4 ms·
"you often put less work into securing it properly." Thats the problem right there.... not obscurity.
by TickleSteve 10y ago
"you often put less work into securing it properly."
Thats the problem right there.... not obscurity.
- Qwertious 10y agoWell, it would be if we were robots who could effectively separate the two problems. But we're not, so we need to avoid obscurity if we want security.
- TickleSteve 10y agoDesign is a separate process and skill than implementation. This applies to security and safety. There is no reason not to implement obscurity also. One thing I can guarantee is that your implementation of one security-type will not be unbreakable.... and neither will mine. Better to add obscurity than not.
- type0 10y agoAgree. But one should design software without the obscurity layer, then it's okay to explain how obscurity can be set up during deployment.
- TickleSteve 10y agoabsolutely... given everything else is equal... adding obscurity is a positive.
- kelson 10y agoThe flaw may be assuming everything else can be equal in the real world. Obscuring the algorithm has downstream consequences that may/will reduce overall security. For example, hiding the algorithm from whitehats may prevent/discourage them from hunting/reporting bugs.
- type0 10y ago> For example, hiding the algorithm from whitehats may prevent/discourage them from hunting/reporting bugs. Yea, this is a serious concern, I guess it depends on use cases. For sure "security by obscurity considered harmful" could be true, thats the thing people overgeneralize and fight over it when this should be weighted depending on the circumstances.
- lmm 10y agoBut if you do secure it properly, what value do you get from obscurity? I think the big problem with obscurity is that its impact is asymmetric in the wrong direction: it inconveniences white hats a lot more than black hats.
- TickleSteve 10y agoDefence in depth acknowledges that there is no perfect security system. Even if mathematically unbreakable, the implementation won't be. This is the whole premise of defence-in-depth... delay rather than prevent.
- lmm 10y agoWell sure, but there are still good and bad security systems. How does the cost/benefit of obscurity compare to alternatives?
- TickleSteve 10y agothat would be an interesting study... but one that is impractical I think.
- lmm 10y agoWell until there's evidence of it's effectiveness I'm going to avoid using obscurity. I know how to achieve an acceptably low break-in rate using mathematically valid encryption etc.. Defense in depth shouldn't be an excuse for using practices you haven't evaluated the effectiveness of at all.
- TickleSteve 10y agoYou're missing the point. An acceptably low break in rare using mathematically valid encryption.... Yes, fine... Given a perfect implementation. You haven't got one of those.