4 ms·
> At the worst, it doesn't hurt I do agree with the article, but at its worst, obscurity can hurt. Obscurity can add complexity, and it's said that "complexity
by ademarre 10y ago
> At the worst, it doesn't hurt
I do agree with the article, but at its worst, obscurity can hurt. Obscurity can add complexity, and it's said that "complexity is the enemy of security".
For example, sysadmins and maintainers could lose track of which layers are security and which are obscurity. In turn, this leads to decisions that compromise security because the maintainers overvalued the obscurity layers.
- zanny 10y agoNot just added complexity, but added sense of false security. To be in a situation where you consider obscurity even a cursory part of your infrastructure is the moment you are relying on it by the nature of considering it even a fraction of total security. It is only reasonable to consider when its both insignificant in the total security stem and you have the willpower of a monk to resist ever considering it valuable.
- jrochkind1 10y agoYep, complexity, the false sense of security you get from an inflated judgement of what it gives you, and the 'opportunity cost' of time you spent devising, implementing, and dealing with it instead of some actual secure protection.