backend code, obviously he/she can decrypt your database.
I think the author misclassified this method. An actual encryption is not obscurity. It would be, sort of, if the key is stored in code. But when a proper key management is in place, it's a solid approach.

[1] https://news.ycombinator.com/item?id=6948742

[2] https://web.archive.org/web/20181118154823/https://www.alexr...

[3] https://eprint.iacr.org/2015/1177.pdf

Post reply on HN