Heavily agree with this. I read people stating "security by obscurity is bad" without really thinking about it all the time. For example, I think changing the

Heavily agree with this. I read people stating "security by obscurity is bad" without really thinking about it all the time. For example, I think changing the SSH server port and WordPress login pages are a good idea because 1) if a hacker cannot find the login location in the first place, your chance of getting hacked must decrease and 2) the number of intrusion attempts being logged will be significantly less so you can more usefully survey these for targeted attacks. Of course, relying only on obscurity is a terrible idea but you should have several layers of obstacles so if one fails the security violation will get caught at the next layer. Avoiding security through obscurity completely is more something you should do when designing a secure protocol or algorithm.