3 ms·
Design is a separate process and skill than implementation. This applies to security and safety. There is no reason not to implement obscurity also. One thing
by TickleSteve 10y ago
Design is a separate process and skill than implementation.
This applies to security and safety. There is no reason not to implement obscurity also.
One thing I can guarantee is that your implementation of one security-type will not be unbreakable.... and neither will mine.
Better to add obscurity than not.
- type0 10y agoAgree. But one should design software without the obscurity layer, then it's okay to explain how obscurity can be set up during deployment.
- TickleSteve 10y agoabsolutely... given everything else is equal... adding obscurity is a positive.
- kelson 10y agoThe flaw may be assuming everything else can be equal in the real world. Obscuring the algorithm has downstream consequences that may/will reduce overall security. For example, hiding the algorithm from whitehats may prevent/discourage them from hunting/reporting bugs.
- type0 10y ago> For example, hiding the algorithm from whitehats may prevent/discourage them from hunting/reporting bugs. Yea, this is a serious concern, I guess it depends on use cases. For sure "security by obscurity considered harmful" could be true, thats the thing people overgeneralize and fight over it when this should be weighted depending on the circumstances.