4 ms·

Hiding your contact information is like security through obscurity. I'm not saying it's not a good extra step to decrease the frequency of attacks (much like ch

Hiding your contact information is like security through obscurity. I'm not saying it's not a good extra step to decrease the frequency of attacks (much like changing an SSH port to 3857 or something), but it doesn't add any real security. This is the crux of the problem; our addressees and birthdays are treated like passwords by these companies.

iopq 11y ago
Passwords are also security by obscurity.
- andrepd 11y ago
  Ssh ports are brute forceable, passwords have a much much larger search space.
  - MertsA 11y ago
    At this point, 16 bits of entropy is more than the entropy of a lot of the passwords that I've seen.
    - richardwhiuk 11y ago
      You have 10 bits of entropy at best, unless you put it above 1024, at which point if it dies, any none privileged user on the box can sniff passwords.
      - arielb1 11y ago
        If you are serious, you should limit SSH access to a bastion host with no unprivileged users.
      - Dylan16807 11y ago
        Why are you using passwords for SSH? Do you actually have untrusted users on the box? Why would you not secure the custom port to root-only?
  - SXX 11y ago
    Changed SSH port is not security measure. It's needed to keep your log files clear from random network scanning. When your SSH port is something like 53148 and you see password brute-force activity in logs it's almost always mean that somebody intentionally scanning your server.
    - zifnab06 11y ago
      Just a note: if you do change it, keep it below 1024. Otherwise if ssh dies anyone on the server can create a client listening on that port and steal credentials.
    - acdha 11y ago
      That's a somewhat obsolete belief – people have been scanning arbitrary ports for many, many years and SSH daemons helpfully announce themselves to search engines: https://www.shodan.io/report/uMZDnWfT https://www.shodan.io/report/uMZDnWfT This is a long-running problem and one with various popular solutions: restrict the source networks which you accept traffic for, disable password authentication entirely, and add some sort of rate limiting (e.g. 2004's fail2ban) for failures. Trying to reduce log volume by obscurity is futile - you really need to address the root problem and use tools which allow you to filter and aggregate effectively.
- andrewaylett 11y ago
  Not really -- security by obscurity is a re-statement of the idea that the security mechanism shouldn't need to be secret for the security to have meaning. You're allowed to have secret data, just not secret mechanism. And relying on what looks like secret data (changing the SSH port) where the number of bits of entropy is low enough that it's plausible to try them all (16) probably still counts as security by obscurity -- it might hide you from many attackers, but it's not enough to make you secure. Relying on data that's not actually secret, just hard to find, is just insecure.
  - noja 11y ago
    > but it's not enough to make you secure. That's not why you change the ssh port at all. You change the ssh port to filter out false positives, if someone is attacking you on your weirdo ssh port, it's likely an actual attack that you need to pay attention to. You still need to do the rest of the security stuff.
- lmm 11y ago
  Passwords are explicitly keys and not used for any other purpose.
deleted 11y ago
[deleted]

iopq 11y ago

Passwords are also security by obscurity.

andrepd 11y ago
Ssh ports are brute forceable, passwords have a much much larger search space.
- MertsA 11y ago
  At this point, 16 bits of entropy is more than the entropy of a lot of the passwords that I've seen.
  - richardwhiuk 11y ago
    You have 10 bits of entropy at best, unless you put it above 1024, at which point if it dies, any none privileged user on the box can sniff passwords.
    - arielb1 11y ago
      If you are serious, you should limit SSH access to a bastion host with no unprivileged users.
    - Dylan16807 11y ago
      Why are you using passwords for SSH? Do you actually have untrusted users on the box? Why would you not secure the custom port to root-only?
- SXX 11y ago
  Changed SSH port is not security measure. It's needed to keep your log files clear from random network scanning. When your SSH port is something like 53148 and you see password brute-force activity in logs it's almost always mean that somebody intentionally scanning your server.
  - zifnab06 11y ago
    Just a note: if you do change it, keep it below 1024. Otherwise if ssh dies anyone on the server can create a client listening on that port and steal credentials.
  - acdha 11y ago
    That's a somewhat obsolete belief – people have been scanning arbitrary ports for many, many years and SSH daemons helpfully announce themselves to search engines: https://www.shodan.io/report/uMZDnWfT https://www.shodan.io/report/uMZDnWfT This is a long-running problem and one with various popular solutions: restrict the source networks which you accept traffic for, disable password authentication entirely, and add some sort of rate limiting (e.g. 2004's fail2ban) for failures. Trying to reduce log volume by obscurity is futile - you really need to address the root problem and use tools which allow you to filter and aggregate effectively.
andrewaylett 11y ago
Not really -- security by obscurity is a re-statement of the idea that the security mechanism shouldn't need to be secret for the security to have meaning. You're allowed to have secret data, just not secret mechanism. And relying on what looks like secret data (changing the SSH port) where the number of bits of entropy is low enough that it's plausible to try them all (16) probably still counts as security by obscurity -- it might hide you from many attackers, but it's not enough to make you secure. Relying on data that's not actually secret, just hard to find, is just insecure.
- noja 11y ago
  > but it's not enough to make you secure. That's not why you change the ssh port at all. You change the ssh port to filter out false positives, if someone is attacking you on your weirdo ssh port, it's likely an actual attack that you need to pay attention to. You still need to do the rest of the security stuff.
lmm 11y ago
Passwords are explicitly keys and not used for any other purpose.

deleted 11y ago

[deleted]