4 ms·

I'm convinced that its wrong to say there is no security in obscurity. It's just one more layer in what should be many, and it has many benefits(simple example:

• nickpsecurity 11y ago
  "and it has many benefits(simple example: ssh port changing at least reduces alert fatigue so I know when I get a lvl 10 from OSSEC I know I need to dig into it asap!)" Interesting point. False alarms were small enough that I never thought to measure the impact of alert fatigue in these changes. Might consider it in the future. "I'm convinced that its wrong to say there is no security in obscurity." It might help to just call what we're doing obfuscation. That's the proper term. Security by obscurity is either defined as or is connected to the concept that only hiding the details would keep you safe. In our examples, we're using a strong, security technique plus hiding a critical aspect of how we use it. Take away the hidden part, it's still at least as strong as a good, security technique. Hence, we're obfuscating otherwise good security rather than doing security by obscurity. "Sounds like you are doing great work!" Appreciate it! Email me if you want to see other solutions or essays I did. I let people copy them without fee so long as they give credit. No blog so it's currently a lot of text files and links to master copies on Schneier's blog.