Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

51–60 of 530 posts

Re: Security by obscurity is underrated

#51

Post by abhishekjha »

tgb wrote: post #43
abhishekjha wrote: post #32

This came up in the stackoverflow podcast where Reddit founders were the guest. They mentioned that they stored plain text passwords initially which is fundamentally a bad design but at the same time it helps to block spam. If a user starts to create a lot of accounts programmatically they generally use the same password thus much easier to filter. Security via Obscurity, if you can do it, can be very very effective.

You could do that without a plain-text password, though with a salt it would be harder (though you could still do it proactively by checking the password when the account is made).

Yes, there was an ongoing criticism from Joel regarding storing plain text passwords.

Re: Security by obscurity is underrated

#52

Post by terlisimo »

Arguably, most security is security through obscurity.

No password -> simple password -> complex password

Plaintext -> Caesar cypher -> Vernier cypher -> modern cyphers

40-bit crypto -> 56-bit crypto -> 128-bit crypto -> 256-bit crypto

0.0.0.0 network allow-list -> /24 network allow-list -> /32 (per host) network allow-list

allow by default -> deny by default

standard port -> non-standard port

We just add layers of obscurity until they add up to "enough" and don't grow into "beyond tedious".

Re: Security by obscurity is underrated

#53

Post by Spivak »

3pt14159 wrote: post #15

In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal tha…

> "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity)

Thank you for being someone else who recognizes this. If having a secret piece of knowledge grants you access to the system then it's obscurity. Once we admit that then we can start talking about the difficulty of guessing that knowledge as the actual important factor.

Re: Security by obscurity is underrated

#54

Post by meowface »

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

It's not really a direct security advantage, so this is mostly off-topic, but changing the default port does greatly reduce log noise, and theoretically could be a bit less taxing for your network connection or CPU if it's a cheap server not intended for publicly hosting services. (If it is then the traffic would be a drop in the bucket compared to regular production traffic, though. And it's admittedly probably a drop in the bucket either way.)

Reducing log clutter alone probably does confer some small indirect benefit, since it's less likely a more sophisticated attempt or successful breach would go unnoticed when inspecting logs. (Assuming there's some SIEM log forwarding or that it's not a situation where an attacker was able to or wise enough to wipe logs.)

Re: Security by obscurity is underrated

#55

Post by formerly_proven »

fooblat wrote: post #29

To me this seems like a bit of a strawman argument. The claim was never that using obscurity is bad and should be avoided. As I first heard it, "Security through obscurity is not security" is saying that if you are relying on obscurity to keep your stuff secure then you aren't doing enough. I think this is still true and the conclusion of the article agrees Security by obscurity is not enough by itself. You should al…

> The claim was never that using obscurity is bad and should be avoided.

Yet. All of these are from HN.

> 3. Since when is obscurity a valid security measure?

> Security through obscurity, not a valid security plan.

> The problem with these "obscurity as a valid security layer" arguments is that there's already obscurity built into these protocols.

> Especially since most people believe "Obscurity" to still be a valid security technique.

> You're just reciting the same tired old rhetoric that security through obscurity is a valid defense mechanism. It's just not.

> I thought the general consensus here is that security by obscurity is bad.

> Obscurity is bad because it makes you _think_ it adds security.

> To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323: [...]

> I dismissed it as security through (bad) obscurity but is there a valid security reason to do this?

> Compression is not encryption and security by obscurity is bad practice.

> it's understood that security by obscurity is bad.

> Security by obscurity is bad, of course, but in that model it's such a minor factor.

And countless many more. Some of these reference "security by obscurity", which, if you're kind, you can interpret as "security only through obscurity" (though reading in context this mostly doesn't seem to be what is meant), while others dismiss obscurity entirely. You will also regularly find commenters lament this point of view as the "mainstream idiocy".

Re: Security by obscurity is underrated

#56

Post by josephcsible »

3pt14159 wrote: post #15

In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal tha…

> But then we all implement passwords (which is just security by obscurity)

No it isn't. Security by obscurity is explicitly keeping things other than passwords and keys secret.

Re: Security by obscurity is underrated

#57

Post by xioxox »

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

One advantage of putting ssh on a non-standard port is that your logs, which are otherwise filled with automated ssh break-in attempts, now become almost empty. It's much easier to look for other problems when the signal to noise is increased.

Re: Security by obscurity is underrated

#58

Post by n0on3 »

It seems to me that the article is missing a few of points on what "security by obscurity" means.

From Wikipedia: "reliance [...] on design or implementation secrecy as _the main method_ of providing security [...]"

So, to use the model mentioned in the article, a single slice of cheese. It's not "an additional layer of defense", it's the main one (so you have other... weaker layers? ¯\_(ツ)_/¯)

Second, "reliance on secrecy of design and implementation" is different from "reliance on secrecy of _whatever-else_", because design and implementation are most often either easily discoverable (sure, occasional skids might not scan port 64323 but what about someone who can observe your traffic?) or pretty much guaranteed to be discovered by adveraries with (not even as much as one might think) time and motivation.

Third, some of the examples mentioned (e.g., the decoy cars) are not even security by obscurity, that's called deception.

So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should never be your only (or your main) layer of defense.

Security by obscurity is not underrated, by definition it's just bad.

Re: Security by obscurity is underrated

#60

Post by jonfw »

dec0dedab0de wrote: post #7

I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?

port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits.

I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?

Post reply on HN