You misunderstood the term "obscurity" in this context. Of course there is something that identifies some user (sth. he knows / sth. he has), but "security thro

You misunderstood the term "obscurity" in this context. Of course there is something that identifies some user (sth. he knows / sth. he has), but "security through obscurity" denotes practices of hiding the way authentication process is planned / implemented. This hiding usually at best makes no difference to the safety of the system, but often actually lowers it. One of the reasons is because it makes it harder for independent security researchers to review it. Of course there are secrets in any access to a secure system. But they should be only those parts which are user specific (passwords, keys,...).